spree_cm_commissioner 2.9.1.pre.pre2 → 2.9.1.pre.pre3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44f0714e8ec1fab5074038112f26db55308feffc75b103ccda9e9d5d5d38409a
-  data.tar.gz: 7f963001ae3a8de9f3f829d03eb83f6a2d310cf5a28ddafc477473e1b2fa9678
+  metadata.gz: 84c27f4187a23acbe9422e5b33cba6cca077dee5fe7a5e879acd3a5d06ee20c9
+  data.tar.gz: e46311b9f88d5a32ddb2272506e99dc1aee786acf800163a833134d942705bc1
 SHA512:
-  metadata.gz: 2afbdbb418fbdca1c4ebfb9c6327a5fb0394663b87881e3ce56950c1aca7e4a1467708c6249ad2bab098564349d432187866966b6704e662ca87b34966466760
-  data.tar.gz: 569d3213e604558bf4d17134aa51fd8cb2e854780f141187a6bff0af167070fe4c53b5f9eda404f4c38c47659aa79fed702ad1f801dc61d9d62d9ceb775e4480
+  metadata.gz: f679ac4607b2c7a6b01d6151605cd7339ff57ad721bb18708cff888362b4c19bb9b7f9847016b3e1f93fd0ce31a74635eb6635de83f6764b89873fc44aeb8d2e
+  data.tar.gz: 0705c2ddb0b22a1bd2581645cfe18f2488b7aaf827ba90873130c782ac253fd95a50aa9795f982b863fc401744eb8654bc4c225caebec1af08965bab8144c72f

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.1.pre.pre2)
+    spree_cm_commissioner (2.9.1.pre.pre3)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/api/v2/tenant/user_account_linkages_controller.rb

@@ -15,8 +15,7 @@ module Spree
             context = SpreeCmCommissioner::AccountLinkage.call(
               user: spree_current_user,
               id_token: params[:id_token],
-              fb_access_token: params[:fb_access_token],
-              fb_jwt: params[:fb_jwt]
+              fb_access_token: params[:fb_access_token]
             )
 
             if context.success?

data/app/controllers/spree_cm_commissioner/api/v2/storefront/checkout_controller_decorator.rb

@@ -7,9 +7,22 @@ module SpreeCmCommissioner
             base.include SpreeCmCommissioner::OrderConcern
             base.include SpreeCmCommissioner::TurnstileProtectable
 
-            base.before_action -> { verify_turnstile! }, only: %i[advance create_payment]
+            base.before_action :set_load_test_bypass_current
+            base.before_action -> { verify_turnstile! }, only: %i[create_payment]
           end
 
+          private
+
+          def set_load_test_bypass_current
+            key = ENV.fetch('LOAD_TEST_BYPASS_KEY', nil)
+            return if key.blank?
+
+            provided = request.headers.fetch('X-Request-Verify', nil).to_s
+            SpreeCmCommissioner::Current.load_test_bypass = ActiveSupport::SecurityUtils.secure_compare(provided, key)
+          end
+
+          public
+
           # Override Spree's default behavior:
           # By default, Spree raises an error if `complete` is called on a completed or confirmed order.
           # We want to allow this call to succeed, so the API can be used both to:

data/app/interactors/spree_cm_commissioner/account_linkage.rb

@@ -1,7 +1,7 @@
 module SpreeCmCommissioner
   class AccountLinkage
     include Interactor
-    delegate :id_token, :fb_access_token, :fb_jwt, :user, to: :context
+    delegate :id_token, :fb_access_token, :user, to: :context
 
     # id_token:, user:
     def call
@@ -10,8 +10,6 @@ module SpreeCmCommissioner
         handle_id_token
       elsif fb_access_token.present?
         handle_fb_access_token
-      elsif fb_jwt.present?
-        handle_fb_jwt
       else
         context.fail!(message: 'missing_social_token')
       end
@@ -39,16 +37,6 @@ module SpreeCmCommissioner
       end
     end
 
-    def handle_fb_jwt
-      facebook_context = FetchFacebookUserDataFromJwt.call(fb_jwt: fb_jwt)
-
-      if facebook_context.success?
-        build_user_identify_provider(facebook_context.provider)
-      else
-        context.fail!(message: facebook_context.message)
-      end
-    end
-
     # {
     #   provider_name: provider_name,
     #   email: email,

data/app/interactors/spree_cm_commissioner/user_fb_token_authenticator.rb

@@ -5,7 +5,6 @@ module SpreeCmCommissioner
     # :fb_access_token, :tenant_id (optional)
     def call
       context.fail!(message: 'fb_access_token_missing') unless fb_access_token
-      context.fail!(message: checker.message) if checker.failure?
 
       context.user = if checker.user.nil?
                        register_user

data/app/models/spree_cm_commissioner/current.rb

@@ -0,0 +1,8 @@
+module SpreeCmCommissioner
+  class Current < ActiveSupport::CurrentAttributes
+    # Set to true for the duration of a load-test request so that rate-limiting
+    # services deeper in the call chain (e.g. InventoryHolds::ValidateLimits) can
+    # skip their checks without needing the request object threaded through them.
+    attribute :load_test_bypass
+  end
+end

data/app/request_schemas/spree_cm_commissioner/user_account_linkage_request_schema.rb

@@ -3,15 +3,13 @@ module SpreeCmCommissioner
     params do
       optional(:id_token).maybe(:string)
       optional(:fb_access_token).maybe(:string)
-      optional(:fb_jwt).maybe(:string)
     end
 
-    rule(:id_token, :fb_access_token, :fb_jwt) do
+    rule(:id_token, :fb_access_token) do
       idt = values[:id_token]
       fbt = values[:fb_access_token]
-      fbj = values[:fb_jwt]
 
-      key(:base).failure('id_token_or_fb_access_token_required') if blank_or_empty?(idt) && blank_or_empty?(fbt) && blank_or_empty?(fbj)
+      key(:base).failure('id_token_or_fb_access_token_required') if blank_or_empty?(idt) && blank_or_empty?(fbt)
     end
 
     private

data/app/services/spree_cm_commissioner/inventory_holds/validate_limits.rb

@@ -15,7 +15,7 @@ module SpreeCmCommissioner
       # Validates all inventory hold limits for the given order
       def call(order:)
         validate_user_hold_limits!(order) if order.user.present?
-        validate_ip_rate_limit!(order)
+        validate_ip_rate_limit!(order) unless SpreeCmCommissioner::Current.load_test_bypass
         validate_cooldown!(order)
 
         success(nil)

data/app/services/spree_cm_commissioner/user_authenticator.rb

@@ -4,7 +4,6 @@ module SpreeCmCommissioner
     # :username, :password
     # :id_token
     # :fb_access_token
-    # :fb_jwt
     # :telegram_init_data, :tg_bot
     # :session_id
 
@@ -43,9 +42,6 @@ module SpreeCmCommissioner
       when 'facebook_auth'
         options = { fb_access_token: params[:fb_access_token], tenant_id: tenant_id }
         SpreeCmCommissioner::UserFbTokenAuthenticator.call(options)
-      when 'facebook_jwt_auth'
-        options = { fb_jwt: params[:fb_jwt], tenant_id: tenant_id }
-        SpreeCmCommissioner::UserFbJwtAuthenticator.call(options)
       when 'telegram_web_app_auth'
         options = { telegram_init_data: params[:telegram_init_data], telegram_bot_username: params[:tg_bot] }
         SpreeCmCommissioner::UserTelegramWebAppAuthenticator.call(options)
@@ -59,7 +55,6 @@ module SpreeCmCommissioner
       return 'login_auth' if params.key?(:username) && params.key?(:password)
       return 'social_auth' if params.key?(:id_token)
       return 'facebook_auth' if params.key?(:fb_access_token)
-      return 'facebook_jwt_auth' if params.key?(:fb_jwt)
       return 'telegram_web_app_auth' if params.key?(:telegram_init_data) && params.key?(:tg_bot)
       return 'vattanac_bank_web_app_auth' if params.key?(:session_id)
 

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.9.1.pre.pre2'.freeze
+  VERSION = '2.9.1.pre.pre3'.freeze
 
   module_function
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.9.1.pre.pre2
+  version: 2.9.1.pre.pre3
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
@@ -1243,7 +1243,6 @@ files:
 - app/interactors/spree_cm_commissioner/event_qr_generator.rb
 - app/interactors/spree_cm_commissioner/existing_account_checker.rb
 - app/interactors/spree_cm_commissioner/fetch_facebook_user_data.rb
-- app/interactors/spree_cm_commissioner/fetch_facebook_user_data_from_jwt.rb
 - app/interactors/spree_cm_commissioner/firebase_email_fetcher.rb
 - app/interactors/spree_cm_commissioner/firebase_email_fetcher_cron_executor.rb
 - app/interactors/spree_cm_commissioner/firebase_id_token_provider.rb
@@ -1320,8 +1319,6 @@ files:
 - app/interactors/spree_cm_commissioner/user_contact_updater.rb
 - app/interactors/spree_cm_commissioner/user_device_token_deregister.rb
 - app/interactors/spree_cm_commissioner/user_device_token_register.rb
-- app/interactors/spree_cm_commissioner/user_fb_jwt_authenticator.rb
-- app/interactors/spree_cm_commissioner/user_fb_jwt_checker.rb
 - app/interactors/spree_cm_commissioner/user_fb_token_authenticator.rb
 - app/interactors/spree_cm_commissioner/user_fb_token_checker.rb
 - app/interactors/spree_cm_commissioner/user_forgotten_password_updater.rb
@@ -1515,6 +1512,7 @@ files:
 - app/models/spree_cm_commissioner/configuration.rb
 - app/models/spree_cm_commissioner/crew_invite.rb
 - app/models/spree_cm_commissioner/crew_invite_link.rb
+- app/models/spree_cm_commissioner/current.rb
 - app/models/spree_cm_commissioner/customer.rb
 - app/models/spree_cm_commissioner/customer_notification.rb
 - app/models/spree_cm_commissioner/customer_promotion_rule.rb

data/app/interactors/spree_cm_commissioner/fetch_facebook_user_data_from_jwt.rb

@@ -1,90 +0,0 @@
-module SpreeCmCommissioner
-  class FetchFacebookUserDataFromJwt < BaseInteractor
-    JWKS_URL = 'https://limited.facebook.com/.well-known/oauth/openid/jwks/'.freeze
-    EXPECTED_ISSUER = 'https://www.facebook.com'.freeze
-
-    delegate :fb_jwt, to: :context
-
-    def call
-      context.fail!(message: 'fb_jwt_missing') if fb_jwt.blank?
-
-      claim = decode_jwt
-
-      context.provider = {
-        identity_type: SpreeCmCommissioner::UserIdentityProvider.identity_types[:facebook],
-        sub: claim['sub'],
-        name: claim['name'],
-        email: nil, # Facebook Limited Login JWT does not include email
-        first_name: claim['given_name'],
-        last_name: claim['family_name'],
-        picture: claim['picture']
-      }
-    end
-
-    private
-
-    def decode_jwt
-      result = JWT.decode(fb_jwt, nil, true, algorithms: ['RS256']) do |header|
-        kid = header['kid']
-        jwk_data = find_jwk(fetch_jwks, kid) || find_jwk(refresh_jwks, kid)
-        context.fail!(message: 'invalid_facebook_jwt_kid') unless jwk_data
-        public_key_from_jwk(jwk_data)
-      end
-
-      claim = result[0]
-      context.fail!(message: 'invalid_facebook_issuer') if claim['iss'] != EXPECTED_ISSUER
-      claim
-    rescue JWT::ExpiredSignature
-      context.fail!(message: 'fb_jwt_expired')
-    rescue JWT::DecodeError => e
-      context.fail!(message: e.message)
-    end
-
-    def find_jwk(jwks, kid)
-      jwks['keys'].find { |k| k['kid'] == kid }
-    end
-
-    def public_key_from_jwk(jwk_data)
-      n = OpenSSL::BN.new(Base64.urlsafe_decode64(jwk_data['n']), 2)
-      e = OpenSSL::BN.new(Base64.urlsafe_decode64(jwk_data['e']), 2)
-
-      pkcs1 = OpenSSL::ASN1::Sequence([
-        OpenSSL::ASN1::Integer(n),
-        OpenSSL::ASN1::Integer(e)
-      ]
-                                     )
-
-      spki = OpenSSL::ASN1::Sequence([
-        OpenSSL::ASN1::Sequence([
-          OpenSSL::ASN1::ObjectId('rsaEncryption'),
-          OpenSSL::ASN1::Null(nil)
-        ]
-                               ),
-        OpenSSL::ASN1::BitString(pkcs1.to_der)
-      ]
-                                    )
-
-      OpenSSL::PKey::RSA.new(spki.to_der)
-    end
-
-    def refresh_jwks
-      Rails.cache.delete('facebook-limited-jwks')
-      fetch_jwks
-    end
-
-    def fetch_jwks
-      Rails.cache.fetch('facebook-limited-jwks', expires_in: 1.hour) do
-        url = URI(JWKS_URL)
-        http = Net::HTTP.new(url.host, url.port)
-        http.use_ssl = true
-        http.open_timeout = 5
-        http.read_timeout = 10
-        response = http.get(url.request_uri)
-        JSON.parse(response.body)
-      end
-    rescue StandardError => e
-      CmAppLogger.error("Facebook JWKS fetch error: #{e.message}")
-      context.fail!(message: 'facebook_jwks_fetch_error')
-    end
-  end
-end

data/app/interactors/spree_cm_commissioner/user_fb_jwt_authenticator.rb

@@ -1,37 +0,0 @@
-module SpreeCmCommissioner
-  class UserFbJwtAuthenticator < BaseInteractor
-    delegate :fb_jwt, :tenant_id, to: :context
-
-    # :fb_jwt, :tenant_id (optional)
-    def call
-      context.fail!(message: 'fb_jwt_missing') unless fb_jwt
-      context.fail!(message: checker.message) if checker.failure?
-
-      context.user = if checker.user.nil?
-                       register_user
-                     else
-                       checker.user
-                     end
-
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
-    end
-
-    private
-
-    def checker
-      @checker ||= SpreeCmCommissioner::UserFbJwtChecker.call(
-        fb_jwt: fb_jwt,
-        tenant_id: tenant_id
-      )
-    end
-
-    def register_user
-      register_context = SpreeCmCommissioner::UserRegistrationWithFbToken.call(
-        provider: checker.provider,
-        tenant_id: tenant_id
-      )
-
-      register_context.user
-    end
-  end
-end

data/app/interactors/spree_cm_commissioner/user_fb_jwt_checker.rb

@@ -1,20 +0,0 @@
-module SpreeCmCommissioner
-  class UserFbJwtChecker < BaseInteractor
-    delegate :tenant_id, :fb_jwt, to: :context
-
-    def call
-      fb_data = SpreeCmCommissioner::FetchFacebookUserDataFromJwt.call(fb_jwt: fb_jwt)
-      context.fail!(message: fb_data.message) if fb_data.failure?
-
-      context.provider = fb_data.provider
-
-      identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
-        identity_type: context.provider[:identity_type],
-        sub: context.provider[:sub],
-        tenant_id: tenant_id
-      )
-
-      context.user = identity_checker.success? ? identity_checker.user : nil
-    end
-  end
-end