payu-ruby 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 94b40d4686b64845659c12c92c956abb4d5d68e864ffe77875c2cc695e9a87d6
-  data.tar.gz: 96af6c931aa710aac02c0bd4b0a16e60638db52bd1e58e535c77ed039df2e675
+  metadata.gz: 04a6b46c02485afa21bf0a5cb2a9f332b5dc46b726dca077b3be8940b5d5acec
+  data.tar.gz: 44048d1e821d50f7878e5398376204f11824ea9a0407d4691d3145f69c2ebcef
 SHA512:
-  metadata.gz: d4f0fbbb6051bde54a99567d09e47c5749392854e6d9f8c1ae4645b85a8de14bc47a332a04eda68b06c4346413ba96ceab8da90bf4176f981191919f2cfcc2b8
-  data.tar.gz: 5f237b35f525398bc77a74200e45172ae549cfed9cf589fedbc7fbc43adc42f3ff6ac31754e5a452a4608225f5690dcac2e277a81a4d22b572881ab39e1b660b
+  metadata.gz: a0aea058df01c76b2fac0afa23c3a9535ff3d4af73d8ff1f21f951ef3a7b936e9b576efa20dfb6868e3e704abdf5507f01d19281867d95d44e2958971408119c
+  data.tar.gz: 1c565df8f4ada5d8997f6cde3bc5c738bcede79939cb2c66c7ab203a0a6e6f4efb6cb2e77a6440578cf19de8d9d63955bf6b93d3fb24b7710783e55b14123510

data/lib/payu/callback_result.rb

@@ -5,11 +5,12 @@ module Payu
   # This is informational only: PayU's reported status here must not be
   # trusted for final state. Always follow up with Client#verify_payment.
   class CallbackResult
-    attr_reader :params, :valid
+    attr_reader :params, :valid, :matched_hash_form
 
-    def initialize(params:, valid:)
+    def initialize(params:, valid:, matched_hash_form: nil)
       @params = params
       @valid = valid
+      @matched_hash_form = matched_hash_form
     end
 
     def valid? = @valid
@@ -27,5 +28,9 @@ module Payu
     def udf3 = @params[:udf3]
     def udf4 = @params[:udf4]
     def udf5 = @params[:udf5]
+
+    def additional_charges
+      Payu::Hash.extract_additional_charges(@params)
+    end
   end
 end

data/lib/payu/client.rb

@@ -54,8 +54,10 @@ module Payu
     # PayU's reported status here is informational only — never trust it
     # for final state; always follow up with #verify_payment.
     def verify_callback(params)
-      valid = Payu::Hash.valid_response?(params: params, salt: @config.salt)
-      CallbackResult.new(params: params, valid: valid)
+      result = Payu::Hash.valid_response?(params: params, salt: @config.salt)
+      valid = result != false
+      matched_form = valid ? result : nil
+      CallbackResult.new(params: params, valid: valid, matched_hash_form: matched_form)
     end
 
     # Server-to-server reconciliation — the source of truth for transaction

data/lib/payu/hash.rb

@@ -16,33 +16,72 @@ module Payu
       Digest::SHA512.hexdigest(parts.join("|"))
     end
 
-    # Response hash — field order is REVERSED vs request (confirmed from docs.payu.in):
+    # Extract additionalCharges regardless of key style (camelCase or snake_case,
+    # string or symbol). PayU sends camelCase in callbacks.
+    def self.extract_additional_charges(params)
+      val = params[:additionalCharges] || params["additionalCharges"] ||
+            params[:additional_charges] || params["additional_charges"]
+      v = val.to_s
+      v.empty? ? nil : v
+    end
+
+    # Response hash candidates — returns a hash of candidate name => SHA512 digest.
+    #
+    # When additionalCharges is present, PayU may sign with either the plain or
+    # prefixed form. Both candidates are returned so the caller can try each.
+    #
+    # Reverse hash formula (plain):
     #   sha512(SALT|status||||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|key)
     #
-    # Variant: when PayU adds additional_charges (platform/convenience fee), it is prepended:
-    #   sha512(additional_charges|SALT|status|...|key)
-    def self.response(params:, salt:)
+    # Reverse hash formula (with additional charges):
+    #   sha512(additionalCharges|SALT|status||||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|key)
+    def self.response_candidates(params:, salt:)
       p = params
-      core = [
+      base_str = [
         salt,
-        p[:status].to_s,
-        "", "", "", "", "",  # reserved slots (reversed)
-        p[:udf5].to_s, p[:udf4].to_s, p[:udf3].to_s, p[:udf2].to_s, p[:udf1].to_s,
-        p[:email].to_s, p[:firstname].to_s, p[:productinfo].to_s,
-        p[:amount].to_s, p[:txnid].to_s, p[:key].to_s
-      ]
-      additional = p[:additional_charges].to_s
-      parts = additional.empty? ? core : [additional] + core
-      Digest::SHA512.hexdigest(parts.join("|"))
+        (p[:status] || p["status"]).to_s,
+        "", "", "", "", "",
+        (p[:udf5] || p["udf5"]).to_s,
+        (p[:udf4] || p["udf4"]).to_s,
+        (p[:udf3] || p["udf3"]).to_s,
+        (p[:udf2] || p["udf2"]).to_s,
+        (p[:udf1] || p["udf1"]).to_s,
+        (p[:email] || p["email"]).to_s,
+        (p[:firstname] || p["firstname"]).to_s,
+        (p[:productinfo] || p["productinfo"]).to_s,
+        (p[:amount] || p["amount"]).to_s,
+        (p[:txnid] || p["txnid"]).to_s,
+        (p[:key] || p["key"]).to_s
+      ].join("|")
+
+      charges = extract_additional_charges(params)
+      candidates = { "plain" => Digest::SHA512.hexdigest(base_str) }
+      candidates["additional_charges"] = Digest::SHA512.hexdigest("#{charges}|#{base_str}") if charges
+      candidates
+    end
+
+    # Response hash — returns the expected reverse hash for verification.
+    # When additionalCharges is present, returns the prefixed hash; otherwise plain.
+    def self.response(params:, salt:)
+      charges = extract_additional_charges(params)
+      candidates = response_candidates(params: params, salt: salt)
+      charges ? candidates["additional_charges"] : candidates["plain"]
     end
 
-    # Constant-time comparison to prevent timing attacks
+    # Constant-time comparison to prevent timing attacks.
+    # Returns the matched form name ("plain" or "additional_charges") on success,
+    # or false on failure. Truthy/falsy contract is preserved for backward compat.
     def self.valid_response?(params:, salt:)
-      expected = response(params: params, salt: salt)
-      received = params[:hash].to_s
-      return false if expected.bytesize != received.bytesize
+      received = (params[:hash] || params["hash"]).to_s
+      return false if received.empty?
+
+      candidates = response_candidates(params: params, salt: salt)
+      matched = candidates.find do |_name, expected|
+        next false if expected.bytesize != received.bytesize
+        expected.bytes.zip(received.bytes).reduce(0) { |acc, (a, b)| acc | (a ^ b) }.zero?
+      end
 
-      expected.bytes.zip(received.bytes).reduce(0) { |acc, (a, b)| acc | (a ^ b) }.zero?
+      matched ? matched.first : false
     end
 
     # Hash for server-to-server API commands: sha512(key|command|var1|salt)

data/lib/payu/version.rb

@@ -1,3 +1,3 @@
 module Payu
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: payu-ruby
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Vishwajeetsingh Desurkar
@@ -77,7 +77,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Ruby client for PayU India payment gateway
 test_files: []