spree_cm_commissioner 2.9.7 → 2.9.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e267212ae81075d66a95e65c2eb320ea05bc9b18f53b1bc4a74896639ddd4ed2
-  data.tar.gz: cc28b8d31dd89f481864b6f5c366d264335403ca4f8aaf9a00dbd39e502012b6
+  metadata.gz: 8eb692e530b34906dfca4d757e6382b9b643e18760fd38ba31507ceb24bb687b
+  data.tar.gz: 782a651003a7817fb539def0a19697d434978c51f7f48c0f2184b48fe87c1260
 SHA512:
-  metadata.gz: 7cb85b5d8aaac69dc845ddeb068ec96200cf400a7c6d9f3bd979681fe4d03dd08cf4358a059855825785d9524e1a4d04e0447e3b0bfc682f4827c1b09734fa7d
-  data.tar.gz: 5727d1541df27c51c58ef2b4a7e022096c62aa6666fcb58514dbe39621a44395478d1f5ea5ecef24280767c0d41f47e43f823276720ce63f45c7ef371278b0a8
+  metadata.gz: '090263c66bf5f79ea0edfcf6602185b0d80120f33308b2d0193cacf3bb2ebc5036543f1e1000b4e823a243a31cd3dc2eaf3e4b8772c6717d16891554b3da96a0'
+  data.tar.gz: 3540311c234819a354e154a532b7745e91ebf1faf7b15bcc40a5a6def80ea069d3820759b328decb2328f6ad60190a12686d5c23c0951c864ee89215160fd4a1

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.7)
+    spree_cm_commissioner (2.9.8)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/order_concern.rb

@@ -12,6 +12,7 @@ module SpreeCmCommissioner
       end
 
       @spree_current_order.last_ip_address = request.remote_ip
+      @spree_current_order.device_id = device_id if device_id.present?
       @spree_current_order
     end
 
@@ -25,5 +26,9 @@ module SpreeCmCommissioner
         state: params[:state]
       )
     end
+
+    def device_id
+      params[:device_id].presence
+    end
   end
 end

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -15,7 +15,8 @@ module Spree
               line_items: draft_order_line_items,
               user: spree_current_user,
               store: current_store,
-              currency: current_currency
+              currency: current_currency,
+              options: { device_id: params[:device_id], last_ip_address: request.remote_ip }
             )
 
             if result.success?

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -13,7 +13,8 @@ module Spree
               user: spree_current_user,
               store: current_store,
               currency: current_currency,
-              tenant: @tenant
+              tenant: @tenant,
+              options: { device_id: params[:device_id], last_ip_address: request.remote_ip }
             )
 
             if result.success?

data/app/interactors/spree_cm_commissioner/create_ticket.rb

@@ -117,12 +117,15 @@ module SpreeCmCommissioner
       end
     end
 
-    def ticket_params
+    def ticket_params # rubocop:disable Metrics/AbcSize
       {
         name: context.params[:name],
         price: context.params[:price],
         compare_at_price: context.params[:compare_at_price],
-        max_order_quantity: context.params[:max_order_quantity],
+        max_quantity_per_order: context.params[:max_quantity_per_order],
+        max_quantity_per_account: context.params[:max_quantity_per_account],
+        max_quantity_per_device: context.params[:max_quantity_per_device],
+        max_quantity_per_ip: context.params[:max_quantity_per_ip],
         available_on: context.params[:available_on],
         discontinue_on: context.params[:discontinue_on],
         description: context.params[:description],
@@ -132,7 +135,8 @@ module SpreeCmCommissioner
         shipping_category_id: context.params[:shipping_category_id],
         option_type_ids: context.params[:option_type_ids],
         allow_anonymous_booking: context.params[:allow_anonymous_booking],
-        allow_self_check_in: context.params[:allow_self_check_in]
+        allow_self_check_in: context.params[:allow_self_check_in],
+        purchasable_on: context.params[:purchasable_on] || 'both'
       }
     end
   end

data/app/models/concerns/spree_cm_commissioner/option_type_attr_type.rb

@@ -29,7 +29,6 @@ module SpreeCmCommissioner
       'duration-in-seconds' => 'integer',
       'payment-option' => 'payment_option',
       'delivery-option' => 'delivery_option',
-      'max-quantity-per-order' => 'integer',
       'due-date' => 'integer',
       'month' => 'integer',
       'number-of-adults' => 'integer',

data/app/models/concerns/spree_cm_commissioner/purchase_limitable.rb

@@ -0,0 +1,59 @@
+# Product-level purchase caps per buyer identity (order, account, device, IP).
+# Stored as public metadata and enforced at cart time by
+# SpreeCmCommissioner::LineItems::ValidatePurchaseLimits.
+module SpreeCmCommissioner
+  module PurchaseLimitable
+    extend ActiveSupport::Concern
+
+    PURCHASE_LIMIT_KEYS = %i[
+      max_quantity_per_order
+      max_quantity_per_account
+      max_quantity_per_device
+      max_quantity_per_ip
+    ].freeze
+
+    POSITIVE_INTEGER = { only_integer: true, greater_than: 0, message: :must_be_positive_integer }.freeze
+
+    included do
+      store_public_metadata :max_quantity_per_order,   :integer
+      store_public_metadata :max_quantity_per_account, :integer
+      store_public_metadata :max_quantity_per_device,  :integer
+      store_public_metadata :max_quantity_per_ip,      :integer
+
+      validates :max_quantity_per_order,   numericality: POSITIVE_INTEGER, allow_nil: true
+      validates :max_quantity_per_account, numericality: POSITIVE_INTEGER, allow_nil: true
+      validates :max_quantity_per_device,  numericality: POSITIVE_INTEGER, allow_nil: true
+      validates :max_quantity_per_ip,      numericality: POSITIVE_INTEGER, allow_nil: true
+
+      validate :validate_max_quantity_per_account
+      validate :validate_max_quantity_per_device
+
+      before_validation :normalize_purchase_limits
+    end
+
+    private
+
+    # A blank cap means "unset". store_public_metadata writes the raw value and its
+    # :integer reader casts with to_i, so a form-submitted "" would otherwise read back
+    # as 0 and fail both the numericality check and the metadata type check.
+    def normalize_purchase_limits
+      return if public_metadata.blank?
+
+      public_metadata.slice(*PURCHASE_LIMIT_KEYS.map(&:to_s)).each do |key, value|
+        public_metadata[key] = nil if value.blank?
+      end
+    end
+
+    def validate_max_quantity_per_account
+      return unless max_quantity_per_account.to_i.positive? && allow_anonymous_booking?
+
+      errors.add(:base, I18n.t('purchase_limit.account_cap_requires_named_booking'))
+    end
+
+    def validate_max_quantity_per_device
+      return unless max_quantity_per_device.to_i.positive? && !purchasable_on_app?
+
+      errors.add(:base, I18n.t('purchase_limit.device_cap_requires_app_only'))
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/variant_options_concern.rb

@@ -14,7 +14,6 @@ module SpreeCmCommissioner
                :duration_in_seconds,
                :payment_option,
                :delivery_option,
-               :max_quantity_per_order,
                :due_date,
                :month,
                :number_of_adults,

data/app/models/spree_cm_commissioner/line_item_decorator.rb

@@ -32,7 +32,7 @@ module SpreeCmCommissioner
       base.before_save :update_vendor_id
 
       base.before_create :add_due_date, if: :subscription?
-      base.validate :ensure_not_exceed_max_quantity_per_order, if: -> { variant&.max_quantity_per_order.present? }
+      base.validate :ensure_not_exceed_purchase_limits, if: -> { product.present? }
       base.validate :ensure_all_guests_have_blocks, if: :required_seat_selection?
 
       base.whitelisted_ransackable_associations |= %w[guests order]
@@ -290,8 +290,9 @@ module SpreeCmCommissioner
 
     private
 
-    def ensure_not_exceed_max_quantity_per_order
-      errors.add(:quantity, I18n.t('line_item.validation.exceeded_max_quantity_per_order')) if quantity > variant.max_quantity_per_order
+    def ensure_not_exceed_purchase_limits
+      result = SpreeCmCommissioner::LineItems::ValidatePurchaseLimits.call(line_item: self)
+      errors.add(:quantity, result.error.to_s) unless result.success?
     end
 
     def ensure_all_guests_have_blocks

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -11,6 +11,7 @@ module SpreeCmCommissioner
       base.include SpreeCmCommissioner::Integrations::IntegrationMappable
       base.include SpreeCmCommissioner::StoreMetadata
       base.include SpreeCmCommissioner::HomepageSectionRelatableConcern
+      base.include SpreeCmCommissioner::PurchaseLimitable
 
       base.delegate :is_open_dated, :is_open_dated?, to: :trip, allow_nil: true
 

data/app/models/spree_cm_commissioner/variant_options.rb

@@ -81,10 +81,6 @@ module SpreeCmCommissioner
       @delivery_option ||= option_value_name_for(option_type_name: 'delivery-option')
     end
 
-    def max_quantity_per_order
-      @max_quantity_per_order ||= option_value_name_for(option_type_name: 'max-quantity-per-order')&.to_i
-    end
-
     def due_date
       @due_date ||= option_value_name_for(option_type_name: 'due-date')&.to_i
     end

data/app/serializers/spree/v2/storefront/product_serializer_decorator.rb

@@ -54,6 +54,10 @@ module Spree
           base.cache_options store: nil
 
           base.attribute :action_button, &:action_button
+          base.attribute :max_quantity_per_order, &:max_quantity_per_order
+          base.attribute :max_quantity_per_account, &:max_quantity_per_account
+          base.attribute :max_quantity_per_device, &:max_quantity_per_device
+          base.attribute :max_quantity_per_ip, &:max_quantity_per_ip
         end
       end
     end

data/app/serializers/spree/v2/storefront/variant_serializer_decorator.rb

@@ -5,9 +5,10 @@ module Spree
         def self.prepended(base)
           base.attributes :need_confirmation, :product_type, :kyc, :allow_anonymous_booking,
                           :reminder_in_hours, :start_time, :delivery_option,
-                          :number_of_guests, :max_quantity_per_order, :discontinue_on, :high_demand
+                          :number_of_guests, :discontinue_on, :high_demand
 
           base.attribute :delivery_required, &:delivery_required?
+          base.attribute(:max_quantity_per_order) { |variant| variant.product&.max_quantity_per_order }
 
           base.has_many :stock_locations
           base.has_many :stock_items, serializer: ::SpreeCmCommissioner::V2::Storefront::StockItemSerializer

data/app/serializers/spree/v2/tenant/product_serializer.rb

@@ -8,6 +8,11 @@ module Spree
 
         # Overrided dynamic fields relationship of the parent serializer(Storefront).
         has_many :dynamic_fields, serializer: Spree::V2::Tenant::DynamicFieldSerializer
+
+        attribute :max_quantity_per_order, &:max_quantity_per_order
+        attribute :max_quantity_per_account, &:max_quantity_per_account
+        attribute :max_quantity_per_device, &:max_quantity_per_device
+        attribute :max_quantity_per_ip, &:max_quantity_per_ip
       end
     end
   end

data/app/serializers/spree/v2/tenant/variant_serializer.rb

@@ -30,9 +30,10 @@ module Spree
 
         attributes :need_confirmation, :product_type, :kyc, :allow_anonymous_booking,
                    :reminder_in_hours, :start_time, :delivery_option,
-                   :number_of_guests, :max_quantity_per_order, :discontinue_on, :high_demand
+                   :number_of_guests, :discontinue_on, :high_demand
 
         attribute :delivery_required, &:delivery_required?
+        attribute(:max_quantity_per_order) { |variant| variant.product&.max_quantity_per_order }
 
         belongs_to :product, serializer: Spree::V2::Storefront::ProductSerializer
 

data/app/services/spree_cm_commissioner/draft_order/create.rb

@@ -27,19 +27,28 @@ module SpreeCmCommissioner
     class Create
       prepend ::Spree::ServiceModule::Base
 
-      def call(line_items:, user: nil, store: nil, currency: nil, tenant: nil)
+      def call(line_items:, user: nil, store: nil, currency: nil, tenant: nil, options: {}) # rubocop:disable Metrics/ParameterLists
         return failure(nil, I18n.t('spree_cm_commissioner.draft_order.line_items_missing')) if line_items.blank?
 
-        order = create_order!(line_items, user, store, currency, tenant)
+        order = create_order!(line_items, user, store, currency, tenant, options)
         success(order: order)
       rescue StandardError => e
         failure(nil, e.message)
       end
 
-      def create_order!(line_items_params, user, store, currency, tenant)
+      def create_order!(line_items_params, user, store, currency, tenant, options) # rubocop:disable Metrics/ParameterLists
         store ||= Spree::Store.default
         currency ||= store&.default_currency
-        order = Spree::Order.new(state: 'cart', use_billing: true, user: user, store: store, currency: currency, tenant: tenant)
+        order = Spree::Order.new(
+          state: 'cart',
+          use_billing: true,
+          user: user,
+          store: store,
+          currency: currency,
+          tenant: tenant,
+          device_id: options[:device_id],
+          last_ip_address: options[:last_ip_address]
+        )
         line_items_params.each { |line_item_params| build_line_item!(order, store, line_item_params) }
 
         ActiveRecord::Base.transaction do

data/app/services/spree_cm_commissioner/line_items/validate_purchase_limits.rb

@@ -0,0 +1,97 @@
+# Per-product purchase caps, one independent check per scope. The order cap looks at a single
+# order; account/ip/device aggregate over the buyer's completed orders, so a customer can't
+# bypass a cap by splitting the purchase across carts.
+#
+# A cap of nil or 0 is off. A scope with no value on the order (guest order, no IP, no device
+# id) has nothing to count the buyer against, so its cap does not apply.
+#
+# Counting is a live aggregation over spree_orders/spree_line_items - no ledger table,
+# nothing to keep in sync, always reflects current order state.
+module SpreeCmCommissioner
+  module LineItems
+    class ValidatePurchaseLimits
+      prepend ::Spree::ServiceModule::Base
+
+      LimitExceededError = Class.new(StandardError)
+
+      COUNTED_STATES = %w[complete resumed].freeze
+
+      def call(line_item:)
+        @line_item = line_item
+        @product = line_item.product
+        @order = line_item.order
+
+        return success(nil) if @product.blank?
+
+        check_order_limit!
+        check_account_limit!
+        check_ip_limit!
+        check_device_limit!
+
+        success(nil)
+      rescue LimitExceededError => e
+        failure(nil, e.message)
+      end
+
+      private
+
+      def check_order_limit!
+        limit = @product.max_quantity_per_order.to_i
+        return unless limit.positive?
+        return if quantity_in_order <= limit
+
+        raise LimitExceededError, I18n.t('line_item.validation.exceeded_order_purchase_limit')
+      end
+
+      def check_account_limit!
+        limit = @product.max_quantity_per_account.to_i
+        return unless limit.positive? && @order&.user_id.present?
+        return if quantity_in_order + purchased_by(user_id: @order.user_id) <= limit
+
+        raise LimitExceededError, I18n.t('line_item.validation.exceeded_account_purchase_limit')
+      end
+
+      def check_ip_limit!
+        limit = @product.max_quantity_per_ip.to_i
+        return unless limit.positive? && @order&.last_ip_address.present?
+        return if quantity_in_order + purchased_by(last_ip_address: @order.last_ip_address) <= limit
+
+        raise LimitExceededError, I18n.t('line_item.validation.exceeded_ip_purchase_limit')
+      end
+
+      def check_device_limit!
+        limit = @product.max_quantity_per_device.to_i
+        return unless limit.positive? && @order&.device_id.present?
+        return if quantity_in_order + purchased_by(device_id: @order.device_id) <= limit
+
+        raise LimitExceededError, I18n.t('line_item.validation.exceeded_device_purchase_limit')
+      end
+
+      # Sums per product, not per line item: two variants of one product share one allowance,
+      # so 3 + 3 must not both pass a cap of 4.
+      def quantity_in_order
+        @quantity_in_order ||= begin
+          siblings = @order ? @order.line_items.reject { |item| item == @line_item } : []
+          # One variant load for the whole cart rather than one per sibling; already-loaded
+          # siblings are skipped.
+          ActiveRecord::Associations::Preloader.new(records: siblings, associations: :variant).call if siblings.any?
+
+          @line_item.quantity.to_i + siblings.sum { |item| item.variant&.product_id == @product.id ? item.quantity : 0 }
+        end
+      end
+
+      # What the buyer already holds for this product, outside the order being validated.
+      # product_id is not a column on spree_line_items - it is `delegate :product_id, to:
+      # :variant` - so the product filter joins through spree_variants, indexed on product_id.
+      def purchased_by(scope)
+        Spree::LineItem.joins(:order, :variant)
+                       .where(spree_orders: { state: COUNTED_STATES })
+                       .where(spree_orders: scope)
+                       .where(spree_variants: { product_id: @product.id })
+                       .where.not(spree_orders: { completed_at: nil })
+                       .where.not(spree_orders: { id: @line_item.order_id })
+                       .sum(:quantity)
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/load_test/generate_booking_ticket_data.rb

@@ -117,7 +117,7 @@ module SpreeCmCommissioner
           request_to_book_issue(variant),
           out_of_stock_issue(variant),
           seat_selection_issue(variant, product),
-          max_quantity_issue(variant),
+          max_quantity_issue(product),
           missing_event_issue(event)
         ].compact
       end
@@ -176,11 +176,11 @@ module SpreeCmCommissioner
         'Variant requires seat selection (it has seat blocks).'
       end
 
-      def max_quantity_issue(variant)
-        max = variant.max_quantity_per_order
+      def max_quantity_issue(product)
+        max = product.max_quantity_per_order
         return if max.blank? || max >= 1
 
-        "Variant max-quantity-per-order is #{max} (less than one ticket)."
+        "Product max_quantity_per_order is #{max} (less than one ticket)."
       end
 
       def missing_event_issue(event)

data/config/locales/en.yml

@@ -163,7 +163,10 @@ en:
 
   line_item:
     validation:
-      exceeded_max_quantity_per_order: "Exceeded maximum quantity per order"
+      exceeded_order_purchase_limit: "You have reached the maximum quantity allowed per order for this item."
+      exceeded_account_purchase_limit: "You have reached the purchase limit for this item."
+      exceeded_ip_purchase_limit: "This network has reached the purchase limit for this item."
+      exceeded_device_purchase_limit: "This device has reached the purchase limit for this item."
       seats_are_required: "Seats are required for all guests"
       blocks_are_reserved_by_other_guest: "Seats were recently reserved by another guest"
       blocks_are_reserved_by_other_guest_with_label: "Seat %{label} was recently reserved by another guest"
@@ -173,6 +176,14 @@ en:
       unable_to_save_reserved_block_record: "Unable to save seat reservation"
       unable_to_save_reserved_block_record_with_label: "Unable to save reservation for seat %{label}"
 
+  errors:
+    messages:
+      must_be_positive_integer: "must be a positive whole number"
+
+  purchase_limit:
+    device_cap_requires_app_only: "Device limit requires the ticket to be app-only."
+    account_cap_requires_named_booking: "Account limit requires anonymous booking to be off."
+
   vectors:
     icons:
       info_rules: 'Only allow <b>%{allow_extensions}</b> files. Icons are stored inside "images/" folder, eg. app/assets/images/backend-adjust.svg.'

data/config/locales/km.yml

@@ -133,7 +133,10 @@ km:
 
   line_item:
     validation:
-      exceeded_max_quantity_per_order: "លើសពីបរិមាណអតិបរមាក្នុងមួយការបញ្ជាទិញ"
+      exceeded_order_purchase_limit: "អ្នកបានឈានដល់ចំនួនអតិបរមាក្នុងមួយការបញ្ជាទិញសម្រាប់ទំនិញនេះ។"
+      exceeded_account_purchase_limit: "អ្នកបានឈានដល់ដែនកំណត់នៃការទិញសម្រាប់ទំនិញនេះ។"
+      exceeded_ip_purchase_limit: "បណ្តាញនេះបានឈានដល់ដែនកំណត់នៃការទិញសម្រាប់ទំនិញនេះ។"
+      exceeded_device_purchase_limit: "ឧបករណ៍នេះបានឈានដល់ដែនកំណត់នៃការទិញសម្រាប់ទំនិញនេះ។"
       seats_are_required: "ត្រូវការលេខកៅអីសម្រាប់ភ្ញៀវទាំងអស់"
       blocks_are_reserved_by_other_guest: "កៅអីត្រូវបានកក់ថ្មីៗដោយភ្ញៀវផ្សេងទៀត"
       blocks_are_reserved_by_other_guest_with_label: "កៅអី %{label} ត្រូវបានកក់ថ្មីៗដោយភ្ញៀវផ្សេងទៀត"
@@ -143,6 +146,14 @@ km:
       unable_to_save_reserved_block_record: "មិនអាចរក្សាទុកការកក់កៅអីបានទេ"
       unable_to_save_reserved_block_record_with_label: "មិនអាចរក្សាទុកការកក់សម្រាប់កៅអី %{label} បានទេ"
 
+  errors:
+    messages:
+      must_be_positive_integer: "ត្រូវតែជាចំនួនគត់វិជ្ជមាន"
+
+  purchase_limit:
+    device_cap_requires_app_only: "ដែនកំណត់តាមឧបករណ៍ត្រូវការឱ្យសំបុត្រមានតែក្នុងកម្មវិធីប៉ុណ្ណោះ។"
+    account_cap_requires_named_booking: "ដែនកំណត់តាមគណនីត្រូវការឱ្យបិទការកក់ដោយអនាមិក។"
+
   subscription:
     validation:
       out_of_range: "Subscription date is out of range."
@@ -436,11 +447,11 @@ km:
           attributes:
             base:
               last_contestant_in_parent_session: 'មិនអាចដកអ្នកចូលប្រកួតចុងក្រោយពី "%{session_name}" ព្រោះ session កូនពឹងផ្អែកលើវា'
-              advanced_from_session: 'ត្រូវបានដំឡើងពី session មុន ហើយមិនអាចដកចេញដោយផ្ទាល់បានទេ។ សូមលុបការដំឡើងនៅក្នុង session ប្រភពជំនួសវិញ។'
-              pre_vote_session: 'មិនអាចដកចេញពី pre-vote session បានទេ។'
-              has_advanced_to_session: 'ត្រូវបានកំណត់ឱ្យដំឡើងទៅ session មួយទៀត។ សូមលុបការដំឡើងជាមុនសិន មុននឹងដកអ្នកចូលប្រកួតនេះចេញ។'
+              advanced_from_session: "ត្រូវបានដំឡើងពី session មុន ហើយមិនអាចដកចេញដោយផ្ទាល់បានទេ។ សូមលុបការដំឡើងនៅក្នុង session ប្រភពជំនួសវិញ។"
+              pre_vote_session: "មិនអាចដកចេញពី pre-vote session បានទេ។"
+              has_advanced_to_session: "ត្រូវបានកំណត់ឱ្យដំឡើងទៅ session មួយទៀត។ សូមលុបការដំឡើងជាមុនសិន មុននឹងដកអ្នកចូលប្រកួតនេះចេញ។"
             advanced_to_id:
-              same_as_advanced_from: 'មិនអាចដូចនឹងអ្នកចូលប្រកួតដែលវាត្រូវបានដំឡើងចេញពីនោះទេ'
+              same_as_advanced_from: "មិនអាចដូចនឹងអ្នកចូលប្រកួតដែលវាត្រូវបានដំឡើងចេញពីនោះទេ"
         spree_cm_commissioner/voting_credit:
           attributes:
             free_votes_amount:

data/db/migrate/20260730000000_add_purchase_limit_scopes_to_spree_orders.rb

@@ -0,0 +1,22 @@
+class AddPurchaseLimitScopesToSpreeOrders < ActiveRecord::Migration[7.0]
+  # Partial, matching ValidatePurchaseLimits::COUNTED_STATES. Most spree_orders rows are
+  # abandoned carts the purchase-limit query never looks at, so indexing them only costs
+  # storage. Keeping state in the predicate also drops a varchar from every entry.
+  COUNTED = "state IN ('complete', 'resumed')".freeze
+
+  def up
+    add_column :spree_orders, :device_id, :string, if_not_exists: true
+
+    add_index :spree_orders, :user_id, where: COUNTED, name: 'idx_orders_user_for_limits', if_not_exists: true
+    add_index :spree_orders, :last_ip_address, where: COUNTED, name: 'idx_orders_ip_for_limits', if_not_exists: true
+    add_index :spree_orders, :device_id, where: COUNTED, name: 'idx_orders_device_for_limits', if_not_exists: true
+  end
+
+  def down
+    remove_index :spree_orders, name: 'idx_orders_user_for_limits', if_exists: true
+    remove_index :spree_orders, name: 'idx_orders_ip_for_limits', if_exists: true
+    remove_index :spree_orders, name: 'idx_orders_device_for_limits', if_exists: true
+
+    remove_column :spree_orders, :device_id, if_exists: true
+  end
+end

data/lib/spree_cm_commissioner/test_helper/factories/option_type_factory.rb

@@ -75,12 +75,6 @@ FactoryBot.define do
       presentation { 'delivery-option' }
     end
 
-    trait :max_quantity_per_order do
-      attr_type { :integer }
-      name { 'max-quantity-per-order' }
-      presentation { 'max-quantity-per-order' }
-    end
-
     trait :due_date do
       attr_type { :integer }
       name { 'due-date' }

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.9.7'.freeze
+  VERSION = '2.9.8'.freeze
 
   module_function
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.9.7
+  version: 2.9.8
 platform: ruby
 authors:
 - You
@@ -1482,6 +1482,7 @@ files:
 - app/models/concerns/spree_cm_commissioner/product_delegation.rb
 - app/models/concerns/spree_cm_commissioner/product_relation_type.rb
 - app/models/concerns/spree_cm_commissioner/product_type.rb
+- app/models/concerns/spree_cm_commissioner/purchase_limitable.rb
 - app/models/concerns/spree_cm_commissioner/route_order_countable.rb
 - app/models/concerns/spree_cm_commissioner/route_type.rb
 - app/models/concerns/spree_cm_commissioner/service_calendar_type.rb
@@ -2282,6 +2283,7 @@ files:
 - app/services/spree_cm_commissioner/invite_guests/bulk_create.rb
 - app/services/spree_cm_commissioner/invite_guests/create.rb
 - app/services/spree_cm_commissioner/line_items/sync_event_date.rb
+- app/services/spree_cm_commissioner/line_items/validate_purchase_limits.rb
 - app/services/spree_cm_commissioner/load_test/create_accounts.rb
 - app/services/spree_cm_commissioner/load_test/destroy_accounts.rb
 - app/services/spree_cm_commissioner/load_test/flow_registry.rb
@@ -3463,6 +3465,7 @@ files:
 - db/migrate/20260728074153_add_role_to_cm_exports.rb
 - db/migrate/20260729000000_add_visibility_to_cm_trips.rb
 - db/migrate/20260729000001_add_session_created_at_index_to_cm_votes.rb
+- db/migrate/20260730000000_add_purchase_limit_scopes_to_spree_orders.rb
 - docker-compose.yml
 - docs/api/scoped-access-token-endpoints.md
 - docs/option_types/attr_types.md