pay 12.1.0 → 12.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bdb443eecac93472dffd43cb07fd34ab9a8ef12722c4979443b8393a0c7d1dad
-  data.tar.gz: ec5ba35c1e9325eb0067f093037a999006ce98b0445623ff077b81c8cc82b9d6
+  metadata.gz: 19c2b44409eb406bf144f15e922e863e8265c0d65bba50141928da748ed0d0f0
+  data.tar.gz: c9dbd51994ab4747a672905bb3b6a0fadf9060ef46ebaaf5edd6acd3f4569197
 SHA512:
-  metadata.gz: 28a2aa3036163cf529a1cb016c76b7ec15ad90186c8bc990258f880b938fe30c2264abf579c85844668b58d9d1b667237d606defa76936d483ed8f716e57eeb3
-  data.tar.gz: 4fdb57edcc65f4e7a21fdde9ad7b0322a9b7812723312a880165022595368fa8e1c00defd2d528ee158772f239a6696ac6c3e3ead64ff94b763424065b779e3a
+  metadata.gz: b1ab458e90aaede5cdc5bb5418917c4084736bc4c48544b3d360ee4e0fac8975db1b24e363e218e2b2986837c7c97ea9724011b3196f00f9e85e9a7b0a26dce6
+  data.tar.gz: 744063befa0467573287d6264a87419018d63fd845a4cdd307f0cb0ecc08bb4570eb839524f9b225c3aeda0e7fdb1a1c095321e4090222c3f29d5355043e7d42

data/app/controllers/pay/webhooks/lemon_squeezy_controller.rb

@@ -13,9 +13,11 @@ module Pay
       end
 
       def valid_signature?(signature)
+        secret = Pay::LemonSqueezy.signing_secret
+        raise Pay::LemonSqueezy::Error, "Cannot verify signature without a Lemon Squeezy signing secret" if secret.blank?
         return false if signature.blank?
 
-        hmac = OpenSSL::HMAC.hexdigest("sha256", Pay::LemonSqueezy.signing_secret.to_s, request.raw_post)
+        hmac = OpenSSL::HMAC.hexdigest("sha256", secret, request.raw_post)
         ActiveSupport::SecurityUtils.secure_compare(hmac, signature)
       end
     end

data/app/controllers/pay/webhooks/paddle_billing_controller.rb

@@ -14,11 +14,14 @@ module Pay
 
       # The header looks like "ts=1671552777;h1=eb4d0dc8..."
       def valid_signature?(signature)
+        secret = Pay::PaddleBilling.signing_secret
+        raise Pay::PaddleBilling::Error, "Cannot verify signature without a Paddle Billing signing secret" if secret.blank?
+
         parts = signature.to_s.split(";").filter_map { |part| part.split("=", 2) if part.include?("=") }.to_h
         ts, h1 = parts.values_at("ts", "h1")
         return false if ts.blank? || h1.blank?
 
-        hmac = OpenSSL::HMAC.hexdigest("sha256", Pay::PaddleBilling.signing_secret.to_s, "#{ts}:#{request.raw_post}")
+        hmac = OpenSSL::HMAC.hexdigest("sha256", secret, "#{ts}:#{request.raw_post}")
         ActiveSupport::SecurityUtils.secure_compare(hmac, h1)
       end
     end

data/app/models/pay/paddle_billing/subscription.rb

@@ -39,8 +39,6 @@ module Pay
             pay_customer.payment_methods.destroy_all
           when "trialing"
             attributes[:trial_ends_at] = Time.parse(subscription.next_billed_at) if subscription.next_billed_at
-          when "paused"
-            attributes[:pause_starts_at] = Time.parse(subscription.paused_at) if subscription.paused_at
           when "active", "past_due"
             attributes[:trial_ends_at] = nil
             attributes[:pause_starts_at] = nil
@@ -76,10 +74,12 @@ module Pay
       end
 
       # If a subscription is paused, cancel immediately
-      # Otherwise, cancel at period end
+      # Otherwise, cancel at period end. A scheduled pause is removed first
       def cancel(**options)
         return if canceled?
 
+        remove_scheduled_pause if will_pause?
+
         response = ::Paddle::Subscription.cancel(
           id: processor_id,
           effective_from: options.fetch(:effective_from, paused? ? "immediately" : "next_billing_period")
@@ -94,8 +94,6 @@ module Pay
 
       def cancel_now!(**options)
         cancel(**options.merge(effective_from: "immediately"))
-      rescue ::Paddle::Error => e
-        raise Pay::PaddleBilling::Error, e
       end
 
       def change_quantity(quantity, **options)
@@ -117,16 +115,22 @@ module Pay
       # A subscription could be set to cancel or pause in the future
       # It is considered on grace period until the cancel or pause time begins
       def on_grace_period?
-        (canceled? && Time.current < ends_at) || (paused? && pause_starts_at? && Time.current < pause_starts_at)
+        (canceled? && ends_at.future?) || will_pause?
+      end
+
+      def will_pause?
+        pause_starts_at? && pause_starts_at.future?
       end
 
+      # Paddle keeps the status `active` until a scheduled pause starts, so check pause_starts_at as well
       def paused?
-        status == "paused"
+        status == "paused" || pause_starts_at?
       end
 
+      # Pauses the subscription at the end of the current billing period
       def pause
         response = ::Paddle::Subscription.pause(id: processor_id)
-        update!(status: :paused, pause_starts_at: response.scheduled_change.effective_at)
+        update!(status: response.status, pause_starts_at: response.scheduled_change.effective_at)
       rescue ::Paddle::Error => e
         raise Pay::PaddleBilling::Error, e
       end
@@ -141,9 +145,8 @@ module Pay
         end
 
         # Paddle Billing API only allows "resuming" subscriptions when they are paused
-        # So cancel the scheduled change if it is in the future
-        if paused? && pause_starts_at? && Time.current < pause_starts_at
-          ::Paddle::Subscription.update(id: processor_id, scheduled_change: nil)
+        if will_pause?
+          remove_scheduled_pause
         else
           ::Paddle::Subscription.resume(id: processor_id, effective_from: "immediately")
         end
@@ -168,6 +171,14 @@ module Pay
         )
         update(processor_plan: plan, ends_at: nil, status: :active)
       end
+
+      private
+
+      # Paddle rejects changes to a subscription with a scheduled change
+      def remove_scheduled_pause
+        ::Paddle::Subscription.update(id: processor_id, scheduled_change: nil)
+        update!(pause_starts_at: nil)
+      end
     end
   end
 end

data/app/models/pay/stripe/subscription.rb

@@ -217,7 +217,7 @@ module Pay
       end
 
       def paused?
-        pause_behavior == "void"
+        status_paused? || pause_behavior_void?
       end
 
       # Pauses a Stripe subscription
@@ -266,12 +266,22 @@ module Pay
         on_grace_period? || paused?
       end
 
-      def resume
+      # Resumes a subscription that is on its grace period or paused
+      #
+      # Subscriptions with a `paused` status are billed immediately and stay paused until that invoice is paid
+      # Raises Pay::InvalidPaymentMethod or Pay::ActionRequired if that payment needs a payment method or authentication
+      #
+      # resume(billing_cycle_anchor: "unchanged")
+      #
+      # https://docs.stripe.com/api/subscriptions/resume
+      def resume(**options)
         unless resumable?
-          raise Error, "You can only resume subscriptions within their grace period."
+          raise Error, "You can only resume subscriptions that are paused or within their grace period."
         end
 
-        if paused?
+        if status_paused?
+          @api_record = ::Stripe::Subscription.resume(processor_id, options.merge(expand_options), stripe_options)
+        elsif paused?
           unpause
         else
           @api_record = ::Stripe::Subscription.update(processor_id, {
@@ -281,6 +291,10 @@ module Pay
             stripe_options)
         end
         update(ends_at: nil, status: @api_record.status)
+
+        # Stripe resumes successfully even when the payment fails, leaving the subscription paused
+        validate_latest_payment if status_paused?
+        true
       rescue ::Stripe::StripeError => e
         raise Pay::Stripe::Error, e
       end
@@ -303,9 +317,7 @@ module Pay
         )
 
         # Validate that swap was successful and handle SCA if needed
-        if (payment_intent_id = @api_record.latest_invoice.payments.first&.payment&.payment_intent)
-          Pay::Payment.from_id(payment_intent_id, stripe_account: stripe_account).validate
-        end
+        validate_latest_payment
 
         sync!(object: @api_record)
       rescue ::Stripe::StripeError => e
@@ -369,6 +381,23 @@ module Pay
 
       private
 
+      # Stripe sets the status to `paused` when a trial ends without a payment method
+      def status_paused?
+        status == "paused"
+      end
+
+      # Pausing collection with `void` leaves the status unchanged
+      def pause_behavior_void?
+        pause_behavior == "void"
+      end
+
+      # Raises Pay::InvalidPaymentMethod or Pay::ActionRequired if the latest invoice's payment is incomplete
+      def validate_latest_payment
+        if (payment_intent = latest_payment)
+          Pay::Payment.new(payment_intent, stripe_account: stripe_account).validate
+        end
+      end
+
       # Options for Stripe requests
       def stripe_options
         {stripe_account: stripe_account}.compact

data/app/views/pay/payments/show.html.erb

@@ -1,12 +1,14 @@
+<% scope = @payment.setup_intent? ? "pay.setup_intent" : "pay" %>
 <div
   data-controller="payment-intent"
   data-payment-intent-public-key-value="<%= Pay::Stripe.public_key %>"
   data-payment-intent-stripe-account-value="<%= @payment.stripe_account %>"
   data-payment-intent-client-secret-value="<%= @payment.client_secret %>"
   data-payment-intent-status-value="<%= @payment.status %>"
+  data-payment-intent-setup-intent-value="<%= @payment.setup_intent? %>"
   data-payment-intent-customer-value="<%= @payment.customer %>"
   data-payment-intent-name-missing-message-value="<%= t("pay.requires_action.name_missing") %>"
-  data-payment-intent-confirmed-message-value="<%= t("pay.requires_action.success") %>"
+  data-payment-intent-confirmed-message-value="<%= t("requires_action.success", scope: scope) %>"
   class="h-screen md:flex md:justify-center md:items-center">
   <div class="w-full max-w-lg">
     <!-- Status Messages -->
@@ -28,18 +30,18 @@
 
     <div class="bg-white rounded-lg shadow-xl p-4 sm:py-6 sm:px-10 mb-5">
       <% if @payment.succeeded? %>
-        <h1 class="text-xl mt-2 mb-4 text-gray-700"><%=t "pay.successful.header" %></h1>
-        <p class="mb-6"><%=t "pay.successful.description" %></p>
+        <h1 class="text-xl mt-2 mb-4 text-gray-700"><%=t "successful.header", scope: scope %></h1>
+        <p class="mb-6"><%=t "successful.description", scope: scope %></p>
 
       <% elsif @payment.canceled? %>
-        <h1 class="text-xl mt-2 mb-4 text-gray-700"><%=t "pay.cancelled.header" %></h1>
-        <p class="mb-6"><%=t "pay.cancelled.description" %></p>
+        <h1 class="text-xl mt-2 mb-4 text-gray-700"><%=t "cancelled.header", scope: scope %></h1>
+        <p class="mb-6"><%=t "cancelled.description", scope: scope %></p>
 
       <% else %>
         <div data-payment-intent-target="form" id="payment-elements">
           <!-- Instructions -->
-          <h1 class="text-xl mt-2 mb-4 text-gray-700"><%=t "pay.requires_action.header", amount: @payment.amount_with_currency %></h1>
-          <p class="mb-6"><%=t "pay.requires_action.description" %></p>
+          <h1 class="text-xl mt-2 mb-4 text-gray-700"><%=t "requires_action.header", scope: scope, amount: @payment.amount_with_currency %></h1>
+          <p class="mb-6"><%=t "requires_action.description", scope: scope %></p>
 
           <div data-payment-intent-target="cardFields" class="hidden">
             <!-- Name -->
@@ -53,7 +55,7 @@
 
           <!-- Pay Button -->
           <button data-payment-intent-target="button" data-action="click->payment-intent#confirmPayment" class="inline-block w-full px-4 py-3 mb-4 text-white rounded-lg bg-blue-400 hover:bg-blue-500">
-            <%=t "pay.requires_action.button", amount: @payment.amount_with_currency %>
+            <%=t "requires_action.button", scope: scope, amount: @payment.amount_with_currency %>
           </button>
         </div>
       <% end %>
@@ -79,6 +81,7 @@
       clientSecret: String,
       customer: String,
       status: String,
+      setupIntent: Boolean,
       nameMissingMessage: String,
       confirmedMessage: String,
       errorMessage: String,
@@ -104,7 +107,7 @@
       switch(this.statusValue) {
         case "requires_action":
           this.processingValue = true
-          this.stripe.confirmPayment({clientSecret: this.clientSecretValue, confirmParams: { return_url: document.location.href }}).then(this.handleConfirmResult.bind(this))
+          this.confirm({clientSecret: this.clientSecretValue})
           break
         case "requires_payment_method":
           this.cardFieldsTarget.classList.toggle("hidden", false)
@@ -114,7 +117,14 @@
 
     confirmPayment() {
       this.processingValue = true
-      this.stripe.confirmPayment({elements: this.elements, confirmParams: { return_url: document.location.href }}).then(this.handleConfirmResult.bind(this))
+      this.confirm({elements: this.elements})
+    }
+
+    // SetupIntents (saving a payment method) and PaymentIntents confirm through different Stripe.js methods
+    confirm(options) {
+      const params = {...options, confirmParams: { return_url: document.location.href }}
+      const result = this.setupIntentValue ? this.stripe.confirmSetup(params) : this.stripe.confirmPayment(params)
+      result.then(this.handleConfirmResult.bind(this))
     }
 
     handleConfirmResult(result) {
@@ -126,7 +136,8 @@
           this.errorMessageValue = this.nameMissingMessageValue
         } else {
           this.errorMessageValue = result.error.message
-          this.statusValue = result.error.payment_intent.status
+          const intent = result.error.payment_intent || result.error.setup_intent
+          if (intent) { this.statusValue = intent.status }
         }
       } else {
         this.completeValue = true

data/config/locales/en.yml

@@ -14,6 +14,18 @@ en:
       button: "Pay %{amount}"
       name_missing: "Please provide your name."
       success: "The payment was successful."
+    setup_intent:
+      successful:
+        header: "Payment Method Saved"
+        description: "Your payment method was successfully confirmed."
+      cancelled:
+        header: "Setup Cancelled"
+        description: "This payment method setup was cancelled."
+      requires_action:
+        header: "Confirm your payment method"
+        description: "Extra confirmation is needed to save your payment method. Please confirm it by filling out your payment details below."
+        button: "Save payment method"
+        success: "Your payment method was saved."
     all_rights_reserved: "All rights reserved."
     back: "Go back"
     refund: "Refund"

data/lib/pay/payment.rb

@@ -19,6 +19,10 @@ module Pay
       @stripe_account = stripe_account
     end
 
+    def setup_intent?
+      intent.is_a?(::Stripe::SetupIntent)
+    end
+
     def requires_payment_method?
       status == "requires_payment_method"
     end
@@ -35,7 +39,9 @@ module Pay
       status == "succeeded"
     end
 
+    # SetupIntents save a payment method for later and have no amount
     def amount_with_currency
+      return if setup_intent?
       Pay::Currency.format(amount, currency: currency)
     end
 

data/lib/pay/version.rb

@@ -1,3 +1,3 @@
 module Pay
-  VERSION = "12.1.0"
+  VERSION = "12.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pay
 version: !ruby/object:Gem::Version
-  version: 12.1.0
+  version: 12.2.0
 platform: ruby
 authors:
 - Jason Charnes