activemerchant 1.133.0 → 1.138.0

data/lib/active_merchant/billing/gateways/cyber_source.rb

@@ -1,5 +1,7 @@
-module ActiveMerchant #:nodoc:
-  module Billing #:nodoc:
+require 'nokogiri'
+
+module ActiveMerchant # :nodoc:
+  module Billing # :nodoc:
     # Initial setup instructions can be found in
     # http://apps.cybersource.com/library/documentation/dev_guides/SOAP_Toolkits/SOAP_toolkits.pdf
     #
@@ -33,9 +35,29 @@ module ActiveMerchant #:nodoc:
         discover: 'pb',
         diners_club: 'pb'
       }.freeze
+      THREEDS_EXEMPTIONS = {
+        authentication_outage: 'authenticationOutageExemptionIndicator',
+        corporate_card: 'secureCorporatePaymentIndicator',
+        delegated_authentication: 'delegatedAuthenticationExemptionIndicator',
+        low_risk: 'riskAnalysisExemptionIndicator',
+        low_value: 'lowValueExemptionIndicator',
+        trusted_merchant: 'trustedMerchantExemptionIndicator'
+      }
       DEFAULT_COLLECTION_INDICATOR = 2
 
-      self.supported_cardtypes = %i[visa master american_express discover diners_club jcb dankort maestro elo]
+      NS_DS = 'http://www.w3.org/2000/09/xmldsig#'
+      NS_WSSE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'
+      C14N_ALGORITHM = 'http://www.w3.org/2001/10/xml-exc-c14n#'
+      RSA_SHA256_ALGORITHM = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
+      SHA256_ALGORITHM = 'http://www.w3.org/2001/04/xmlenc#sha256'
+      BINARY_SECURITY_TOKEN_PROFILE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3'
+      BINARY_SECURITY_TOKEN_TYPE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary'
+      BINARY_SECURITY_TOKEN_WSU = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'
+      BINARY_SECURITY_TOKEN_ID = 'X509Token'
+      USERNAME_TOKEN_PROFILE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText'
+      ENVELOPE = 'http://schemas.xmlsoap.org/soap/envelope/'
+
+      self.supported_cardtypes = %i[visa master american_express discover diners_club jcb dankort maestro elo patagonia_365 tarjeta_sol]
       self.supported_countries = %w(US AE BR CA CN DK FI FR DE IN JP MX NO SE GB SG LB PK)
 
       self.default_currency = 'USD'
@@ -53,7 +75,8 @@ module ActiveMerchant #:nodoc:
         jcb: '007',
         dankort: '034',
         maestro: '042',
-        elo: '054'
+        elo: '054',
+        carnet: '002'
       }
 
       @@decision_codes = {
@@ -132,11 +155,16 @@ module ActiveMerchant #:nodoc:
         r703: 'Export hostname_country/ip_country match'
       }
 
-      @@payment_solution = {
+      @@wallet_payment_solution = {
         apple_pay: '001',
         google_pay: '012'
       }
 
+      NT_PAYMENT_SOLUTION = {
+        'master' => '014',
+        'visa' => '015'
+      }
+
       # These are the options that can be used when creating a new CyberSource
       # Gateway object.
       #
@@ -157,13 +185,24 @@ module ActiveMerchant #:nodoc:
       # :ignore_cvv => true   don't want to use CVV so continue processing even
       #                       if CVV would have failed
       def initialize(options = {})
-        requires!(options, :login, :password)
+        if options[:public_key]
+          requires!(options, :login, :public_key, :private_key)
+        else
+          requires!(options, :login, :password)
+        end
+
         super
       end
 
-      def authorize(money, creditcard_or_reference, options = {})
-        setup_address_hash(options)
-        commit(build_auth_request(money, creditcard_or_reference, options), :authorize, money, options)
+      def authorize(money, payment_method, options = {})
+        if valid_payment_method?(payment_method, options)
+          setup_address_hash(options)
+          commit(build_auth_request(money, payment_method, options), :authorize, money, options)
+        else
+          # this is for NetworkToken, ApplePay or GooglePay brands that aren't supported at CyberSource
+          payment_type = payment_method.source.to_s.gsub('_', ' ').titleize.gsub(' ', '')
+          Response.new(false, "#{card_brand(payment_method).capitalize} is not supported by #{payment_type} at CyberSource, check https://developer.cybersource.com/docs/cybs/en-us/payments/developer/all/rest/payments/CreatingOnlineAuth/CreatingAuthReqPNT.html")
+        end
       end
 
       def capture(money, authorization, options = {})
@@ -171,9 +210,15 @@ module ActiveMerchant #:nodoc:
         commit(build_capture_request(money, authorization, options), :capture, money, options)
       end
 
-      def purchase(money, payment_method_or_reference, options = {})
-        setup_address_hash(options)
-        commit(build_purchase_request(money, payment_method_or_reference, options), :purchase, money, options)
+      def purchase(money, payment_method, options = {})
+        if valid_payment_method?(payment_method, options)
+          setup_address_hash(options)
+          commit(build_purchase_request(money, payment_method, options), :purchase, money, options)
+        else
+          # this is for NetworkToken, ApplePay or GooglePay brands that aren't supported at CyberSource
+          payment_type = payment_method.source.to_s.gsub('_', ' ').titleize.gsub(' ', '')
+          Response.new(false, "#{card_brand(payment_method).capitalize} is not supported by #{payment_type} at CyberSource, check https://developer.cybersource.com/docs/cybs/en-us/payments/developer/all/rest/payments/CreatingOnlineAuth/CreatingAuthReqPNT.html")
+        end
       end
 
       def void(identification, options = {})
@@ -206,8 +251,14 @@ module ActiveMerchant #:nodoc:
       # To charge the card while creating a profile, pass
       # options[:setup_fee] => money
       def store(payment_method, options = {})
-        setup_address_hash(options)
-        commit(build_create_subscription_request(payment_method, options), :store, nil, options)
+        if valid_payment_method?(payment_method, options)
+          setup_address_hash(options)
+          commit(build_create_subscription_request(payment_method, options), :store, nil, options)
+        else
+          # this is for NetworkToken, ApplePay or GooglePay brands that aren't supported at CyberSource
+          payment_type = payment_method.source.to_s.gsub('_', ' ').titleize.gsub(' ', '')
+          Response.new(false, "#{card_brand(payment_method).capitalize} is not supported by #{payment_type} at CyberSource, check https://developer.cybersource.com/docs/cybs/en-us/payments/developer/all/rest/payments/CreatingOnlineAuth/CreatingAuthReqPNT.html")
+        end
       end
 
       # Updates a customer subscription/profile
@@ -268,10 +319,15 @@ module ActiveMerchant #:nodoc:
       def scrub(transcript)
         transcript.
           gsub(%r((<wsse:Password [^>]*>)[^<]*(</wsse:Password>))i, '\1[FILTERED]\2').
+          gsub(%r((<wsse:BinarySecurityToken [^>]*>)[^<]*(</wsse:BinarySecurityToken>))i, '\1[FILTERED]\2').
+          gsub(%r((<ds:DigestValue>)[^<]*(</ds:DigestValue>))i, '\1[FILTERED]\2').
+          gsub(%r((<ds:SignatureValue [^>]*>)[^<]*(</ds:SignatureValue>))i, '\1[FILTERED]\2').
           gsub(%r((<accountNumber>)[^<]*(</accountNumber>))i, '\1[FILTERED]\2').
           gsub(%r((<cvNumber>)[^<]*(</cvNumber>))i, '\1[FILTERED]\2').
           gsub(%r((<cavv>)[^<]*(</cavv>))i, '\1[FILTERED]\2').
           gsub(%r((<xid>)[^<]*(</xid>))i, '\1[FILTERED]\2').
+          gsub(%r((<networkTokenCryptogram>)[^<]*(</networkTokenCryptogram>))i, '\1[FILTERED]\2').
+          gsub(%r((<requestorID>)[^<]*(</requestorID>))i, '\1[FILTERED]\2').
           gsub(%r((<authenticationData>)[^<]*(</authenticationData>))i, '\1[FILTERED]\2')
       end
 
@@ -286,6 +342,14 @@ module ActiveMerchant #:nodoc:
 
       private
 
+      def valid_payment_method?(payment_method, options)
+        return true unless payment_method.is_a?(NetworkTokenizationCreditCard)
+
+        brands = %w(visa master american_express)
+        brands << 'discover' if options[:enable_cybs_discover_apple_pay]
+        brands.include?(card_brand(payment_method))
+      end
+
       # Create all required address hash key value pairs
       # If a value of nil is received, that value will be passed on to the gateway and will not be replaced with a default value
       # Billing address fields received without an override value or with an empty string value will be replaced with the default_address values
@@ -317,17 +381,20 @@ module ActiveMerchant #:nodoc:
         xml = Builder::XmlMarkup.new indent: 2
         add_customer_id(xml, options)
         add_payment_method_or_subscription(xml, money, creditcard_or_reference, options)
-        add_other_tax(xml, options)
         add_threeds_2_ucaf_data(xml, creditcard_or_reference, options)
+        add_mastercard_network_tokenization_ucaf_data(xml, creditcard_or_reference, options)
         add_decision_manager_fields(xml, options)
+        add_other_tax(xml, options)
         add_mdd_fields(xml, options)
         add_auth_service(xml, creditcard_or_reference, options)
+        add_capture_service_fields_with_run_false(xml, options)
         add_threeds_services(xml, options)
         add_business_rules_data(xml, creditcard_or_reference, options)
         add_airline_data(xml, options)
+        add_merchant_category_code(xml, options)
         add_sales_slip_number(xml, options)
-        add_payment_network_token(xml) if network_tokenization?(creditcard_or_reference)
-        add_payment_solution(xml, creditcard_or_reference.source) if network_tokenization?(creditcard_or_reference)
+        add_payment_network_token(xml, creditcard_or_reference, options)
+        add_payment_solution(xml, creditcard_or_reference)
         add_tax_management_indicator(xml, options)
         add_stored_credential_subsequent_auth(xml, options)
         add_issuer_additional_data(xml, options)
@@ -360,7 +427,7 @@ module ActiveMerchant #:nodoc:
 
       def build_capture_request(money, authorization, options)
         order_id, request_id, request_token = authorization.split(';')
-        options[:order_id] = order_id
+        options[:order_id] = options[:merchant_reference_code] || order_id
 
         xml = Builder::XmlMarkup.new indent: 2
         add_purchase_data(xml, money, true, options)
@@ -368,6 +435,7 @@ module ActiveMerchant #:nodoc:
         add_mdd_fields(xml, options)
         add_capture_service(xml, request_id, request_token, options)
         add_business_rules_data(xml, authorization, options)
+        add_merchant_category_code(xml, options)
         add_tax_management_indicator(xml, options)
         add_issuer_additional_data(xml, options)
         add_merchant_description(xml, options)
@@ -380,13 +448,15 @@ module ActiveMerchant #:nodoc:
         xml = Builder::XmlMarkup.new indent: 2
         add_customer_id(xml, options)
         add_payment_method_or_subscription(xml, money, payment_method_or_reference, options)
-        add_other_tax(xml, options)
         add_threeds_2_ucaf_data(xml, payment_method_or_reference, options)
+        add_mastercard_network_tokenization_ucaf_data(xml, payment_method_or_reference, options)
         add_decision_manager_fields(xml, options)
+        add_other_tax(xml, options)
         add_mdd_fields(xml, options)
         if (!payment_method_or_reference.is_a?(String) && card_brand(payment_method_or_reference) == 'check') || reference_is_a_check?(payment_method_or_reference)
           add_check_service(xml)
           add_airline_data(xml, options)
+          add_merchant_category_code(xml, options)
           add_sales_slip_number(xml, options)
           add_tax_management_indicator(xml, options)
           add_issuer_additional_data(xml, options)
@@ -397,9 +467,10 @@ module ActiveMerchant #:nodoc:
           add_threeds_services(xml, options)
           add_business_rules_data(xml, payment_method_or_reference, options)
           add_airline_data(xml, options)
+          add_merchant_category_code(xml, options)
           add_sales_slip_number(xml, options)
-          add_payment_network_token(xml) if network_tokenization?(payment_method_or_reference)
-          add_payment_solution(xml, payment_method_or_reference.source) if network_tokenization?(payment_method_or_reference)
+          add_payment_network_token(xml, payment_method_or_reference, options)
+          add_payment_solution(xml, payment_method_or_reference)
           add_tax_management_indicator(xml, options)
           add_stored_credential_subsequent_auth(xml, options)
           add_issuer_additional_data(xml, options)
@@ -418,9 +489,12 @@ module ActiveMerchant #:nodoc:
       end
 
       def build_void_request(identification, options)
-        order_id, request_id, request_token, action, money, currency = identification.split(';')
+        order_id, request_id, request_token, action, money, currency = identification&.split(';')
         options[:order_id] = order_id
 
+        money ||= options[:amount]
+        currency ||= options[:currency]
+
         xml = Builder::XmlMarkup.new indent: 2
         case action
         when 'capture', 'purchase'
@@ -431,6 +505,7 @@ module ActiveMerchant #:nodoc:
           add_mdd_fields(xml, options)
           add_auth_reversal_service(xml, request_id, request_token)
         end
+        add_merchant_category_code(xml, options)
         add_issuer_additional_data(xml, options)
         add_partner_solution_id(xml)
 
@@ -443,9 +518,10 @@ module ActiveMerchant #:nodoc:
 
         xml = Builder::XmlMarkup.new indent: 2
         add_purchase_data(xml, money, true, options)
-        add_credit_service(xml, request_id: request_id,
-                                request_token: request_token,
+        add_credit_service(xml, request_id:,
+                                request_token:,
                                 use_check_service: reference_is_a_check?(identification))
+        add_merchant_category_code(xml, options)
         add_partner_solution_id(xml)
 
         xml.target!
@@ -487,7 +563,7 @@ module ActiveMerchant #:nodoc:
             add_check_service(xml)
           else
             add_purchase_service(xml, payment_method, options)
-            add_payment_network_token(xml) if network_tokenization?(payment_method)
+            add_payment_network_token(xml, payment_method, options)
           end
         end
         add_subscription_create_service(xml, options)
@@ -556,7 +632,7 @@ module ActiveMerchant #:nodoc:
       end
 
       def add_merchant_data(xml, options)
-        xml.tag! 'merchantID', @options[:login]
+        xml.tag! 'merchantID', options[:merchant_id] || @options[:login]
         xml.tag! 'merchantReferenceCode', options[:order_id] || generate_unique_id
         xml.tag! 'clientLibrary', 'Ruby Active Merchant'
         xml.tag! 'clientLibraryVersion', VERSION
@@ -566,12 +642,24 @@ module ActiveMerchant #:nodoc:
       end
 
       def add_merchant_descriptor(xml, options)
-        return unless options[:merchant_descriptor] || options[:user_po] || options[:taxable] || options[:reference_data_code] || options[:invoice_number]
+        return unless options[:merchant_descriptor] ||
+                      options[:user_po] ||
+                      options[:taxable] ||
+                      options[:reference_data_code] ||
+                      options[:invoice_number] ||
+                      options[:merchant_descriptor_city] ||
+                      options[:submerchant_id] ||
+                      options[:merchant_descriptor_state] ||
+                      options[:merchant_descriptor_country]
 
         xml.tag! 'invoiceHeader' do
           xml.tag! 'merchantDescriptor', options[:merchant_descriptor] if options[:merchant_descriptor]
+          xml.tag! 'merchantDescriptorCity', options[:merchant_descriptor_city] if options[:merchant_descriptor_city]
+          xml.tag! 'merchantDescriptorState', options[:merchant_descriptor_state] if options[:merchant_descriptor_state]
+          xml.tag! 'merchantDescriptorCountry', options[:merchant_descriptor_country] if options[:merchant_descriptor_country]
           xml.tag! 'userPO', options[:user_po] if options[:user_po]
           xml.tag! 'taxable', options[:taxable] if options[:taxable]
+          xml.tag! 'submerchantID', options[:submerchant_id] if options[:submerchant_id]
           xml.tag! 'referenceDataCode', options[:reference_data_code] if options[:reference_data_code]
           xml.tag! 'invoiceNumber', options[:invoice_number] if options[:invoice_number]
         end
@@ -645,9 +733,23 @@ module ActiveMerchant #:nodoc:
           xml.tag! 'driversLicenseNumber',  options[:drivers_license_number]  unless options[:drivers_license_number].blank?
           xml.tag! 'driversLicenseState',   options[:drivers_license_state]   unless options[:drivers_license_state].blank?
           xml.tag! 'merchantTaxID',         bill_to_merchant_tax_id           unless bill_to_merchant_tax_id.blank?
+          add_browser_info(xml, options, shipTo)
         end
       end
 
+      def add_browser_info(xml, options, shipTo)
+        return if shipTo
+        return unless browser_info = options.dig(:three_ds_2, :browser_info)
+
+        xml.tag! 'httpBrowserColorDepth', browser_info[:depth]&.to_s
+        xml.tag! 'httpBrowserJavaEnabled', browser_info[:java]
+        xml.tag! 'httpBrowserJavaScriptEnabled', browser_info[:javascript]
+        xml.tag! 'httpBrowserLanguage', browser_info[:language]&.to_s
+        xml.tag! 'httpBrowserScreenHeight', browser_info[:height]&.to_s
+        xml.tag! 'httpBrowserScreenWidth', browser_info[:width]&.to_s
+        xml.tag! 'httpBrowserTimeDifference', browser_info[:timezone]&.to_s
+      end
+
       def address_names(address_name, payment_method)
         names = split_names(address_name)
         return names if names.any?(&:present?)
@@ -677,8 +779,10 @@ module ActiveMerchant #:nodoc:
         end
       end
 
-      def add_payment_solution(xml, source)
-        return unless (payment_solution = @@payment_solution[source])
+      def add_payment_solution(xml, payment_method)
+        return unless network_tokenization?(payment_method)
+
+        payment_solution = payment_method.network_token? ? NT_PAYMENT_SOLUTION[payment_method.brand] : @@wallet_payment_solution[payment_method.source]
 
         xml.tag! 'paymentSolution', payment_solution
       end
@@ -692,7 +796,7 @@ module ActiveMerchant #:nodoc:
       end
 
       def add_other_tax(xml, options)
-        return unless options[:local_tax_amount] || options[:national_tax_amount] || options[:national_tax_indicator]
+        return unless %i[vat_tax_rate local_tax_amount national_tax_amount national_tax_indicator].any? { |gsf| options.include?(gsf) }
 
         xml.tag! 'otherTax' do
           xml.tag! 'vatTaxRate', options[:vat_tax_rate] if options[:vat_tax_rate]
@@ -730,22 +834,39 @@ module ActiveMerchant #:nodoc:
       end
 
       def add_auth_service(xml, payment_method, options)
-        if network_tokenization?(payment_method)
-          add_auth_network_tokenization(xml, payment_method, options)
-        else
-          xml.tag! 'ccAuthService', { 'run' => 'true' } do
-            if options[:three_d_secure]
-              add_normalized_threeds_2_data(xml, payment_method, options)
-            else
-              indicator = options[:commerce_indicator] || stored_credential_commerce_indicator(options)
-              xml.tag!('commerceIndicator', indicator) if indicator
-            end
-            xml.tag!('reconciliationID', options[:reconciliation_id]) if options[:reconciliation_id]
-            xml.tag!('mobileRemotePaymentType', options[:mobile_remote_payment_type]) if options[:mobile_remote_payment_type]
+        xml.tag! 'ccAuthService', { 'run' => 'true' } do
+          if network_tokenization?(payment_method)
+            add_auth_network_tokenization(xml, payment_method, options)
+          elsif options[:three_d_secure]
+            add_normalized_threeds_2_data(xml, payment_method, options)
+            add_threeds_exemption_data(xml, options)
+          elsif (indicator = options[:commerce_indicator] || stored_credential_commerce_indicator(options))
+            xml.tag!('commerceIndicator', indicator)
+          end
+
+          unless options[:three_d_secure]
+            add_reconciliation_and_aggregator_id(xml, options)
+            add_optional_fields(xml, options)
           end
         end
       end
 
+      def add_reconciliation_and_aggregator_id(xml, options)
+        xml.tag!('reconciliationID', options[:reconciliation_id]) if options[:reconciliation_id]
+        xml.tag!('aggregatorID', options[:aggregator_id]) if options[:aggregator_id]
+      end
+
+      def add_optional_fields(xml, options)
+        xml.tag!('firstRecurringPayment', options[:first_recurring_payment]) if options[:first_recurring_payment]
+        xml.tag!('mobileRemotePaymentType', options[:mobile_remote_payment_type]) if options[:mobile_remote_payment_type]
+      end
+
+      def add_threeds_exemption_data(xml, options)
+        return unless (exemption = THREEDS_EXEMPTIONS[options[:three_ds_exemption_type]&.to_sym])
+
+        xml.tag!(exemption, '1')
+      end
+
       def add_incremental_auth_service(xml, authorization, options)
         xml.tag! 'ccIncrementalAuthService', { 'run' => 'true' } do
           xml.tag! 'authRequestID', authorization
@@ -775,8 +896,10 @@ module ActiveMerchant #:nodoc:
           xml.tag!('xid', cavv) if cavv.present?
         end
 
+        add_reconciliation_and_aggregator_id(xml, options)
         xml.tag!('veresEnrolled', threeds_2_options[:enrolled]) if threeds_2_options[:enrolled]
         xml.tag!('paresStatus', threeds_2_options[:authentication_response_status]) if threeds_2_options[:authentication_response_status]
+        add_optional_fields(xml, options)
       end
 
       def infer_commerce_indicator?(options, cc_brand)
@@ -793,13 +916,15 @@ module ActiveMerchant #:nodoc:
       end
 
       def stored_credential_commerce_indicator(options)
-        return unless options[:stored_credential]
-
-        return if options[:stored_credential][:initial_transaction]
+        return unless (reason_type = options.dig(:stored_credential, :reason_type))
 
-        case options[:stored_credential][:reason_type]
-        when 'installment' then 'install'
-        when 'recurring' then 'recurring'
+        case reason_type
+        when 'installment'
+          'install'
+        when 'recurring'
+          'recurring'
+        else
+          'internet'
         end
       end
 
@@ -807,53 +932,95 @@ module ActiveMerchant #:nodoc:
         payment_method.is_a?(NetworkTokenizationCreditCard)
       end
 
+      def subsequent_wallet_auth(payment_method, options)
+        return unless options[:stored_credential] || options[:stored_credential_overrides]
+        return unless @@wallet_payment_solution[payment_method.source]
+
+        options.dig(:stored_credential_overrides, :subsequent_auth) || options.dig(:stored_credential, :initiator) == 'merchant'
+      end
+
       def add_auth_network_tokenization(xml, payment_method, options)
-        return unless network_tokenization?(payment_method)
+        brand = card_brand(payment_method)
+        return if payment_method.mobile_wallet? && brand == 'discover' && !options[:enable_cybs_discover_apple_pay]
+
+        if payment_method.network_token?
+          xml.tag!('networkTokenCryptogram', payment_method.payment_cryptogram)
+          xml.tag!('commerceIndicator', stored_credential_commerce_indicator(options) || 'internet')
+        elsif send_only_commerce_indicator(payment_method, options)
+          commerce_indicator = if brand == 'discover'
+                                 'dipb'
+                               elsif subsequent_wallet_auth(payment_method, options)
+                                 'internet'
+                               else
+                                 ECI_BRAND_MAPPING[brand.to_sym]
+                               end
+
+          xml.commerceIndicator(commerce_indicator)
+        else
+          default_wallet_values(xml, payment_method)
+        end
+      end
+
+      def send_only_commerce_indicator(payment_method, options)
+        brand = card_brand(payment_method)
+
+        return false if brand == 'american_express'
+
+        brand == 'master' || subsequent_wallet_auth(payment_method, options)
+      end
 
+      def default_wallet_values(xml, payment_method)
         brand = card_brand(payment_method).to_sym
+        commerce_indicator = brand == :discover ? 'dipb' : ECI_BRAND_MAPPING[brand]
+        cryptogram = brand == :american_express ? Base64.decode64(payment_method.payment_cryptogram) : payment_method.payment_cryptogram
+        cavv = xid = cryptogram
 
-        case brand
-        when :visa
-          xml.tag! 'ccAuthService', { 'run' => 'true' } do
-            xml.tag!('cavv', payment_method.payment_cryptogram)
-            xml.tag!('commerceIndicator', ECI_BRAND_MAPPING[brand])
-            xml.tag!('xid', payment_method.payment_cryptogram)
-            xml.tag!('reconciliationID', options[:reconciliation_id]) if options[:reconciliation_id]
-          end
-        when :master
-          xml.tag! 'ucaf' do
-            xml.tag!('authenticationData', payment_method.payment_cryptogram)
-            xml.tag!('collectionIndicator', DEFAULT_COLLECTION_INDICATOR)
-          end
-          xml.tag! 'ccAuthService', { 'run' => 'true' } do
-            xml.tag!('commerceIndicator', ECI_BRAND_MAPPING[brand])
-            xml.tag!('reconciliationID', options[:reconciliation_id]) if options[:reconciliation_id]
-          end
-        when :american_express
-          cryptogram = Base64.decode64(payment_method.payment_cryptogram)
-          xml.tag! 'ccAuthService', { 'run' => 'true' } do
-            xml.tag!('cavv', Base64.encode64(cryptogram[0...20]))
-            xml.tag!('commerceIndicator', ECI_BRAND_MAPPING[brand])
-            xml.tag!('xid', Base64.encode64(cryptogram[20...40])) if cryptogram.bytes.count > 20
-            xml.tag!('reconciliationID', options[:reconciliation_id]) if options[:reconciliation_id]
-          end
-        else
-          raise ArgumentError.new("Payment method #{brand} is not supported, check https://developer.cybersource.com/docs/cybs/en-us/payments/developer/all/rest/payments/CreatingOnlineAuth/CreatingAuthReqPNT.html")
+        if brand == :american_express
+          cavv = Base64.encode64(cavv[0...20])
+          xid = xid.bytes.count > 20 ? Base64.encode64(xid[20...40]) : nil
+        end
+
+        xml.tag! 'cavv', cavv
+        xml.tag! 'commerceIndicator', commerce_indicator
+        xml.tag! 'xid', xid if xid
+      end
+
+      def add_mastercard_network_tokenization_ucaf_data(xml, payment_method, options)
+        return unless network_tokenization?(payment_method) && card_brand(payment_method).to_sym == :master
+        return if payment_method.source == :network_token
+
+        commerce_indicator = 'internet' if subsequent_wallet_auth(payment_method, options)
+
+        xml.tag! 'ucaf' do
+          xml.tag!('authenticationData', payment_method.payment_cryptogram) unless commerce_indicator
+          xml.tag!('collectionIndicator', DEFAULT_COLLECTION_INDICATOR)
         end
       end
 
-      def add_payment_network_token(xml)
+      def add_payment_network_token(xml, payment_method, options)
+        return unless network_tokenization?(payment_method)
+
+        transaction_type = payment_method.network_token? ? '3' : '1'
         xml.tag! 'paymentNetworkToken' do
-          xml.tag!('transactionType', '1')
+          xml.tag!('requestorID', options[:trid]) if transaction_type == '3' && options[:trid]
+          xml.tag!('transactionType', transaction_type)
         end
       end
 
       def add_capture_service(xml, request_id, request_token, options)
         xml.tag! 'ccCaptureService', { 'run' => 'true' } do
           xml.tag! 'authRequestID', request_id
+          xml.tag! 'reconciliationID', options[:reconciliation_id] if options[:reconciliation_id]
           xml.tag! 'authRequestToken', request_token
           xml.tag! 'gratuityAmount', options[:gratuity_amount] if options[:gratuity_amount]
-          xml.tag! 'reconciliationID', options[:reconciliation_id] if options[:reconciliation_id]
+        end
+      end
+
+      def add_capture_service_fields_with_run_false(xml, options)
+        return unless options[:gratuity_amount]
+
+        xml.tag! 'ccCaptureService', { 'run' => 'false' } do
+          xml.tag! 'gratuityAmount', options[:gratuity_amount]
         end
       end
 
@@ -861,6 +1028,7 @@ module ActiveMerchant #:nodoc:
         add_auth_service(xml, payment_method, options)
         xml.tag! 'ccCaptureService', { 'run' => 'true' } do
           xml.tag!('reconciliationID', options[:reconciliation_id]) if options[:reconciliation_id]
+          xml.tag!('gratuityAmount', options[:gratuity_amount]) if options[:gratuity_amount]
         end
       end
 
@@ -873,7 +1041,7 @@ module ActiveMerchant #:nodoc:
 
       def add_auth_reversal_service(xml, request_id, request_token)
         xml.tag! 'ccAuthReversalService', { 'run' => 'true' } do
-          xml.tag! 'authRequestID', request_id
+          xml.tag! 'authRequestID', request_id unless request_id.nil?
           xml.tag! 'authRequestToken', request_token
         end
       end
@@ -909,6 +1077,11 @@ module ActiveMerchant #:nodoc:
         xml.tag! 'paySubscriptionRetrieveService', { 'run' => 'true' }
       end
 
+      def add_merchant_category_code(xml, options)
+        xml.tag! 'merchantTransactionIdentifier', options[:merchant_transaction_id] if options[:merchant_transaction_id]
+        xml.tag! 'merchantCategoryCode', options[:merchant_category_code] if options[:merchant_category_code]
+      end
+
       def add_subscription(xml, options, reference = nil)
         options[:subscription] ||= {}
 
@@ -977,10 +1150,18 @@ module ActiveMerchant #:nodoc:
       end
 
       def add_threeds_services(xml, options)
-        xml.tag! 'payerAuthEnrollService', { 'run' => 'true' } if options[:payer_auth_enroll_service]
+        if options[:payer_auth_enroll_service]
+          xml.tag! 'payerAuthEnrollService', { 'run' => 'true' } do
+            browser_info = options.dig(:three_ds_2, :browser_info)
+            xml.tag! 'httpUserAgent', browser_info[:user_agent] if browser_info&.dig(:user_agent)
+            xml.tag! 'returnURL', options[:return_url] if options[:return_url]
+            xml.tag! 'httpUserAccept', browser_info[:accept_header] if browser_info&.dig(:accept_header)
+          end
+        end
+
         if options[:payer_auth_validate_service]
           xml.tag! 'payerAuthValidateService', { 'run' => 'true' } do
-            xml.tag! 'signedPARes', options[:pares]
+            xml.tag! 'authenticationTransactionID', options[:authentication_transaction_id]
           end
         end
       end
@@ -1003,9 +1184,9 @@ module ActiveMerchant #:nodoc:
       def add_stored_credential_options(xml, options = {})
         return unless options[:stored_credential] || options[:stored_credential_overrides]
 
-        stored_credential_subsequent_auth_first = 'true' if options.dig(:stored_credential, :initial_transaction)
+        stored_credential_subsequent_auth_first = 'true' if cardholder_or_initiated_transaction?(options)
         stored_credential_transaction_id = options.dig(:stored_credential, :network_transaction_id) if options.dig(:stored_credential, :initiator) == 'merchant'
-        stored_credential_subsequent_auth_stored_cred = 'true' if options.dig(:stored_credential, :initiator) == 'cardholder' && !options.dig(:stored_credential, :initial_transaction) || options.dig(:stored_credential, :initiator) == 'merchant' && options.dig(:stored_credential, :reason_type) == 'unscheduled'
+        stored_credential_subsequent_auth_stored_cred = 'true' if subsequent_cardholder_initiated_transaction?(options) || unscheduled_merchant_initiated_transaction?(options) || threeds_stored_credential_exemption?(options)
 
         override_subsequent_auth_first = options.dig(:stored_credential_overrides, :subsequent_auth_first)
         override_subsequent_auth_transaction_id = options.dig(:stored_credential_overrides, :subsequent_auth_transaction_id)
@@ -1016,34 +1197,127 @@ module ActiveMerchant #:nodoc:
         xml.subsequentAuthStoredCredential override_subsequent_auth_stored_cred.nil? ? stored_credential_subsequent_auth_stored_cred : override_subsequent_auth_stored_cred
       end
 
+      def cardholder_or_initiated_transaction?(options)
+        options.dig(:stored_credential, :initiator) == 'cardholder' || options.dig(:stored_credential, :initial_transaction)
+      end
+
+      def subsequent_cardholder_initiated_transaction?(options)
+        options.dig(:stored_credential, :initiator) == 'cardholder' && !options.dig(:stored_credential, :initial_transaction)
+      end
+
+      def unscheduled_merchant_initiated_transaction?(options)
+        options.dig(:stored_credential, :initiator) == 'merchant' && options.dig(:stored_credential, :reason_type) == 'unscheduled'
+      end
+
+      def threeds_stored_credential_exemption?(options)
+        options[:three_ds_exemption_type] == 'stored_credential'
+      end
+
       def add_partner_solution_id(xml)
         return unless application_id
 
         xml.tag!('partnerSolutionID', application_id)
       end
 
-      # Where we actually build the full SOAP request using builder
-      def build_request(body, options)
-        xsd_version = test? ? TEST_XSD_VERSION : PRODUCTION_XSD_VERSION
+      def sign_info(body)
+        canonicalized = canonicalization(body)
+        digest_value = OpenSSL::Digest::SHA256.digest(canonicalized)
 
         xml = Builder::XmlMarkup.new indent: 2
-        xml.instruct!
-        xml.tag! 's:Envelope', { 'xmlns:s' => 'http://schemas.xmlsoap.org/soap/envelope/' } do
-          xml.tag! 's:Header' do
-            xml.tag! 'wsse:Security', { 's:mustUnderstand' => '1', 'xmlns:wsse' => 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' } do
+
+        xml.tag! 'ds:SignedInfo', { 'xmlns:ds' => NS_DS } do
+          xml.tag! 'ds:CanonicalizationMethod', { 'Algorithm' => C14N_ALGORITHM }
+          xml.tag! 'ds:SignatureMethod', { 'Algorithm' => RSA_SHA256_ALGORITHM }
+          xml.tag! 'ds:Reference', { 'URI' => '#Body' } do
+            xml.tag! 'ds:Transforms' do
+              xml.tag! 'ds:Transform', { 'Algorithm' => C14N_ALGORITHM }
+            end
+            xml.tag! 'ds:DigestMethod', { 'Algorithm' => SHA256_ALGORITHM }
+            xml.tag! 'ds:DigestValue', Base64.encode64(digest_value).strip
+          end
+        end
+
+        canonicalization(xml.target!)
+      end
+
+      def signature_element(xml, body)
+        signed_info = sign_info(body)
+        rsa_private_key = OpenSSL::PKey::RSA.new(@options[:private_key])
+        signature = rsa_private_key.sign(OpenSSL::Digest.new('SHA256'), signed_info)
+
+        xml.tag! 'ds:Signature', { 'xmlns:ds' => NS_DS } do
+          xml << signed_info
+          xml.tag! 'ds:SignatureValue', { 'xmlns:ds' => NS_DS } do
+            xml.text! Base64.encode64(signature).strip
+          end
+          xml.tag! 'ds:KeyInfo', { 'xmlns:ds' => NS_DS } do
+            xml.tag! 'wsse:SecurityTokenReference', { 'xmlns:wsse' => NS_WSSE } do
+              xml.tag! 'wsse:Reference', { 'URI' => '#X509Token', 'xmlns:wsse' => NS_WSSE }
+            end
+          end
+        end
+      end
+
+      def security_token_reference(xml)
+        xml.tag! 'wsse:BinarySecurityToken', { 'ValueType' => BINARY_SECURITY_TOKEN_PROFILE, 'EncodingType' => BINARY_SECURITY_TOKEN_TYPE, 'xmlns:wsu' => BINARY_SECURITY_TOKEN_WSU, 'wsu:Id' => BINARY_SECURITY_TOKEN_ID } do
+          xml.text! @options[:public_key]
+        end
+      end
+
+      def set_headers(xml, body)
+        xml.tag! 's:Header' do
+          xml.tag! 'wsse:Security', { 'xmlns:wsse' => NS_WSSE } do
+            if @options[:public_key]
+              security_token_reference(xml)
+              signature_element(xml, body)
+            else
               xml.tag! 'wsse:UsernameToken' do
                 xml.tag! 'wsse:Username', @options[:login]
-                xml.tag! 'wsse:Password', @options[:password], 'Type' => 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText'
+                xml.tag! 'wsse:Password', @options[:password], 'Type' => USERNAME_TOKEN_PROFILE
               end
             end
           end
-          xml.tag! 's:Body', { 'xmlns:xsi' => 'http://www.w3.org/2001/XMLSchema-instance', 'xmlns:xsd' => 'http://www.w3.org/2001/XMLSchema' } do
-            xml.tag! 'requestMessage', { 'xmlns' => "urn:schemas-cybersource-com:transaction-data-#{xsd_version}" } do
-              add_merchant_data(xml, options)
-              xml << body
-            end
+        end
+      end
+
+      def build_body(request, options, xsd_version)
+        xml = Builder::XmlMarkup.new indent: 2
+
+        arguments =
+          if @options[:public_key]
+            { 'xmlns:s' => ENVELOPE, 'xmlns:wsu' => BINARY_SECURITY_TOKEN_WSU, 'wsu:Id' => 'Body' }
+          else
+            { 'xmlns:xsi' => 'http://www.w3.org/2001/XMLSchema-instance', 'xmlns:xsd' => 'http://www.w3.org/2001/XMLSchema' }
           end
+
+        xml.tag! 's:Body', arguments do
+          xml.tag! 'requestMessage', { 'xmlns' => "urn:schemas-cybersource-com:transaction-data-#{xsd_version}" } do
+            add_merchant_data(xml, options)
+            xml << request
+          end
+        end
+
+        xml.target!
+      end
+
+      def canonicalization(xml)
+        doc = Nokogiri::XML(xml)
+        doc.canonicalize(Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0)
+      end
+
+      # Where we actually build the full SOAP request using builder
+      def build_request(request, options)
+        xsd_version = test? ? TEST_XSD_VERSION : PRODUCTION_XSD_VERSION
+
+        body = build_body(request, options, xsd_version)
+        xml = Builder::XmlMarkup.new indent: 2
+
+        xml.instruct!
+        xml.tag! 's:Envelope', { 'xmlns:s' => ENVELOPE, 'xmlns' => "urn:schemas-cybersource-com:transaction-data-#{xsd_version}" } do
+          set_headers(xml, body)
+          xml << body
         end
+
         xml.target!
       end
 
@@ -1068,12 +1342,16 @@ module ActiveMerchant #:nodoc:
 
         message = auto_void?(authorization_from(response, action, amount, options), response, message, options)
 
-        Response.new(success, message, response,
+        Response.new(
+          success,
+          message,
+          response,
           test: test?,
-          authorization: authorization,
+          authorization:,
           fraud_review: in_fraud_review?(response),
           avs_result: { code: response[:avsCode] },
-          cvv_result: response[:cvCode])
+          cvv_result: response[:cvCode]
+        )
       end
 
       def auto_void?(authorization, response, message, options = {})
@@ -1115,6 +1393,7 @@ module ActiveMerchant #:nodoc:
             parent += '_' + node.parent.attributes['id'] if node.parent.attributes['id']
             parent += '_'
           end
+          reply[:reconciliationID2] = node.text if node.name == 'reconciliationID' && reply[:reconciliationID]
           reply["#{parent}#{node.name}".to_sym] ||= node.text
         end
         return reply