payu-ruby 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7174c74c8e761c3551f5cc8630ac654b924487f3b864946cc2ba6eb0e217d348
-  data.tar.gz: 6e03c092a17af45084ba92dc68c8704df3754560906615a7704c87406cb64cbb
+  metadata.gz: 04a6b46c02485afa21bf0a5cb2a9f332b5dc46b726dca077b3be8940b5d5acec
+  data.tar.gz: 44048d1e821d50f7878e5398376204f11824ea9a0407d4691d3145f69c2ebcef
 SHA512:
-  metadata.gz: 6d8c2bce20f3b640a9f5d37920eb99f6a0d805e75d5cd9b260d3fd01ebe6e26a833a86ffb650f87cd5206f598728764e621b6326b4ea77cd6767c36baa21e46c
-  data.tar.gz: 58e87cb538219d113cc1e44c32156f89245d8bacb603c6a04fa6cb4539c0d7ba8efb9a7c86898fdafb187889b34667ceab3f79a2a852bcf3b066d44155aef92f
+  metadata.gz: a0aea058df01c76b2fac0afa23c3a9535ff3d4af73d8ff1f21f951ef3a7b936e9b576efa20dfb6868e3e704abdf5507f01d19281867d95d44e2958971408119c
+  data.tar.gz: 1c565df8f4ada5d8997f6cde3bc5c738bcede79939cb2c66c7ab203a0a6e6f4efb6cb2e77a6440578cf19de8d9d63955bf6b93d3fb24b7710783e55b14123510

data/README.md

@@ -57,9 +57,33 @@ refund.status(result.mihpayid)
 reported status is informational only; always follow up with
 `verify_payment` before treating a transaction as successful.
 
-For Rails, expose `GET /checkout/:id/pay` that renders an auto-submit form
-page. For mobile, return `{ payment_url:, params: }` as JSON and have the
-app open `payment_url` in a WebView, POSTing the params.
+## Auto-submit checkout page (web + mobile)
+
+`form.to_html` renders a complete, self-contained HTML page that
+auto-submits to PayU on load — a hidden form with one input per field,
+`onload="document.forms[0].submit()"`, and a `<noscript>` fallback button.
+Values are HTML-escaped.
+
+Expose one route that renders it:
+
+```ruby
+# GET /checkout/:id/pay
+def pay
+  form = client.build_payment(...)
+  render html: form.to_html.html_safe, content_type: "text/html"
+end
+```
+
+That single public URL (e.g. `https://app.example.com/checkout/123/pay`) is
+all any client needs — no client-side form building required either way:
+
+- **Web** — redirect the browser to it, or link to it.
+- **Mobile** — point a WebView at the same URL; the page auto-submits to
+  PayU itself, so the app never needs to construct the POST or handle
+  `fields` directly.
+
+`form.to_h` (`{ payment_url:, fields: }`) is also available if you'd rather
+hand the raw data to your own frontend code instead of using `to_html`.
 
 ## Error handling
 

data/lib/payu/callback_result.rb

@@ -5,11 +5,12 @@ module Payu
   # This is informational only: PayU's reported status here must not be
   # trusted for final state. Always follow up with Client#verify_payment.
   class CallbackResult
-    attr_reader :params, :valid
+    attr_reader :params, :valid, :matched_hash_form
 
-    def initialize(params:, valid:)
+    def initialize(params:, valid:, matched_hash_form: nil)
       @params = params
       @valid = valid
+      @matched_hash_form = matched_hash_form
     end
 
     def valid? = @valid
@@ -27,5 +28,9 @@ module Payu
     def udf3 = @params[:udf3]
     def udf4 = @params[:udf4]
     def udf5 = @params[:udf5]
+
+    def additional_charges
+      Payu::Hash.extract_additional_charges(@params)
+    end
   end
 end

data/lib/payu/client.rb

@@ -54,8 +54,10 @@ module Payu
     # PayU's reported status here is informational only — never trust it
     # for final state; always follow up with #verify_payment.
     def verify_callback(params)
-      valid = Payu::Hash.valid_response?(params: params, salt: @config.salt)
-      CallbackResult.new(params: params, valid: valid)
+      result = Payu::Hash.valid_response?(params: params, salt: @config.salt)
+      valid = result != false
+      matched_form = valid ? result : nil
+      CallbackResult.new(params: params, valid: valid, matched_hash_form: matched_form)
     end
 
     # Server-to-server reconciliation — the source of truth for transaction

data/lib/payu/hash.rb

@@ -16,33 +16,72 @@ module Payu
       Digest::SHA512.hexdigest(parts.join("|"))
     end
 
-    # Response hash — field order is REVERSED vs request (confirmed from docs.payu.in):
+    # Extract additionalCharges regardless of key style (camelCase or snake_case,
+    # string or symbol). PayU sends camelCase in callbacks.
+    def self.extract_additional_charges(params)
+      val = params[:additionalCharges] || params["additionalCharges"] ||
+            params[:additional_charges] || params["additional_charges"]
+      v = val.to_s
+      v.empty? ? nil : v
+    end
+
+    # Response hash candidates — returns a hash of candidate name => SHA512 digest.
+    #
+    # When additionalCharges is present, PayU may sign with either the plain or
+    # prefixed form. Both candidates are returned so the caller can try each.
+    #
+    # Reverse hash formula (plain):
     #   sha512(SALT|status||||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|key)
     #
-    # Variant: when PayU adds additional_charges (platform/convenience fee), it is prepended:
-    #   sha512(additional_charges|SALT|status|...|key)
-    def self.response(params:, salt:)
+    # Reverse hash formula (with additional charges):
+    #   sha512(additionalCharges|SALT|status||||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|key)
+    def self.response_candidates(params:, salt:)
       p = params
-      core = [
+      base_str = [
         salt,
-        p[:status].to_s,
-        "", "", "", "", "",  # reserved slots (reversed)
-        p[:udf5].to_s, p[:udf4].to_s, p[:udf3].to_s, p[:udf2].to_s, p[:udf1].to_s,
-        p[:email].to_s, p[:firstname].to_s, p[:productinfo].to_s,
-        p[:amount].to_s, p[:txnid].to_s, p[:key].to_s
-      ]
-      additional = p[:additional_charges].to_s
-      parts = additional.empty? ? core : [additional] + core
-      Digest::SHA512.hexdigest(parts.join("|"))
+        (p[:status] || p["status"]).to_s,
+        "", "", "", "", "",
+        (p[:udf5] || p["udf5"]).to_s,
+        (p[:udf4] || p["udf4"]).to_s,
+        (p[:udf3] || p["udf3"]).to_s,
+        (p[:udf2] || p["udf2"]).to_s,
+        (p[:udf1] || p["udf1"]).to_s,
+        (p[:email] || p["email"]).to_s,
+        (p[:firstname] || p["firstname"]).to_s,
+        (p[:productinfo] || p["productinfo"]).to_s,
+        (p[:amount] || p["amount"]).to_s,
+        (p[:txnid] || p["txnid"]).to_s,
+        (p[:key] || p["key"]).to_s
+      ].join("|")
+
+      charges = extract_additional_charges(params)
+      candidates = { "plain" => Digest::SHA512.hexdigest(base_str) }
+      candidates["additional_charges"] = Digest::SHA512.hexdigest("#{charges}|#{base_str}") if charges
+      candidates
+    end
+
+    # Response hash — returns the expected reverse hash for verification.
+    # When additionalCharges is present, returns the prefixed hash; otherwise plain.
+    def self.response(params:, salt:)
+      charges = extract_additional_charges(params)
+      candidates = response_candidates(params: params, salt: salt)
+      charges ? candidates["additional_charges"] : candidates["plain"]
     end
 
-    # Constant-time comparison to prevent timing attacks
+    # Constant-time comparison to prevent timing attacks.
+    # Returns the matched form name ("plain" or "additional_charges") on success,
+    # or false on failure. Truthy/falsy contract is preserved for backward compat.
     def self.valid_response?(params:, salt:)
-      expected = response(params: params, salt: salt)
-      received = params[:hash].to_s
-      return false if expected.bytesize != received.bytesize
+      received = (params[:hash] || params["hash"]).to_s
+      return false if received.empty?
+
+      candidates = response_candidates(params: params, salt: salt)
+      matched = candidates.find do |_name, expected|
+        next false if expected.bytesize != received.bytesize
+        expected.bytes.zip(received.bytes).reduce(0) { |acc, (a, b)| acc | (a ^ b) }.zero?
+      end
 
-      expected.bytes.zip(received.bytes).reduce(0) { |acc, (a, b)| acc | (a ^ b) }.zero?
+      matched ? matched.first : false
     end
 
     # Hash for server-to-server API commands: sha512(key|command|var1|salt)

data/lib/payu/payment_form.rb

@@ -1,3 +1,5 @@
+require "cgi"
+
 module Payu
   # Return value of Client#build_payment. No network call is made to
   # produce this — it's just the signed field set and the URL to post it to.
@@ -8,5 +10,40 @@ module Payu
       @payment_url = payment_url
       @fields = fields
     end
+
+    # Shape expected by the bundled payu-checkout.js: new PayuCheckout(data).open()
+    def to_h = { payment_url: @payment_url, fields: @fields }
+
+    # A complete, self-contained HTML page that auto-submits to PayU on
+    # load. Render this from a single GET route (e.g. GET /checkout/:id/pay)
+    # and that URL is all a client needs: redirect a browser to it, or point
+    # a mobile WebView at it — no client-side form building required either
+    # way. Values are HTML-escaped; a <noscript> button covers JS-disabled
+    # browsers.
+    def to_html
+      inputs = @fields.map { |name, value| hidden_input(name, value) }.join("\n      ")
+
+      <<~HTML
+        <!DOCTYPE html>
+        <html>
+          <head>
+            <meta charset="utf-8">
+            <title>Redirecting to PayU&hellip;</title>
+          </head>
+          <body onload="document.forms[0].submit()">
+            <form method="POST" action="#{CGI.escapeHTML(@payment_url)}">
+              #{inputs}
+              <noscript><button type="submit">Continue to payment</button></noscript>
+            </form>
+          </body>
+        </html>
+      HTML
+    end
+
+    private
+
+    def hidden_input(name, value)
+      %(<input type="hidden" name="#{CGI.escapeHTML(name.to_s)}" value="#{CGI.escapeHTML(value.to_s)}">)
+    end
   end
 end

data/lib/payu/version.rb

@@ -1,3 +1,3 @@
 module Payu
-  VERSION = "0.1.0"
+  VERSION = "0.3.0"
 end

data/lib/payu.rb

@@ -32,6 +32,7 @@ require "payu/refund"
 #   )
 #   form.payment_url  # => URL to POST form.fields to (form submit or WebView)
 #   form.fields        # => Hash of all form fields including :hash
+#   form.to_html        # => self-contained auto-submitting checkout page
 #
 #   # 2. Verify an inbound callback/redirect's hash (never trust it for final state)
 #   callback = client.verify_callback(params)
@@ -43,8 +44,8 @@ require "payu/refund"
 #   result.mihpayid
 #   result.raw        # full parsed JSON, for audit logging
 #
-# For Rails, expose GET /checkout/:id/pay that renders an auto-submit form page.
-# For mobile, return { payment_url:, params: } as JSON; the app opens payment_url
-# in a WebView posting the params.
+# form.to_html renders a complete auto-submitting checkout page — expose it
+# from one GET route and that URL is all any client needs: redirect a
+# browser to it, or point a mobile WebView at it. See README for details.
 module Payu
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: payu-ruby
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Vishwajeetsingh Desurkar
@@ -77,7 +77,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Ruby client for PayU India payment gateway
 test_files: []