spree_cm_commissioner 2.8.6 → 2.8.7.pre.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4099b82b9c0b05292b810ed04e00714e847c0f9757912ccfdb2fe9f98d0e79a9
-  data.tar.gz: 4047434d7d6aebaeca53abe171efbb02df51651cd31fb19824effc88e6dbaf0b
+  metadata.gz: 423377b68ab98a03dc1b8c6cf94df82ed330255cd5b5249e6fbd3efd97507e96
+  data.tar.gz: ced4f7bb4506a6d0652a305cba71c57b117328a5e3b7a55a7cdeb3755aa4d057
 SHA512:
-  metadata.gz: 3834ecd9e3496a49180c8be39c5bf8e4b81828f1f3a9dab73122fc772e63264e8f1d6a1ce30c634223e910b696bcedb30ecfcf1fe60ace739f1c1dc725a119df
-  data.tar.gz: b47b5250978bdd1eebcebcc74329f79ae74837a86d3167006539b68d73dc8835b81c03d877ae46441e939667f913dcf615c9ffeedccc21d980cda1e953eb96c1
+  metadata.gz: 41d86b9d82bbc702c8a04bff0b474c1daebbfed2cf0b0bb8b50fa8ee56358930e0cd98899d936f394ca005e62f93c92bfe8fc6cd8cbdf6d90e6db885c5a14d8e
+  data.tar.gz: ba9caa729146ca74e0ac1155f48ca54fa7baec727ffbf6d6ce591c872cf97688baa5b9efc7dcc1ef3e9b288ba1ea506c1d8b74b79e6e1a0cc236421fcdbdb004

data/.env.example

@@ -22,6 +22,11 @@ WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
 WAITING_ROOM_POSITION_STAMP_LIMIT=1000
 WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
+WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS=600 # Waiting Room step floor (10 min)
+WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS=300 # Queue step floor (5 min)
+WAITING_ROOM_MAX_WAIT_TO_DISPLAY_SECONDS=3600 # above this the ETA is hidden (1 h)
+WAITING_ROOM_CALLER_INTERVAL_SECONDS=60 # how often the caller runs; match the waiting_guests_caller cron
+WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating the ETA
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""
@@ -68,3 +73,6 @@ HOLD_COOLDOWN_AFTER_EXPIRY_IN_MINUTES=2     # Cooldown period before a user can
 
 # See: app/models/spree_cm_commissioner/payment_decorator.rb
 PAYMENT_INCOMPLETE_NOTIFICATION_DELAY_IN_MINUTES=5  # Delay before notifying a customer that their order is still unpaid after payment is created
+
+# See: app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb
+ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order integrity Telegram alert job (off by default to avoid flooding Telegram rate limits during traffic spikes)

data/.gitignore

@@ -34,3 +34,9 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude
+CLAUDE.md
+AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.6)
+    spree_cm_commissioner (2.8.7.pre.pre1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,6 +16,7 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
+      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -25,6 +26,7 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
+      ShowsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/import_new_orders_controller.rb

@@ -23,6 +23,31 @@ module Spree
           end
         end
       end
+
+      # POST: /admin/orders/import_new_orders/:id/cancel
+      def cancel
+        import = model_class.find(params[:id])
+        show_url = spree.admin_import_new_order_url(import.id)
+
+        unless import.cancellable?
+          flash[:error] = 'These orders cannot be canceled.' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to show_url and return
+        end
+
+        if params[:confirm_name].to_s.strip != import.name.to_s.strip
+          flash[:error] = 'Import name did not match. Cancellation aborted.' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to show_url and return
+        end
+
+        SpreeCmCommissioner::CancelImportOrderJob.perform_later(
+          import_order_id: import.id,
+          canceled_by_user_id: spree_current_user.id,
+          cancellation_reason: params[:cancellation_reason].to_s.strip.presence
+        )
+
+        flash[:success] = "Canceling orders from \"#{import.name}\". This runs in the background."
+        redirect_to show_url
+      end
     end
   end
 end

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -55,6 +56,24 @@ module Spree
         @taxon.build_ad_banner(attachment: permitted_resource_params.delete(:ad_banner)) if permitted_resource_params[:ad_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -44,6 +44,11 @@ module Spree
             def collection_finder
               SpreeCmCommissioner::Orders::FindByState
             end
+
+            # this allows fetching a single order regardless of its state.
+            def resource_finder
+              SpreeCmCommissioner::Orders::FindByAllState
+            end
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -31,12 +31,12 @@ module Spree
 
           def collection
             if spree_current_user.present?
-              spree_current_user.orders.payment.not_archived
+              spree_current_user.orders.not_archived
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived.without_user.where(token: order_tokens)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/ticket_transfers_controller.rb

@@ -86,9 +86,10 @@ module Spree
           end
 
           def collection
-            SpreeCmCommissioner::TicketTransfer.includes(:order,
-                                                         from_guest: [:event, { line_item: :product }]
-                                                        ).where(from_user_id: spree_current_user.id)
+            SpreeCmCommissioner::TicketTransfer
+              .includes(:order, from_guest: [:event, { line_item: :product }])
+              .where(from_user_id: spree_current_user.id)
+              .order(id: :desc)
           end
 
           def resource_serializer

data/app/controllers/spree/api/v2/tenant/ad_campaigns_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class AdCampaignsController < BaseController
+          private
+
+          def scope
+            Spree::Taxon.ad_campaigns
+                        .joins(:vendor)
+                        .includes(:advertisements)
+                        .where(spree_vendors: { tenant_id: @tenant.id })
+                        .where('spree_taxons.from_date <= ? OR spree_taxons.from_date IS NULL', Time.current)
+                        .where('spree_taxons.to_date >= ? OR spree_taxons.to_date IS NULL', Time.current)
+                        .order(created_at: :asc)
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::AdCampaignSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,6 +16,10 @@ module Spree
             set_current_tenant(@tenant)
           end
 
+          def current_vendor
+            @current_vendor ||= @tenant.active_vendor
+          end
+
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/episodes_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class EpisodesController < BaseController
+          private
+
+          def model_class
+            SpreeCmCommissioner::ShowEpisode
+          end
+
+          def resource
+            @resource ||= scope.find(params[:id])
+          end
+
+          def scope
+            current_season.episodes.where(product_type: :show_episode).includes(:voting_sessions, :vote_packages)
+          end
+
+          def current_season
+            @current_season ||= SpreeCmCommissioner::Show
+                                .where(vendor_id: @tenant.vendors.select(:id))
+                                .where.not(parent_id: nil)
+                                .find_by!(slug: params[:show_id])
+          end
+
+          def resource_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/free_vote_claims_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class FreeVoteClaimsController < BaseController
+          before_action :require_spree_current_user
+
+          def create
+            show = current_vendor.shows.find(params[:show_id])
+
+            result = SpreeCmCommissioner::VotingCredits::ClaimFreeVotes.new(
+              show: show,
+              user: spree_current_user,
+              tenant_id: MultiTenant.current_tenant_id,
+              votable_type: params[:votable_type],
+              votable_id: params[:votable_id]
+            ).call
+
+            if result.failure?
+              render_error_payload(result.error.to_s)
+            elsif result.value.nil?
+              head :no_content
+            else
+              render_serialized_payload { serialize_resource(result.value) }
+            end
+          end
+
+          private
+
+          def resource_serializer
+            Spree::V2::Tenant::VotingCreditSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -38,12 +38,12 @@ module Spree
 
           def collection
             if spree_current_user.present?
-              spree_current_user.orders.payment.not_archived
+              spree_current_user.orders.not_archived
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived.without_user.where(token: order_tokens)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewProductsController < ProductsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super.where(status: :active, preview: true)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .active
+                                 .where(preview: true)
+                                 .where(id: section_ids)
+                                 .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_shows_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewShowsController < ShowsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles
+                                            .where(previewable_type: SpreeCmCommissioner::Show.polymorphic_name)
+                                            .select(:previewable_id)
+            super.rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_taxons_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewTaxonsController < TaxonsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            MultiTenant.with(@tenant) do
+              model_class.where(preview: true, id: allowed_ids)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/show_contestants_controller.rb

@@ -0,0 +1,52 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowContestantsController < BaseController
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::ShowContestant
+          end
+
+          # override
+          def scope
+            return model_class.none unless current_show
+
+            model_class
+              .where(show_id: current_show.id)
+              .includes(
+                :show_contestant_images,
+                :show_contestant_videos,
+                :current_voting_session,
+                :voting_contestants,
+                assigned_show_person: :show_person_images,
+                show: [
+                  :parent,
+                  { episodes: :voting_sessions },
+                  { seasons: { episodes: :voting_sessions } }
+                ]
+              )
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            return SpreeCmCommissioner::Show.none if vendor_ids.blank?
+
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+
+          # override
+          def resource_serializer
+            Spree::V2::Tenant::ShowContestantSerializer
+          end
+        end
+      end
+    end
+  end
+end