mpp-rb 0.1.4 → 0.1.6

data/lib/mpp/server/middleware.rb

@@ -14,6 +14,8 @@ module Mpp
     #
     # Payment is verified BEFORE the downstream app runs — if verification
     # fails, the app never executes and a 402 challenge is returned.
+    # Payment-Receipt is attached only when the app then returns 2xx, so a
+    # failed fulfillment is not reported as a successful paid response.
     #
     # Example:
     #   use Mpp::Server::Middleware,
@@ -22,10 +24,10 @@ module Mpp
     class Middleware
       extend T::Sig
 
-      sig { params(app: T.untyped, handler: Mpp::Server::MppHandler, pricing: T.untyped).void }
+      sig { params(app: T.untyped, handler: T.untyped, pricing: T.untyped).void }
       def initialize(app, handler:, pricing:)
         @app = T.let(app, T.untyped)
-        @handler = T.let(handler, Mpp::Server::MppHandler)
+        @handler = T.let(handler, T.untyped)
         @pricing = T.let(pricing, T.untyped)
       end
 
@@ -35,40 +37,58 @@ module Mpp
         return @app.call(env) unless charge_opts
 
         authorization = env["HTTP_AUTHORIZATION"]
+        payment_authorization = env["HTTP_PAYMENT_AUTHORIZATION"]
+        payment_signature = env["HTTP_PAYMENT_SIGNATURE"]
+        accept_payment = env["HTTP_ACCEPT_PAYMENT"]
+        http_method = env["REQUEST_METHOD"]
+        url = request_url(env)
         body_capture = capture_request_body(env)
 
         request_body = body_capture&.materialize
         env["rack.input"] = StringIO.new(request_body || "") if body_capture
 
-        amount = charge_opts[:amount]
-        opts = charge_opts.except(:amount, :body)
-        opts[:mppx_scope] ||= mppx_scope(env)
+        result = verify_payment(
+          env,
+          charge_opts,
+          authorization: authorization,
+          payment_authorization: payment_authorization,
+          payment_signature: payment_signature,
+          accept_payment: accept_payment,
+          http_method: http_method,
+          url: url,
+          request_body: request_body
+        )
 
-        result = @handler.charge(authorization, amount, **opts, body: request_body)
-
-        if result.is_a?(Mpp::Challenge)
-          resp = Mpp::Server::Decorator.make_challenge_response(result, @handler.realm)
-          return [resp["status"], resp["headers"], [resp["body"]]]
-        end
+        challenge_response = challenge_rack_response(result, url: url, http_method: http_method)
+        return challenge_response if challenge_response
 
-        _credential, receipt = result
+        credential, receipt, extra_headers = paid_result(result)
         status, headers, body = @app.call(env)
-        headers["Payment-Receipt"] = receipt.to_payment_receipt
-        self.class.mark_authorization_bound_response(headers)
+        if success_status?(status)
+          headers["Payment-Receipt"] = receipt.to_payment_receipt
+          extra_headers.each { |key, value| headers[key] = value unless value.nil? }
+          decorate_single_method_receipt(headers, credential, receipt, payment_signature)
+        end
+        vary = [credential_vary_field]
+        vary << "PAYMENT-SIGNATURE" if x402_bound?(headers, payment_signature)
+        self.class.mark_authorization_bound_response(headers, vary: vary)
 
         [status, headers, body]
       end
 
-      sig { params(headers: T::Hash[T.untyped, T.untyped]).void }
-      def self.mark_authorization_bound_response(headers)
+      sig { params(headers: T::Hash[T.untyped, T.untyped], vary: T::Array[String]).void }
+      def self.mark_authorization_bound_response(headers, vary: ["Authorization"])
         headers["Cache-Control"] = "no-store"
 
         vary_values = headers["Vary"].to_s.split(",").map do |value|
           value.strip.downcase
         end
-        return if vary_values.include?("*") || vary_values.include?("authorization")
+        return if vary_values.include?("*")
+
+        additions = vary.reject { |field| vary_values.include?(field.downcase) }
+        return if additions.empty?
 
-        headers["Vary"] = [headers["Vary"], "Authorization"]
+        headers["Vary"] = [headers["Vary"], *additions]
           .compact
           .reject(&:empty?)
           .join(", ")
@@ -76,6 +96,128 @@ module Mpp
 
       private
 
+      sig do
+        params(
+          env: T.untyped,
+          charge_opts: T.untyped,
+          authorization: T.untyped,
+          payment_authorization: T.untyped,
+          payment_signature: T.untyped,
+          accept_payment: T.untyped,
+          http_method: T.untyped,
+          url: T.untyped,
+          request_body: T.untyped
+        ).returns(T.untyped)
+      end
+      def verify_payment(env, charge_opts, authorization:, payment_authorization:, payment_signature:, accept_payment:, http_method:, url:, request_body:)
+        if @handler.is_a?(Mpp::Server::ComposedHandler)
+          return @handler.call(
+            authorization: authorization,
+            payment_authorization: payment_authorization,
+            payment_signature: payment_signature,
+            body: request_body,
+            url: url,
+            accept_payment: accept_payment,
+            http_method: http_method,
+            scope: mppx_scope(env)
+          )
+        end
+
+        amount = charge_opts[:amount]
+        opts = charge_opts.except(:amount, :body)
+        opts[:mppx_scope] ||= mppx_scope(env)
+        @handler.charge(
+          authorization,
+          amount,
+          **opts,
+          body: request_body,
+          payment_authorization: payment_authorization,
+          payment_signature: payment_signature,
+          url: url,
+          accept_payment: accept_payment,
+          http_method: http_method
+        )
+      end
+
+      sig { params(result: T.untyped, url: T.nilable(String), http_method: T.nilable(String)).returns(T.nilable(T::Array[T.untyped])) }
+      def challenge_rack_response(result, url:, http_method:)
+        if result.is_a?(Mpp::Server::ComposedResult)
+          return nil unless result.payment_required?
+
+          resp = result.to_response
+          return [resp["status"], resp["headers"], [resp["body"]]]
+        end
+
+        return nil unless result.is_a?(Mpp::Challenge)
+
+        resp = if @handler.respond_to?(:challenge_response)
+          @handler.challenge_response(result, url: url, http_method: http_method)
+        else
+          Mpp::Server::Decorator.make_challenge_response(result, @handler.realm)
+        end
+        [resp["status"], resp["headers"], [resp["body"]]]
+      end
+
+      sig { params(status: T.untyped).returns(T::Boolean) }
+      def success_status?(status)
+        code = Integer(status)
+        (code >= 200) && (code < 300)
+      rescue ArgumentError, TypeError
+        false
+      end
+
+      sig { params(result: T.untyped).returns(T::Array[T.untyped]) }
+      def paid_result(result)
+        if result.is_a?(Mpp::Server::ComposedResult)
+          credential, receipt = result.payment
+          return [credential, receipt, result.extra_headers]
+        end
+
+        credential, receipt = result
+        [credential, receipt, {}]
+      end
+
+      sig { params(headers: T::Hash[T.untyped, T.untyped], credential: T.untyped, receipt: T.untyped, payment_signature: T.untyped).void }
+      def decorate_single_method_receipt(headers, credential, receipt, payment_signature)
+        return unless payment_signature
+        return unless @handler.respond_to?(:method)
+        return unless @handler.method.respond_to?(:decorate_receipt)
+
+        @handler.method.decorate_receipt(headers, receipt, credential, payment_signature: payment_signature)
+      end
+
+      sig { params(headers: T::Hash[T.untyped, T.untyped], payment_signature: T.untyped).returns(T::Boolean) }
+      def x402_bound?(headers, payment_signature)
+        !payment_signature.to_s.empty? ||
+          headers.key?("PAYMENT-RESPONSE") ||
+          headers.key?("PAYMENT-REQUIRED")
+      end
+
+      sig { returns(String) }
+      def credential_vary_field
+        if @handler.respond_to?(:requires_auth) && @handler.requires_auth
+          Mpp::PAYMENT_AUTHORIZATION_HEADER
+        else
+          Mpp::AUTHORIZATION_HEADER
+        end
+      end
+
+      sig { params(env: T.untyped).returns(String) }
+      def request_url(env)
+        scheme = env["HTTP_X_FORWARDED_PROTO"] || env["rack.url_scheme"] || "http"
+        host = env["HTTP_HOST"]
+        unless host
+          server = env["SERVER_NAME"] || "localhost"
+          port = env["SERVER_PORT"]
+          host = (port && !["80", "443"].include?(port.to_s)) ? "#{server}:#{port}" : server
+        end
+        path = "#{env["SCRIPT_NAME"]}#{env["PATH_INFO"]}"
+        query = env["QUERY_STRING"]
+        url = "#{scheme}://#{host}#{path}"
+        url += "?#{query}" if query && !query.empty?
+        url
+      end
+
       sig { params(env: T.untyped).returns(T.nilable(RackInputCapture)) }
       def capture_request_body(env)
         input = env["rack.input"]

data/lib/mpp/server/mpp_handler.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: true
 # frozen_string_literal: true
 
 require_relative "method"
@@ -10,9 +10,14 @@ module Mpp
     class MppHandler
       extend T::Sig
 
+      REQUEST_OPTION_KEYS = [:body, :url, :payment_signature, :accept_payment, :http_method, :payment_authorization].freeze
+
       sig { returns(T.untyped) }
       attr_reader :method
 
+      sig { returns(T::Array[T.untyped]) }
+      attr_reader :methods
+
       sig { returns(String) }
       attr_reader :realm
 
@@ -22,23 +27,55 @@ module Mpp
       sig { returns(T::Hash[String, T.untyped]) }
       attr_reader :defaults
 
-      sig { params(method: T.untyped, realm: String, secret_key: String, defaults: T.nilable(T::Hash[String, T.untyped]), events: T.nilable(Mpp::Events::Dispatcher)).void }
-      def initialize(method:, realm:, secret_key:, defaults: nil, events: nil)
-        @method = T.let(method, T.untyped)
+      sig { returns(T::Boolean) }
+      attr_reader :requires_auth
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :credential_header
+
+      sig do
+        params(
+          realm: String,
+          secret_key: String,
+          method: T.untyped,
+          methods: T.nilable(T::Array[T.untyped]),
+          defaults: T.nilable(T::Hash[String, T.untyped]),
+          events: T.nilable(Mpp::Events::Dispatcher),
+          requires_auth: T::Boolean
+        ).void
+      end
+      def initialize(realm:, secret_key:, method: nil, methods: nil, defaults: nil, events: nil, requires_auth: false)
+        @methods = T.let(normalize_methods(method, methods), T::Array[T.untyped])
+        @method = T.let(@methods.first, T.untyped)
         @realm = T.let(realm, String)
         @secret_key = T.let(secret_key, String)
         @defaults = T.let(defaults || {}, T::Hash[String, T.untyped])
         @events = T.let(events || Mpp::Events.server_dispatcher, Mpp::Events::Dispatcher)
+        @method_hook_events = T.let(Mpp::Events.server_dispatcher, Mpp::Events::Dispatcher)
+        @requires_auth = T.let(requires_auth, T::Boolean)
+        @credential_header = T.let(requires_auth ? Mpp::PAYMENT_AUTHORIZATION_HEADER : nil, T.nilable(String))
+        register_method_payment_success
       end
 
       # Create with auto-detected realm and secret_key.
-      sig { params(method: T.untyped, realm: T.untyped, secret_key: T.untyped, events: T.nilable(Mpp::Events::Dispatcher)).returns(T.attached_class) }
-      def self.create(method:, realm: nil, secret_key: nil, events: nil)
+      sig do
+        params(
+          method: T.untyped,
+          methods: T.nilable(T::Array[T.untyped]),
+          realm: T.untyped,
+          secret_key: T.untyped,
+          events: T.nilable(Mpp::Events::Dispatcher),
+          requires_auth: T::Boolean
+        ).returns(T.attached_class)
+      end
+      def self.create(method: nil, methods: nil, realm: nil, secret_key: nil, events: nil, requires_auth: false)
         new(
           method: method,
+          methods: methods,
           realm: realm || Defaults.detect_realm,
           secret_key: secret_key || Defaults.detect_secret_key,
-          events: events
+          events: events,
+          requires_auth: requires_auth
         )
       end
 
@@ -62,20 +99,138 @@ module Mpp
         on(Mpp::Events::PAYMENT_SUCCESS, handler, &block)
       end
 
+      # Select the HTTP header value that carries the Payment credential.
+      # When requires_auth is true, Payment credentials ride in
+      # Payment-Authorization so Authorization can hold application auth.
+      sig { params(authorization: T.nilable(String), payment_authorization: T.nilable(String)).returns(T.nilable(String)) }
+      def payment_credential_value(authorization, payment_authorization = nil)
+        @requires_auth ? payment_authorization : authorization
+      end
+
+      # Combine method offers into a single callable that presents every method.
+      sig { params(entries: T.untyped).returns(ComposedHandler) }
+      def compose(*entries)
+        ComposedHandler.from_entries(self, entries)
+      end
+
+      # Look up a registered method by object, name, or "name/intent" key.
+      sig { params(method_ref: T.untyped).returns(T.untyped) }
+      def resolve_method(method_ref)
+        case method_ref
+        when String
+          resolve_method_key(method_ref)
+        else
+          found = @methods.find { |candidate| candidate.equal?(method_ref) } ||
+            @methods.find { |candidate| candidate.name == method_ref.name }
+          return found if found
+
+          raise ArgumentError, "No handler for #{method_ref.inspect}. Is this method in your methods array?"
+        end
+      end
+
       # Handle a charge intent.
-      sig { params(authorization: T.nilable(String), amount: String, currency: T.nilable(String), recipient: T.nilable(String), expires: T.nilable(String), description: T.nilable(String), external_id: T.nilable(String), memo: T.nilable(String), fee_payer: T::Boolean, chain_id: T.nilable(Integer), extra: T.nilable(T::Hash[String, String]), mppx_scope: T.nilable(T::Hash[String, String]), body: T.untyped).returns(T.untyped) }
-      def charge(authorization, amount, currency: nil, recipient: nil, expires: nil,
-        description: nil, external_id: nil, memo: nil, fee_payer: false, chain_id: nil,
-        extra: nil, mppx_scope: nil, body: nil)
-        intent = @method.intents["charge"]
-        raise ArgumentError, "Method #{@method.name} does not support charge intent" unless intent
-
-        resolved_currency = currency || (@method.respond_to?(:currency) ? @method.currency : nil)
-        resolved_recipient = recipient || (@method.respond_to?(:recipient) ? @method.recipient : nil)
+      #
+      # With a single registered charge method this returns Challenge or
+      # [Credential, Receipt]. With multiple charge methods it implicitly
+      # composes them and returns a ComposedResult.
+      sig { params(authorization: T.nilable(String), amount: String, kwargs: T.untyped).returns(T.untyped) }
+      def charge(authorization, amount, **kwargs)
+        charge_methods = @methods.select { |candidate| candidate.intents.key?("charge") }
+        raise ArgumentError, "No registered method supports charge intent" if charge_methods.empty?
+
+        request_opts = kwargs.slice(*REQUEST_OPTION_KEYS)
+        offer_opts = kwargs.except(*REQUEST_OPTION_KEYS)
+        payment = payment_credential_value(authorization, request_opts[:payment_authorization])
+
+        if charge_methods.length == 1
+          return charge_one(
+            charge_methods.first,
+            payment,
+            amount,
+            **request_opts,
+            **offer_opts
+          )
+        end
+
+        entries = charge_methods.map { |candidate| [candidate, offer_opts.merge(amount: amount)] }
+        ComposedHandler.from_entries(self, entries).call(
+          authorization: authorization,
+          payment_authorization: request_opts[:payment_authorization],
+          payment_signature: request_opts[:payment_signature],
+          body: request_opts[:body],
+          url: request_opts[:url],
+          accept_payment: request_opts[:accept_payment],
+          http_method: request_opts[:http_method]
+        )
+      end
+
+      # Verify or challenge a single method. Used by compose and charge.
+      # The optional request guard can omit an offer after its canonical request
+      # is built, ensuring the guard and challenge use the exact same request.
+      sig { params(method: T.untyped, authorization: T.nilable(String), amount: String, kwargs: T.untyped, request_guard: T.nilable(T.proc.params(request: T::Hash[String, T.untyped]).returns(T::Boolean))).returns(T.untyped) }
+      def charge_one(method, authorization, amount, **kwargs, &request_guard)
+        intent = method.intents["charge"]
+        raise ArgumentError, "Method #{method.name} does not support charge intent" unless intent
+
+        body = kwargs[:body]
+        url = kwargs[:url]
+        payment_signature = kwargs[:payment_signature]
+        offer_opts = kwargs.except(*REQUEST_OPTION_KEYS)
+        request = build_charge_request(method, amount, **offer_opts)
+        return nil if request_guard && !request_guard.call(request)
+
+        if payment_signature && method.respond_to?(:bind_x402_credential)
+          return verify_x402(
+            method,
+            intent,
+            request,
+            payment_signature: payment_signature,
+            url: url,
+            body: body,
+            description: offer_opts[:description],
+            expires: offer_opts[:expires],
+            http_method: kwargs[:http_method]
+          )
+        end
+
+        Verify.verify_or_challenge(
+          authorization: authorization,
+          intent: intent,
+          request: request,
+          realm: @realm,
+          secret_key: @secret_key,
+          method: method.name,
+          description: offer_opts[:description],
+          expires: offer_opts[:expires],
+          events: @events,
+          method_hook_events: @method_hook_events,
+          body: body,
+          header: @credential_header
+        )
+      end
+
+      # Build the canonical charge request for a method without verifying.
+      sig { params(method: T.untyped, amount: String, kwargs: T.untyped).returns(T::Hash[String, T.untyped]) }
+      def build_charge_request(method, amount, **kwargs)
+        currency = kwargs[:currency]
+        recipient = kwargs[:recipient]
+        external_id = kwargs[:external_id]
+        memo = kwargs[:memo]
+        fee_payer = if kwargs.key?(:fee_payer)
+          kwargs[:fee_payer]
+        else
+          method.respond_to?(:fee_payer) && method.fee_payer
+        end
+        chain_id = kwargs[:chain_id]
+        extra = kwargs[:extra]
+        mppx_scope = kwargs[:mppx_scope]
+
+        resolved_currency = currency || (method.respond_to?(:currency) ? method.currency : nil)
+        resolved_recipient = recipient || (method.respond_to?(:recipient) ? method.recipient : nil)
         raise ArgumentError, "currency must be set on the method or passed to charge()" unless resolved_currency
         raise ArgumentError, "recipient must be set on the method or passed to charge()" unless resolved_recipient
 
-        decimals = @method.respond_to?(:decimals) ? @method.decimals : DEFAULT_DECIMALS
+        decimals = method.respond_to?(:decimals) ? method.decimals : DEFAULT_DECIMALS
         base_amount = Mpp::Units.parse_units(amount, decimals).to_s
 
         request = {
@@ -86,20 +241,20 @@ module Mpp
         request["externalId"] = external_id unless external_id.nil?
 
         if extra
-          extra.each do |k, v|
-            raise ArgumentError, "extra must be a dict[str, str]" unless k.is_a?(String) && v.is_a?(String)
+          extra.each do |key, value|
+            raise ArgumentError, "extra must be a dict[str, str]" unless key.is_a?(String) && value.is_a?(String)
           end
           request["extra"] = extra
         end
         if mppx_scope
-          mppx_scope.each do |k, v|
-            raise ArgumentError, "mppx_scope must be a dict[str, str]" unless k.is_a?(String) && v.is_a?(String)
+          mppx_scope.each do |key, value|
+            raise ArgumentError, "mppx_scope must be a dict[str, str]" unless key.is_a?(String) && value.is_a?(String)
           end
           request["_mppx_scope"] = mppx_scope
         end
 
         resolved_chain_id = chain_id
-        resolved_chain_id ||= @method.chain_id if @method.respond_to?(:chain_id)
+        resolved_chain_id ||= method.chain_id if method.respond_to?(:chain_id)
 
         if memo || fee_payer || !resolved_chain_id.nil?
           method_details = {}
@@ -109,20 +264,153 @@ module Mpp
           request["methodDetails"] = method_details
         end
 
-        request = Mpp::Server::MethodHelper.transform_request(@method, request, nil)
+        Mpp::Server::MethodHelper.transform_request(method, request, nil)
+      end
 
-        Verify.verify_or_challenge(
-          authorization: authorization,
-          intent: intent,
-          request: request,
-          realm: @realm,
-          secret_key: @secret_key,
-          method: @method.name,
-          description: description,
-          expires: expires,
-          events: @events,
-          body: body
+      # Render a 402 response, applying method-specific extra headers (x402).
+      sig { params(challenge: T.untyped, url: T.nilable(String), http_method: T.nilable(String)).returns(T::Hash[T.untyped, T.untyped]) }
+      def challenge_response(challenge, url: nil, http_method: nil)
+        challenges = challenge.is_a?(Array) ? challenge : [challenge]
+        extra = {}
+        if @methods.length == 1 && @method.respond_to?(:decorate_challenge)
+          @method.decorate_challenge(extra, challenges.first, url: url, http_method: http_method)
+        end
+        Decorator.make_challenge_response(challenges, @realm, extra_headers: extra)
+      end
+
+      private
+
+      sig { params(method: T.untyped, methods: T.untyped).returns(T::Array[T.untyped]) }
+      def normalize_methods(method, methods)
+        if !method.nil? && !methods.nil?
+          raise ArgumentError, "pass method: or methods:, not both"
+        end
+
+        list = methods || (method.nil? ? nil : [method])
+        raise ArgumentError, "method: or methods: is required" if list.nil? || list.empty?
+
+        names = list.map(&:name)
+        duplicates = names.tally.select { |_name, count| count > 1 }.keys
+        raise ArgumentError, "duplicate payment method names: #{duplicates.join(", ")}" unless duplicates.empty?
+
+        list
+      end
+
+      sig { params(key: String).returns(T.untyped) }
+      def resolve_method_key(key)
+        name, intent = key.split("/", 2)
+        found = if intent
+          @methods.find { |candidate| candidate.name == name && candidate.intents.key?(intent) }
+        else
+          @methods.find { |candidate| candidate.name == name }
+        end
+        return found if found
+
+        raise ArgumentError, "No handler for #{key.inspect}. Is this method in your methods array?"
+      end
+
+      sig do
+        params(
+          method: T.untyped,
+          intent: T.untyped,
+          request: T::Hash[String, T.untyped],
+          payment_signature: String,
+          url: T.nilable(String),
+          body: T.untyped,
+          description: T.nilable(String),
+          expires: T.nilable(String),
+          http_method: T.nilable(String)
+        ).returns(T.untyped)
+      end
+      def verify_x402(method, intent, request, payment_signature:, url:, body:, description:, expires:, http_method: nil)
+        challenge = Verify.create_challenge(
+          method.name,
+          intent.name,
+          Mpp::Units.transform_units(request),
+          @realm,
+          @secret_key,
+          description,
+          nil,
+          expires,
+          body,
+          @credential_header
         )
+        method_context = {name: method.name, intent: intent.name}
+
+        begin
+          credential = method.bind_x402_credential(
+            payment_signature,
+            challenge: challenge,
+            request: challenge.request,
+            url: url,
+            body: body,
+            http_method: http_method
+          )
+          receipt = intent.verify(credential, challenge.request)
+        rescue => error
+          if @events.has_handlers?(Mpp::Events::PAYMENT_FAILED)
+            Verify.emit_payment_failed(
+              dispatcher: @events,
+              challenge: challenge,
+              credential: nil,
+              error: error,
+              method: method_context,
+              request: challenge.request,
+              retry_challenge: challenge
+            )
+          end
+          if error.is_a?(Mpp::ParseError) || error.is_a?(Mpp::VerificationError) || error.is_a?(Mpp::PaymentError)
+            if @events.has_handlers?(Mpp::Events::CHALLENGE_CREATED)
+              Verify.emit_challenge_created(
+                dispatcher: @events,
+                challenge: challenge,
+                credential: nil,
+                error: error,
+                method: method_context,
+                request: challenge.request
+              )
+            end
+            return challenge
+          end
+          raise
+        end
+
+        if @events.has_handlers?(Mpp::Events::PAYMENT_SUCCESS) || @method_hook_events.has_handlers?(Mpp::Events::PAYMENT_SUCCESS)
+          Verify.emit_payment_success(
+            dispatcher: @events,
+            method_hook_dispatcher: @method_hook_events,
+            challenge: challenge,
+            credential: credential,
+            method: method_context,
+            receipt: receipt,
+            request: challenge.request
+          )
+        end
+        [credential, receipt]
+      end
+
+      private
+
+      sig { void }
+      def register_method_payment_success
+        @methods.each do |payment_method|
+          next unless payment_method.respond_to?(:on_payment_success)
+
+          hook = payment_method.on_payment_success
+          next if hook.nil?
+          raise ArgumentError, "on_payment_success must be callable" unless hook.respond_to?(:call)
+
+          method_name = payment_method.name
+          intent_names = payment_method.intents.each_value.map { |intent| intent.name }
+          @method_hook_events.on(Mpp::Events::PAYMENT_SUCCESS) do |payload|
+            event_method = payload[:method]
+            next unless event_method.is_a?(Hash)
+            next unless event_method[:name] == method_name
+            next unless intent_names.include?(event_method[:intent])
+
+            hook.call(payload)
+          end
+        end
       end
     end
   end