pay 11.2.3 → 11.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71299748a825cda0c189c61f051f666840c413df3e33e177d126dffa9feaa2fe
-  data.tar.gz: 3d6ad655b364d9fea688fbeae0e1f013bd6966e796559ec4cf1e2d5cb181dda0
+  metadata.gz: 82b0246d201ed5b493e730a2620e5ef8b084d25dbd9d2aeb45d376b3515e0500
+  data.tar.gz: 7086d1d8ed0c6c999fc6d9e221a4bc7bdbde9a01b07f6c2257dbe3e5ca52bf3b
 SHA512:
-  metadata.gz: 530ea9ae04118c33c7aa91e17bb945cb752b22d175b3bdc32eef915e7e304f97f2017409eb53c3adb4ebeb319abf5e9c698ffa618167065d230c548d64ac23df
-  data.tar.gz: a39c4b305ce5083fcf44fdd8813de11292938bd2439a6288039d0f737e6f134b0ed869c61a06b99d1db4b105207e017de805c5a6cc86cbf9c2230add37dc69da
+  metadata.gz: b5e2f3c52f8d2fadf7803798ffe98c9dbd2f40d91095548c87374e7a1bebab7cbe60ec18c5357fe19703fdb7761414849554dc988fc45d03c9e762f91742fff7
+  data.tar.gz: c32a6bd51f512eeaba0b4689a281b866b2fe246e9ee9d81b7f55491244750f8f6dfea2f400d69473096b27b117aec1e8e48e46688cace5042f9273b804561d14

data/Rakefile

@@ -19,8 +19,6 @@ end
 APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
 load "rails/tasks/engine.rake"
 
-load "rails/tasks/statistics.rake"
-
 require "rake/testtask"
 
 Rake::TestTask.new(:test) do |t|

data/app/controllers/pay/webhooks/braintree_controller.rb

@@ -1,10 +1,6 @@
 module Pay
   module Webhooks
-    class BraintreeController < Pay::ApplicationController
-      if Rails.application.config.action_controller.default_protect_from_forgery
-        skip_before_action :verify_authenticity_token
-      end
-
+    class BraintreeController < ActionController::API
       def create
         queue_event(verified_event)
         head :ok

data/app/controllers/pay/webhooks/lemon_squeezy_controller.rb

@@ -1,10 +1,6 @@
 module Pay
   module Webhooks
-    class LemonSqueezyController < Pay::ApplicationController
-      if Rails.application.config.action_controller.default_protect_from_forgery
-        skip_before_action :verify_authenticity_token
-      end
-
+    class LemonSqueezyController < ActionController::API
       def create
         if valid_signature?(request.headers["X-Signature"])
           queue_event(verify_params.as_json)

data/app/controllers/pay/webhooks/paddle_billing_controller.rb

@@ -1,10 +1,6 @@
 module Pay
   module Webhooks
-    class PaddleBillingController < Pay::ApplicationController
-      if Rails.application.config.action_controller.default_protect_from_forgery
-        skip_before_action :verify_authenticity_token
-      end
-
+    class PaddleBillingController < ActionController::API
       def create
         if valid_signature?(request.headers["Paddle-Signature"])
           queue_event(verify_params.as_json)
@@ -40,7 +36,8 @@ module Pay
         digest = OpenSSL::Digest.new("sha256")
 
         hmac = OpenSSL::HMAC.hexdigest(digest, key, data)
-        hmac == h1
+        return false if h1.nil? || hmac.bytesize != h1.bytesize
+        ActiveSupport::SecurityUtils.secure_compare(hmac, h1)
       end
 
       def verify_params

data/app/controllers/pay/webhooks/paddle_classic_controller.rb

@@ -1,10 +1,6 @@
 module Pay
   module Webhooks
-    class PaddleClassicController < Pay::ApplicationController
-      if Rails.application.config.action_controller.default_protect_from_forgery
-        skip_before_action :verify_authenticity_token
-      end
-
+    class PaddleClassicController < ActionController::API
       def create
         queue_event(verified_event)
         head :ok

data/app/controllers/pay/webhooks/stripe_controller.rb

@@ -1,10 +1,6 @@
 module Pay
   module Webhooks
-    class StripeController < Pay::ApplicationController
-      if Rails.application.config.action_controller.default_protect_from_forgery
-        skip_before_action :verify_authenticity_token
-      end
-
+    class StripeController < ActionController::API
       def create
         event = verified_event
         queue_event(event) if event.livemode || Pay::Stripe.webhook_receive_test_events

data/app/mailers/pay/user_mailer.rb

@@ -2,7 +2,7 @@ module Pay
   class UserMailer < Pay.parent_mailer.constantize
     def receipt
       if params[:pay_charge].respond_to? :receipt
-        attachments[params[:pay_charge].filename] = params[:pay_charge].receipt
+        attachments[params[:pay_charge].receipt_filename] = params[:pay_charge].receipt
       end
 
       mail mail_arguments

data/app/models/pay/braintree/customer.rb

@@ -158,7 +158,7 @@ module Pay
 
       def save_payment_method(payment_method, default:)
         attributes = case payment_method
-        when ::Braintree::CreditCard, ::Braintree::ApplePayCard, ::Braintree::GooglePayCard, ::Braintree::SamsungPayCard, ::Braintree::VisaCheckoutCard
+        when ::Braintree::CreditCard, ::Braintree::ApplePayCard, ::Braintree::GooglePayCard, ::Braintree::SamsungPayCard
           {
             payment_method_type: :card,
             brand: payment_method.card_type,

data/app/models/pay/braintree/payment_method.rb

@@ -10,10 +10,16 @@ module Pay
         pay_customer.save_payment_method(object, default: object.default?)
       end
 
-      # Sets payment method as default on Stripe
+      # Sets payment method as default
       def make_default!
+        return if default?
+
         result = gateway.customer.update(customer.processor_id, default_payment_method_token: processor_id)
         raise Pay::Braintree::Error, result unless result.success?
+
+        customer.payment_methods.update_all(default: false)
+        update!(default: true)
+
         result.success?
       end
 

data/app/models/pay/fake_processor/payment_method.rb

@@ -2,6 +2,10 @@ module Pay
   module FakeProcessor
     class PaymentMethod < Pay::PaymentMethod
       def make_default!
+        return if default?
+
+        customer.payment_methods.update_all(default: false)
+        update!(default: true)
       end
 
       def detach

data/app/models/pay/lemon_squeezy/charge.rb

@@ -6,7 +6,7 @@ module Pay
       def self.sync_order(order_id, object: nil, try: 0, retries: 1)
         object ||= ::LemonSqueezy::Order.retrieve(id: order_id)
 
-        pay_customer = Pay::Customer.find_by(type: "Pay::LemonSqueezy::Customer", processor_id: object.customer_id)
+        pay_customer = Pay::LemonSqueezy::Customer.find_by(processor_id: object.customer_id)
         return unless pay_customer
 
         processor_id = "order:#{object.id}"
@@ -34,7 +34,7 @@ module Pay
         # Skip loading the latest subscription invoice details from the API if we already have it
         object ||= ::LemonSqueezy::SubscriptionInvoice.retrieve(id: subscription_invoice_id)
 
-        pay_customer = Pay::Customer.find_by(type: "Pay::LemonSqueezy::Customer", processor_id: object.customer_id)
+        pay_customer = Pay::LemonSqueezy::Customer.find_by(processor_id: object.customer_id)
         return unless pay_customer
 
         processor_id = "subscription_invoice:#{object.id}"

data/app/models/pay/lemon_squeezy/payment_method.rb

@@ -18,6 +18,10 @@ module Pay
       end
 
       def make_default!
+        return if default?
+
+        customer.payment_methods.update_all(default: false)
+        update!(default: true)
       end
 
       def detach

data/app/models/pay/paddle_billing/payment_method.rb

@@ -36,6 +36,10 @@ module Pay
       end
 
       def make_default!
+        return if default?
+
+        customer.payment_methods.update_all(default: false)
+        update!(default: true)
       end
 
       def detach

data/app/models/pay/paddle_classic/payment_method.rb

@@ -41,6 +41,10 @@ module Pay
       end
 
       def make_default!
+        return if default?
+
+        customer.payment_methods.update_all(default: false)
+        update!(default: true)
       end
 
       def detach

data/app/models/pay/payment_method.rb

@@ -21,19 +21,6 @@ module Pay
     def self.pay_processor_for(name)
       "Pay::#{name.to_s.classify}::PaymentMethod".constantize
     end
-
-    def payment_processor
-      @payment_processor ||= self.class.pay_processor_for(customer.processor).new(self)
-    end
-
-    def make_default!
-      return if default?
-
-      payment_processor.make_default!
-
-      customer.payment_methods.update_all(default: false)
-      update!(default: true)
-    end
   end
 end
 

data/app/models/pay/stripe/charge.rb

@@ -48,8 +48,9 @@ module Pay
 
         # Associate charge with subscription if we can
         if object.payment_intent.present?
-          invoice_payments = ::Stripe::InvoicePayment.list({payment: {type: :payment_intent, payment_intent: object.payment_intent}, status: :paid, expand: ["data.invoice.total_discount_amounts.discount"]}, {stripe_account: stripe_account}.compact)
-          if invoice_payments.any? && (invoice = invoice_payments.first.invoice)
+          invoice_payments = ::Stripe::InvoicePayment.list({payment: {type: :payment_intent, payment_intent: object.payment_intent}, status: :paid}, {stripe_account: stripe_account}.compact)
+          if invoice_payments.any?
+            invoice = ::Stripe::Invoice.retrieve({id: invoice_payments.first.invoice, expand: ["total_discount_amounts.discount.source.coupon"]}, {stripe_account: stripe_account}.compact)
             attrs[:stripe_invoice] = invoice.to_hash
             attrs[:subtotal] = invoice.subtotal
             attrs[:tax] = invoice.total - invoice.total_excluding_tax.to_i
@@ -139,7 +140,8 @@ module Pay
       end
 
       def stripe_object
-        ::Stripe::Charge.construct_from(object) if object?
+        sync! if object.nil?
+        ::Stripe::Charge.construct_from(object)
       end
 
       private

data/app/models/pay/stripe/customer.rb

@@ -175,7 +175,7 @@ module Pay
         }
 
         # Hosted (the default) checkout sessions require a success_url and cancel_url
-        if ["", "hosted"].include? options[:ui_mode].to_s
+        if ["", "hosted_page"].include?(options[:ui_mode].to_s)
           args[:success_url] = merge_session_id_param(options.delete(:success_url) || root_url)
           args[:cancel_url] = merge_session_id_param(options.delete(:cancel_url) || root_url)
         end

data/app/models/pay/stripe/payment_method.rb

@@ -31,7 +31,7 @@ module Pay
           return
         end
 
-        default_payment_method_id = pay_customer.api_record.invoice_settings.default_payment_method
+        default_payment_method_id = pay_customer.api_record.invoice_settings&.default_payment_method
         default = (id == default_payment_method_id)
 
         attributes = extract_attributes(object).merge(default: default, stripe_account: stripe_account)
@@ -67,7 +67,12 @@ module Pay
 
       # Sets payment method as default
       def make_default!
+        return if default?
+
         ::Stripe::Customer.update(customer.processor_id, {invoice_settings: {default_payment_method: processor_id}}, stripe_options)
+
+        customer.payment_methods.update_all(default: false)
+        update!(default: true)
       end
 
       # Remove payment method

data/app/models/pay/stripe/subscription.rb

@@ -140,6 +140,7 @@ module Pay
       end
 
       def stripe_object
+        sync! if object.nil?
         ::Stripe::Subscription.construct_from(object)
       end
 
@@ -279,7 +280,6 @@ module Pay
           unpause
         else
           @api_record = ::Stripe::Subscription.update(processor_id, {
-            plan: processor_plan,
             trial_end: (on_trial? ? trial_ends_at.to_i : "now"),
             cancel_at_period_end: false
           }.merge(expand_options),
@@ -300,10 +300,9 @@ module Pay
           processor_id,
           {
             cancel_at_period_end: false,
-            plan: plan,
+            items: [{id: subscription_items.first.id, plan: plan, quantity: quantity}],
             proration_behavior: proration_behavior,
-            trial_end: (on_trial? ? trial_ends_at.to_i : "now"),
-            quantity: quantity
+            trial_end: (on_trial? ? trial_ends_at.to_i : "now")
           }.merge(expand_options).merge(options),
           stripe_options
         )
@@ -335,7 +334,7 @@ module Pay
 
       # Retries the latest invoice for a Past Due subscription and attempts to pay it
       def retry_failed_payment(payment_intent_id: nil)
-        payment_intent_id ||= api_record.latest_invoice.payment_intent.id
+        payment_intent_id ||= api_record.latest_invoice.payments.first.payment.payment_intent
         payment_intent = ::Stripe::PaymentIntent.retrieve({id: payment_intent_id}, stripe_options)
 
         payment_intent = if payment_intent.status == "requires_payment_method"

data/app/models/pay/subscription.rb

@@ -3,7 +3,7 @@ module Pay
     STATUSES = %w[incomplete incomplete_expired trialing active past_due canceled unpaid paused]
 
     # Associations
-    belongs_to :customer
+    belongs_to :customer, touch: true
     belongs_to :payment_method, optional: true, primary_key: :processor_id
     has_many :charges
 

data/lib/pay/attributes.rb

@@ -37,7 +37,11 @@ module Pay
 
         with_lock do
           pay_customers.update_all(default: false)
-          pay_customer = pay_customers.active.where(processor: processor_name, type: klass.name, stripe_account: stripe_account).first_or_initialize
+          pay_customer = pay_customers.active.where(
+            Pay::Customer.inheritance_column => klass.name,
+            :processor => processor_name,
+            :stripe_account => stripe_account
+          ).first_or_initialize
           pay_customer.update!(attributes.merge(default: true))
         end
 
@@ -52,7 +56,11 @@ module Pay
         klass = "Pay::#{processor_name.to_s.classify}::Customer".constantize
         raise ArgumentError, "not a valid payment processor" if klass.ancestors.exclude?(Pay::Customer)
 
-        pay_customer = pay_customers.active.where(processor: processor_name, type: klass.name, stripe_account: stripe_account).first_or_initialize
+        pay_customer = pay_customers.active.where(
+          Pay::Customer.inheritance_column => klass.name,
+          :processor => processor_name,
+          :stripe_account => stripe_account
+        ).first_or_initialize
         pay_customer.update!(attributes)
         pay_customer
       end
@@ -83,7 +91,10 @@ module Pay
       def set_merchant_processor(processor_name, **attributes)
         with_lock do
           pay_merchants.update_all(default: false)
-          pay_merchant = pay_merchants.where(processor: processor_name, type: "Pay::#{processor_name.to_s.classify}::Merchant").first_or_initialize
+          pay_merchant = pay_merchants.where(
+            Pay::Merchant.inheritance_column => "Pay::#{processor_name.to_s.classify}::Merchant",
+            :processor => processor_name
+          ).first_or_initialize
           pay_merchant.update!(attributes.merge(default: true))
         end
 

data/lib/pay/errors.rb

@@ -3,7 +3,7 @@ module Pay
   class Error < StandardError
   end
 
-  class PaymentError < StandardError
+  class PaymentError < Error
     attr_reader :payment
 
     def initialize(payment)

data/lib/pay/paddle_classic/webhooks/signature_verifier.rb

@@ -39,7 +39,7 @@ module Pay
 
           # verify the data
           digest = OpenSSL::Digest.new("SHA1")
-          pub_key = OpenSSL::PKey::RSA.new(public_key)
+          pub_key = OpenSSL::PKey::RSA.new(public_key).public_key
           pub_key.verify(digest, signature, data_serialized)
         end
 

data/lib/pay/receipts.rb

@@ -70,8 +70,8 @@ module Pay
       items
     end
 
-    def discount_description(discount)
-      coupon = discount.discount.coupon
+    def discount_description(total_discount_amount)
+      coupon = total_discount_amount.discount.try(:source).try(:coupon) || total_discount_amount.discount.try(:coupon)
       name = coupon.name
 
       if (percent = coupon.percent_off)

data/lib/pay/stripe/webhooks/invoice_updated.rb

@@ -0,0 +1,34 @@
+module Pay
+  module Stripe
+    module Webhooks
+      class InvoiceUpdated
+        def call(event)
+          # Grab the invoice from the event
+          invoice = event.data.object
+
+          # Find the corresponding subscription_id
+          subscription_id = invoice.parent.try(:subscription_details).try(:subscription)
+
+          # Not all invoices have a subscription - could be a one-time or manual payment
+          return if subscription_id.blank?
+
+          # Grab the local subscription
+          subscription = Pay::Subscription.find_by_processor_and_id(:stripe, subscription_id)
+
+          # Return if we don't have a corresponding subscription
+          return unless subscription
+
+          # Grab the local latest_invoice from the subscription stripe_object
+          latest_invoice = subscription.stripe_object.try(:latest_invoice)
+
+          # Compare the local invoice id to the event invoice id and sync if they are the same
+          if latest_invoice.id.to_s == invoice.id.to_s
+            Pay::Stripe::Subscription.sync(subscription_id, stripe_account: event.try(:account))
+          end
+        rescue ::Stripe::StripeError => e
+          Rails.logger.error "Stripe Webhook Error (InvoiceUpdated): #{e.message}"
+        end
+      end
+    end
+  end
+end

data/lib/pay/stripe.rb

@@ -12,6 +12,7 @@ module Pay
       autoload :CheckoutSessionAsyncPaymentSucceeded, "pay/stripe/webhooks/checkout_session_async_payment_succeeded"
       autoload :CustomerDeleted, "pay/stripe/webhooks/customer_deleted"
       autoload :CustomerUpdated, "pay/stripe/webhooks/customer_updated"
+      autoload :InvoiceUpdated, "pay/stripe/webhooks/invoice_updated"
       autoload :PaymentActionRequired, "pay/stripe/webhooks/payment_action_required"
       autoload :PaymentFailed, "pay/stripe/webhooks/payment_failed"
       autoload :PaymentIntentSucceeded, "pay/stripe/webhooks/payment_intent_succeeded"
@@ -27,7 +28,7 @@ module Pay
 
     extend Env
 
-    REQUIRED_VERSION = "~> 15"
+    REQUIRED_VERSION = "~> 19"
 
     # A list of database model names that include Pay
     # Used for safely looking up models with client_reference_id
@@ -84,6 +85,9 @@ module Pay
         # This probably should be ignored for monthly subscriptions.
         events.subscribe "stripe.invoice.upcoming", Pay::Stripe::Webhooks::SubscriptionRenewing.new
 
+        # Ensures the local stripe_object is up-to-date anytime the API's record is updated.
+        events.subscribe "stripe.invoice.updated", Pay::Stripe::Webhooks::InvoiceUpdated.new
+
         # Payment action is required to process an invoice
         events.subscribe "stripe.invoice.payment_action_required", Pay::Stripe::Webhooks::PaymentActionRequired.new
 
@@ -111,6 +115,7 @@ module Pay
         # If a customer's payment source was deleted in Stripe, we should update as well
         events.subscribe "stripe.payment_method.attached", Pay::Stripe::Webhooks::PaymentMethodAttached.new
         events.subscribe "stripe.payment_method.updated", Pay::Stripe::Webhooks::PaymentMethodUpdated.new
+        events.subscribe "stripe.payment_method.automatically_updated", Pay::Stripe::Webhooks::PaymentMethodUpdated.new
         events.subscribe "stripe.payment_method.card_automatically_updated", Pay::Stripe::Webhooks::PaymentMethodUpdated.new
         events.subscribe "stripe.payment_method.detached", Pay::Stripe::Webhooks::PaymentMethodDetached.new
 

data/lib/pay/version.rb

@@ -1,3 +1,3 @@
 module Pay
-  VERSION = "11.2.3"
+  VERSION = "11.6.2"
 end

data/lib/pay.rb

@@ -38,7 +38,7 @@ module Pay
   mattr_accessor :business_address
   mattr_accessor :business_name
   mattr_accessor :business_logo
-  mattr_accessor :support_email
+  mattr_reader :support_email
 
   def self.support_email=(value)
     @@support_email = value.is_a?(::Mail::Address) ? value : ::Mail::Address.new(value)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pay
 version: !ruby/object:Gem::Version
-  version: 11.2.3
+  version: 11.6.2
 platform: ruby
 authors:
 - Jason Charnes
@@ -153,6 +153,7 @@ files:
 - lib/pay/stripe/webhooks/checkout_session_completed.rb
 - lib/pay/stripe/webhooks/customer_deleted.rb
 - lib/pay/stripe/webhooks/customer_updated.rb
+- lib/pay/stripe/webhooks/invoice_updated.rb
 - lib/pay/stripe/webhooks/payment_action_required.rb
 - lib/pay/stripe/webhooks/payment_failed.rb
 - lib/pay/stripe/webhooks/payment_intent_succeeded.rb
@@ -172,7 +173,8 @@ files:
 homepage: https://github.com/pay-rails/pay
 licenses:
 - MIT
-metadata: {}
+metadata:
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -187,7 +189,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.1
+rubygems_version: 4.0.15
 specification_version: 4
 summary: Payments engine for Ruby on Rails
 test_files: []