defra_ruby_govpay 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7864631baaae149b487329392889e27cffdea8c1ac48ab82e94728a68786d99f
-  data.tar.gz: ce5c2fca8fc52b326465aebee8ff8a2d499f10851810481994e8d497e72f71d0
+  metadata.gz: a727a626f74c5efcd304567763038db11f30b9f81afa6e18189e0cd04a96f0b4
+  data.tar.gz: 78382f4bd08bef079d068db1938fbb7d9e21137239750746051a6ea47edaa750
 SHA512:
-  metadata.gz: fe1254fd86f79691cedcaa93d9a89aa7612a189bfac6f34b71673a2773894b66abaf84e9c8eb0843c291d7ae7fdfb6f817b7783afd7a2b6fa6244e7c40ef0035
-  data.tar.gz: 95b985bff36238d5412da57919d0d84307803fa8220cc5b5dd6c8ffb4512154fffa4db25ba239946e21e285f19541da356e56c08d5131b92414a775309e98189
+  metadata.gz: 8956999c3c6cdf5d8861c3502155ea7342175d21b94d0409c443f81afac8d61cdafbd80d5ce68a70cc1361e1fe1f385fca45181879091ef3aaeabfd95e36d412
+  data.tar.gz: ce0434005dc833dcab5b5b2537753ebe538f83683b2ba5cf054baac2450e15cd8cf6f2535fd84dc1b4ce7f5a26f43b1ed634fad296cefc6fe2953aa4d657e3ab

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [Unreleased](https://github.com/DEFRA/defra-ruby-govpay/tree/HEAD)
+
+[Full Changelog](https://github.com/DEFRA/defra-ruby-govpay/compare/v1.0.2...HEAD)
+
+**Fixed bugs:**
+
+- Fix/ruby 3931 refund callbacks [\#45](https://github.com/DEFRA/defra-ruby-govpay/pull/45) ([PaulDoyle-EA](https://github.com/PaulDoyle-EA))
+
+**Merged pull requests:**
+
+- Bump rubocop-rspec from 3.6.0 to 3.7.0 [\#46](https://github.com/DEFRA/defra-ruby-govpay/pull/46) ([dependabot[bot]](https://github.com/apps/dependabot))
+
+## [v1.0.2](https://github.com/DEFRA/defra-ruby-govpay/tree/v1.0.2) (2025-08-06)
+
+[Full Changelog](https://github.com/DEFRA/defra-ruby-govpay/compare/v1.0.1...v1.0.2)
+
+**Fixed bugs:**
+
+- Fix/exclude gem file [\#42](https://github.com/DEFRA/defra-ruby-govpay/pull/42) ([PaulDoyle-EA](https://github.com/PaulDoyle-EA))
+
 ## [v1.0.1](https://github.com/DEFRA/defra-ruby-govpay/tree/v1.0.1) (2025-08-05)
 
 [Full Changelog](https://github.com/DEFRA/defra-ruby-govpay/compare/v1.0.0...v1.0.1)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    defra_ruby_govpay (1.0.2)
+    defra_ruby_govpay (1.1.0)
       rest-client (~> 2.1)
 
 GEM
@@ -42,7 +42,7 @@ GEM
       async (>= 1.25)
     base64 (0.1.1)
     bigdecimal (3.2.2)
-    byebug (11.1.3)
+    byebug (12.0.0)
     concurrent-ruby (1.2.2)
     connection_pool (2.4.1)
     console (1.23.2)
@@ -114,14 +114,14 @@ GEM
     public_suffix (6.0.2)
     racc (1.8.1)
     rainbow (3.1.1)
-    rake (13.1.0)
-    regexp_parser (2.11.0)
+    rake (13.3.0)
+    regexp_parser (2.11.2)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    rexml (3.4.1)
+    rexml (3.4.2)
     rspec (3.13.1)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -134,8 +134,8 @@ GEM
     rspec-mocks (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.4)
-    rubocop (1.79.1)
+    rspec-support (3.13.5)
+    rubocop (1.80.1)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -152,9 +152,10 @@ GEM
     rubocop-factory_bot (2.27.1)
       lint_roller (~> 1.1)
       rubocop (~> 1.72, >= 1.72.1)
-    rubocop-rake (0.6.0)
-      rubocop (~> 1.0)
-    rubocop-rspec (3.6.0)
+    rubocop-rake (0.7.1)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.72.1)
+    rubocop-rspec (3.7.0)
       lint_roller (~> 1.1)
       rubocop (~> 1.72, >= 1.72.1)
     ruby-progressbar (1.13.0)
@@ -169,7 +170,7 @@ GEM
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.8.2)
-    unicode-display_width (3.1.4)
+    unicode-display_width (3.1.5)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
     webmock (3.25.1)

data/README.md

@@ -98,12 +98,13 @@ result = DefraRubyGovpay::WebhookRefundService.run(webhook_body)
 
 ### Validating Webhook Signatures
 
-To validate the signature of a webhook, use the `CallbackValidator` class:
+The `WebhookSignatureService` service returns two HMAC hexdigests for the webhook body, one created using the front-office signature and one using the back-office signature. This is necessary because both MOTO and non-MOTO payment webhooks are processed by the front-office, as the back-office is inaccessible to GOV.UK Pay. 
+
+To validate the signature of a webhook, use the `WebhookBodyValidatorService` class:
 
 ```ruby
-valid = DefraRubyGovpay::CallbackValidator.call(
-  request_body,
-  ENV['GOVPAY_WEBHOOK_SIGNING_SECRET'],
+valid = DefraRubyGovpay::WebhookBodyValidatorService.call(
+  body: webhook_body,
   request.headers['Pay-Signature']
 )
 
@@ -116,10 +117,10 @@ end
 
 ### Payment vs Refund Webhooks
 
-The gem can handle both payment and refund webhooks:
+The gem can handle both payment and refund webhooks. Both have a top-level `resource_id` which refers to the relevant payment. There is no distinct identifier for a refund. Note that `resource_type` is "PAYMENT" for both payment and refund webhoks. The `event_type` indicates whether the webhook is for a payment or a refund:
 
-- **Payment Webhooks**: These have a `resource_type` of "payment" and contain payment status information in `resource.state.status`.
-- **Refund Webhooks**: These have a `refund_id` field and contain refund status information in the `status` field.
+- **Payment webhook**: `card_payment_succeeded` (for example)
+- **Refund webhook**: `card_payment_refunded`
 
 The appropriate service class will be used based on the webhook type:
 

data/lib/defra_ruby_govpay/services/webhook_base_service.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "active_support/core_ext/object/blank"
+require "active_support/core_ext/hash/keys"
 
 module DefraRubyGovpay
   class WebhookBaseService
@@ -15,12 +16,8 @@ module DefraRubyGovpay
       new.run(webhook_body, previous_status: previous_status)
     end
 
-    def initialize
-      # No initialization needed
-    end
-
     def run(webhook_body, previous_status: nil)
-      @webhook_body = webhook_body
+      @webhook_body = webhook_body.deep_symbolize_keys
       @previous_status = previous_status
 
       validate_webhook_body
@@ -35,7 +32,6 @@ module DefraRubyGovpay
         )
       end
 
-      # Extract and return data from webhook
       extract_data_from_webhook
     end
 
@@ -51,30 +47,34 @@ module DefraRubyGovpay
 
     def extract_data_from_webhook
       {
-        id: webhook_payment_or_refund_id,
+        id: webhook_payment_id,
         status: webhook_payment_or_refund_status,
         webhook_body: webhook_body
       }
     end
 
-    # The following methods must be implemented in subclasses
-    def payment_or_refund_str
-      raise NotImplementedError
+    def webhook_payment_id
+      @webhook_payment_id ||= webhook_body[:resource_id]
     end
 
-    def validate_webhook_body
-      raise NotImplementedError
+    def log_webhook_context
+      " for payment #{webhook_payment_id}"
     end
 
-    def webhook_payment_or_refund_id
-      raise NotImplementedError
+    def webhook_payment_or_refund_status
+      @webhook_payment_or_refund_status ||= webhook_body.dig(:resource, :state, :status)
     end
 
-    def webhook_payment_or_refund_status
+    def webhook_resource_type
+      @webhook_resource_type ||= webhook_body[:resource_type]&.downcase
+    end
+
+    # The following methods must be implemented in subclasses
+    def payment_or_refund_str
       raise NotImplementedError
     end
 
-    def log_webhook_context
+    def validate_webhook_body
       raise NotImplementedError
     end
   end

data/lib/defra_ruby_govpay/services/webhook_payment_service.rb

@@ -24,23 +24,7 @@ module DefraRubyGovpay
 
       return unless webhook_payment_or_refund_status.blank?
 
-      raise ArgumentError, "Webhook body missing payment status: #{webhook_body}"
-    end
-
-    def webhook_resource_type
-      @webhook_resource_type ||= webhook_body["resource_type"]&.downcase
-    end
-
-    def webhook_payment_or_refund_id
-      @webhook_payment_or_refund_id ||= webhook_body.dig("resource", "payment_id")
-    end
-
-    def webhook_payment_or_refund_status
-      @webhook_payment_or_refund_status ||= webhook_body.dig("resource", "state", "status")
-    end
-
-    def log_webhook_context
-      "for payment #{webhook_payment_or_refund_id}"
+      raise ArgumentError, "Webhook body missing payment status: #{WebhookSanitizerService.call(webhook_body)}"
     end
   end
 end

data/lib/defra_ruby_govpay/services/webhook_refund_service.rb

@@ -4,7 +4,7 @@ module DefraRubyGovpay
   class WebhookRefundService < WebhookBaseService
 
     VALID_STATUS_TRANSITIONS = {
-      "submitted" => %w[success],
+      "submitted" => %w[success error],
       "success" => %w[],
       "error" => %w[]
     }.freeze
@@ -16,35 +16,16 @@ module DefraRubyGovpay
     end
 
     def validate_webhook_body
-      return if webhook_payment_or_refund_id.present? && webhook_payment_or_refund_status.present?
+      return if webhook_body[:event_type] == "card_payment_refunded" &&
+                webhook_payment_id.present? &&
+                webhook_refund_status.present?
 
-      raise ArgumentError, "Invalid refund webhook: #{webhook_body}"
+      raise ArgumentError, "Invalid refund webhook: #{WebhookSanitizerService.call(webhook_body)}"
     end
 
-    def webhook_payment_id
-      @webhook_payment_id ||= webhook_body["payment_id"]
+    def webhook_refund_status
+      @webhook_refund_status ||= webhook_body.dig(:resource, :state, :status)
     end
 
-    def webhook_payment_or_refund_id
-      @webhook_payment_or_refund_id ||= webhook_body["refund_id"]
-    end
-
-    def webhook_payment_or_refund_status
-      @webhook_payment_or_refund_status ||= webhook_body["status"]
-    end
-
-    def extract_data_from_webhook
-      data = super
-
-      data.merge!(
-        payment_id: webhook_payment_id
-      )
-
-      data
-    end
-
-    def log_webhook_context
-      "for refund #{webhook_payment_or_refund_id}"
-    end
   end
 end

data/lib/defra_ruby_govpay/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DefraRubyGovpay
-  VERSION = "1.0.2"
+  VERSION = "1.1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: defra_ruby_govpay
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - Jerome Pratt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-06 00:00:00.000000000 Z
+date: 2025-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client