rails-shopee-qris 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f301fa2107316c8aa94a3ab8946fc318bbbb73d0306c9d0b08290648437e2c1
-  data.tar.gz: d35eb2223fdad00dfc593ec82eb4c926652aa97a15ccea640177f1d9b6c31b3b
+  metadata.gz: c540bf182092132cfb2ffc55a0b47e1a5e83591e99ef57d1592717ac0b9aeeb7
+  data.tar.gz: bff1c88608517ed8258c727d3913693aea35b8b14006520545bf1552bacb02c8
 SHA512:
-  metadata.gz: e4a3757eb7bd2e386a1774bafdb50b8486a51dd3265c6513b75c2039bac9d3e4ec6a8c0760794de5cbdf6fdba45b0cefee97e16aeb988dcb1e2ae8b11180f443
-  data.tar.gz: 84a529743925b2494c02b9cd9c5a322f7efda75dc83c630e258a7833a6c59fb9a7dbfc1f04b31f45d743f1d265032da7f39c3c5d0d28fd960c903dcb636b11b3
+  metadata.gz: 11943a5f4d2f2398b6fa00a1973b479752cd1a3a49be0364529a1fedf7795fa392bcaa3b7f2f03a2d1fcf2e4bd89cd61ff46299d025c3d5bc747ef9e1c56f0f3
+  data.tar.gz: 65bbab7fc0cf7fd5ccf73800f3deb0fe4bf8766566e0e5e16920bcecb3caf339ad444316c1f7366a634a1496d526a508925985edf11ee6f0b756531a32750376

data/CHANGELOG.md

@@ -1,14 +1,27 @@
 # Changelog
 
+## 0.2.1
+
+- Do not infer merchant ID from JWT staff `userid`.
+- Reject malformed credentials, invalid payment envelopes, and invalid time ranges.
+- Do not suppress unknown password-auth failures or captcha requirements.
+- Preserve provider rejection codes without claiming an undocumented expiry reason.
+- Expose optional OTP `seed` as opaque response data, not delivery evidence.
+- Reject malformed transaction/store lists rather than returning misleading empty history.
+- Preserve selected merchant scope when constructing the OTP data client.
+- Reject fractional provider result codes and malformed OTP channel settings.
+- Correct prior verification claims: no successful OTP login or payment settlement observed.
+
 ## 0.2.0
 
-Verified against a live ShopeePay Partner merchant account (store listing, transaction
-feed, transaction detail, device-risk, OTP request).
+Observed store listing and an empty transaction feed with a merchant token. OTP
+requests returned success without recipient-confirmed delivery. Transaction detail,
+successful OTP login and payment settlement were not verified live.
 
 ### Added
 - `Client` accepts either the raw `B:...` merchant token or the whole
-  `__shopee_partner_website_x_token_live` JWT cookie, extracting the inner token,
-  `userid` and `exp`.
+  `__shopee_partner_website_x_token_live` JWT cookie, extracting the inner token
+  and advisory expiry.
 - `Client#refreshable?` tells callers whether a session can silently renew.
 - Provider error codes are translated into actionable text
   (`10002`, `200020`, `2010000`, `48401003`, `48401102`, `48401103`, `48500102`).
@@ -20,14 +33,14 @@ feed, transaction detail, device-risk, OTP request).
 - **Payment envelope shape.** Request fields were nested under `data.metadata`; Shopee
   expects them as siblings of `metadata`. Store listing and the transaction feed never
   worked before this.
-- **`10002` aborted every non-password account.** It means "no password set" — the OTP
-  flow now continues instead of raising.
+- **`10002` compatibility.** Empty-password responses were allowed to continue to the
+  OTP step. Its meaning was not independently established.
 - **Wrong refresh error.** A rejected manual token raised "session cannot be refreshed";
   it now reports the real rejection and its code. Proactive refresh only runs when the
   session actually has renewal credentials.
 - **Duplicate-key crash.** `Client` symbolized sessions via `JSON.generate`, which raised
   on hashes carrying both `"token"` and `:token`.
-- **`48401003`** is now reported as a wrong/expired OTP rather than a bare code.
+- **`48401003`** is reported as OTP rejection rather than a bare code; reason unspecified.
 - QRIS generation rejects fractional and oversized amounts instead of truncating them,
   and parsing rejects non-decimal lengths and duplicate tags.
 

data/README.md

@@ -2,16 +2,18 @@
 
 Unofficial Ruby/Rails ShopeePay Partner client, based on `QrisMerchantID` Shopee API logic and `rails-gopay-unofficial` gem structure. Ruby >= 3.1; no runtime dependencies beyond stdlib.
 
-Use only with merchant authorization. Internal Shopee APIs can change. Read paths (`get-store-list`, `get-transaction-list`, `get-transaction-detail`, device-risk, OTP request/verify) have been exercised against a live merchant account; actual money settlement has not. Never log tokens, passwords, device reports, session cookies, or raw payment data.
+Use only with merchant authorization. Internal Shopee APIs can change. Store listing and an empty transaction feed were observed with a merchant token. OTP endpoints accepted requests, but recipients reported no delivery; successful OTP login and money settlement remain unverified. Never log tokens, passwords, device reports, session cookies, or raw payment data.
 
 ## Installation
 
-Until published, use a local path:
+Install published version from RubyGems:
 
 ```ruby
-gem "rails-shopee-qris", path: "../rails-shopee-qris"
+gem "rails-shopee-qris", "~> 0.2.0"
 ```
 
+Version 0.2.1 contains the reviewed validation and merchant-scope fixes; it must be published before RubyGems consumers can install it. To exercise this checkout locally, use `gem "rails-shopee-qris", path: "../rails-shopee-qris"`.
+
 ```ruby
 require "rails/shopee/qris"
 
@@ -24,7 +26,7 @@ end
 
 ## Direct merchant token
 
-Pass either the inner `B:...` token, or the whole `__shopee_partner_website_x_token_live` cookie value — the client decodes that JWT and pulls out the inner `token` (plus `userid` and `exp`). It does not verify the JWT signature; Shopee validates credentials on each request.
+Pass either the inner `B:...` token or the whole `__shopee_partner_website_x_token_live` cookie value. Client extracts the inner token and advisory expiry. JWT `userid` is a staff account ID, **not** merchant ID; provide merchant scope explicitly when known. JWT decoding does not verify its signature; Shopee validates credentials on each request.
 
 Get a fresh token: log in at `partner.shopee.co.id` → DevTools → Network → open the ShopeePay transaction history page → click `get-transaction-list` → Request Payload → `data.metadata.token`.
 
@@ -64,6 +66,10 @@ Channels: `1` SMS, `2` voice, `3` WhatsApp, `4` email, `5` Zalo. Omit `channel:`
 
 Persist **entire** session encrypted, including `cookies`, `merchant`, `merchants`, and `switch_credential`. These are credentials, not safe client-side session data.
 
+OTP request success and optional `seed` do not prove SMS/WhatsApp delivery. `device_report` means the raw browser SDK report request body, not the `riskToken` returned by its response. No reliable report-format or delivery-status check is available here. Do not retry repeatedly or switch channels without merchant consent.
+
+Rails cookie sessions cannot hold full Shopee state (4 KB limit). Use server-side sessions; memory-backed development sessions disappear on restart. Never persist passwords for resend—prompt again when required.
+
 ```ruby
 serialized = JSON.generate(shopee_session)
 restored = JSON.parse(serialized, symbolize_names: true)
@@ -136,10 +142,10 @@ Invalid provider envelopes, HTTP failures, expired credentials, malformed inputs
 
 | Code | Meaning |
 | --- | --- |
-| `10002` | Account has no password set (not an error — the OTP flow continues) |
+| `10002` | Undocumented password-auth response; empty-password probe may continue to OTP, but it does not prove account existence or password state |
 | `200020` | Token invalid or expired — paste a fresh one |
 | `2010000` | Request carried no token |
-| `48401003` | OTP code wrong or expired |
+| `48401003` | Credential rejected; when returned by OTP verification, the OTP was rejected (reason unspecified) |
 | `48401102` | Password required before an OTP is sent |
 | `48401103` | OTP channel unavailable for this account |
 | `48500102` | Account session expired; log in again with an OTP |
@@ -156,7 +162,7 @@ gem build rails-shopee-qris.gemspec
 Package with `gem build rails-shopee-qris.gemspec`. Authenticate via `gem signin` (or configure a scoped `GEM_HOST_API_KEY` with push permission), then:
 
 ```sh
-gem push rails-shopee-qris-0.2.0.gem --host https://rubygems.org
+gem push rails-shopee-qris-0.2.1.gem --host https://rubygems.org
 ```
 
 RubyGems versions are immutable. Bump the gemspec version before subsequent releases. Built `.gem` files and credentials must not be committed.

data/lib/rails/shopee/qris/client.rb

@@ -30,9 +30,9 @@ module Rails
           parsed_token, token_meta = parse_token_input(raw_token)
           @token = parsed_token
           @store_id = (store_id || @session&.dig(:store_id) || config.store_id)&.to_s
-          @merchant_id = (merchant_id || @session&.dig(:merchant, :id) || @session&.dig(:merchant_id) || token_meta[:account_id] || config.merchant_id)&.to_s
+          @merchant_id = (merchant_id || (@session[:merchant][:id] if @session&.dig(:merchant).is_a?(Hash)) || @session&.dig(:merchant_id) || config.merchant_id)&.to_s
           @phone_number = phone_number || @session&.dig(:phone_number) || config.phone_number
-          @device_id = device_id || @session&.dig(:switch_credential, :spc_clientid)
+          @device_id = device_id || (@session[:switch_credential][:spc_clientid] if @session&.dig(:switch_credential).is_a?(Hash))
           expiry = expires_at || @session&.dig(:expires_at) || token_meta[:expires_at]
           @expires_at = extract_time(expiry)
           raise Error, "Invalid Shopee session expiry" if expiry && !@expires_at
@@ -48,7 +48,7 @@ module Rails
           raise Error, "Shopee static QRIS is not configured" if static_qris.to_s.empty?
 
           code = Qris.generate(static_qris, amount)
-          amount = Integer(amount)
+          amount = amount.is_a?(String) ? Integer(amount, 10) : Integer(amount)
           {
             qris_id: SecureRandom.hex(16),
             qris_code: code,
@@ -65,8 +65,7 @@ module Rails
 
         def refresh!
           unless refreshable?
-            raise Error, "Shopee merchant token is invalid or expired and this session has no renewal " \
-                         "credentials; log in again with OTP or paste a fresh B:... token"
+            raise Error, "Shopee session has no renewal credentials; log in again with OTP or paste a fresh B:... token"
           end
 
           updated = Setup.new.refresh_session(session)
@@ -77,12 +76,12 @@ module Rails
         end
 
         def transactions_between(start_time:, end_time:, store_id: @store_id, page_size: 10, max_pages: 20)
-          refresh! if refreshable? && expires_at && expires_at <= Time.now + 900
-
-          start_ts = start_time.respond_to?(:to_i) ? start_time.to_i : Integer(start_time)
-          end_ts = end_time.respond_to?(:to_i) ? end_time.to_i : Integer(end_time)
+          start_ts = transaction_timestamp(start_time)
+          end_ts = transaction_timestamp(end_time)
           raise Error, "Shopee transaction time range is invalid" if start_ts > end_ts
 
+          refresh! if refreshable? && expires_at && expires_at <= Time.now + 900
+
           size = [[1, page_size.to_i].max, 10].min
           pages_limit = [1, max_pages.to_i].max
           want_store = store_id&.to_s
@@ -107,7 +106,8 @@ module Rails
 
             resp = request_payment(TRANSACTIONS_URL, body)
             data = Response.data(resp)
-            list = data[:list].is_a?(Array) ? data[:list] : []
+            list = data[:list]
+            raise Error, "Shopee transaction list is missing or invalid" unless list.is_a?(Array)
 
             list.each do |raw|
               tx = normalize_transaction(raw, want_store)
@@ -216,7 +216,8 @@ module Rails
             body[:serviceList] = service_list if service_list
 
             data = Response.data(request_payment(STORES_URL, body))
-            list = data[:list].is_a?(Array) ? data[:list] : []
+            list = data[:list]
+            raise Error, "Shopee store list is missing or invalid" unless list.is_a?(Array)
 
             list.each do |raw|
               store = normalize_store(raw)
@@ -322,7 +323,7 @@ module Rails
           case obj
           when Hash
             obj.each_with_object({}) do |(k, v), acc|
-              acc[k.to_sym] = deep_symbolize(v)
+              acc[k.is_a?(String) ? k.to_sym : k] = deep_symbolize(v)
             end
           when Array
             obj.map { |item| deep_symbolize(item) }
@@ -331,28 +332,25 @@ module Rails
           end
         end
 
-        def parse_token_input(val)
-          return [nil, {}] if val.nil?
-
-          str = val.to_s.strip.gsub(/[\r\n\t ]/, "")
-          return [str, {}] if str.start_with?("B:")
-
-          if str.count(".") == 2
-            segments = str.split(".")
-            padded = segments[1] + ("=" * (-segments[1].bytesize % 4))
-            payload = JSON.parse(Base64.urlsafe_decode64(padded), symbolize_names: true)
-            if payload.is_a?(Hash) && payload[:token].to_s.start_with?("B:")
-              meta = {
-                account_id: payload[:userid]&.to_s,
-                expires_at: payload[:exp] ? Time.at(payload[:exp]) : nil
-              }
-              return [payload[:token].to_s, meta]
-            end
-          end
+        def transaction_timestamp(value)
+          return value.to_i if value.is_a?(Time) || (value.is_a?(Numeric) && value.finite?)
+          return Integer(value, 10) if value.is_a?(String) && value.match?(/\A[+-]?\d+\z/)
+
+          raise Error, "Shopee transaction time range is invalid"
+        rescue ArgumentError, TypeError, RangeError
+          raise Error, "Shopee transaction time range is invalid"
+        end
+
+        def parse_token_input(value)
+          return [nil, {}] if value.nil?
+          raise Error, "Shopee merchant token must be a string" unless value.is_a?(String)
+          return [value, {}] if value.start_with?("B:")
 
-          [str, {}]
-        rescue StandardError
-          [str, {}]
+          credential = Setup.new.read_merchant_credential([
+            { name: Setup::LIVE_TOKEN_COOKIE, value: value, domain: "partner.shopee.co.id", path: "/" }
+          ])
+          expiry = credential[:expires_at]
+          [credential[:token], { expires_at: expiry && Time.at(expiry / 1000.0) }]
         end
 
 
@@ -381,7 +379,7 @@ module Rails
             end
 
             raise Error.new(
-              "Shopee rejected the merchant token (code #{code}); it is invalid or expired. " \
+              "Shopee rejected the merchant token (code #{code}). " \
               "Log in again with OTP or paste a fresh B:... token.",
               nil, resp[:code], resp
             )
@@ -389,6 +387,7 @@ module Rails
 
           err = Response.error(resp)
           raise Error.new(err || "ShopeePay request failed", nil, resp[:code], resp) if err
+          Response.data(resp)
 
           resp
         end

data/lib/rails/shopee/qris/qris.rb

@@ -10,7 +10,7 @@ module Rails
           unless amount.is_a?(Integer) || (amount.is_a?(String) && amount.match?(/\A\d+\z/))
             raise Error, "Invalid payment amount"
           end
-          amount = Integer(amount)
+          amount = amount.is_a?(String) ? Integer(amount, 10) : amount
           raise Error, "Payment amount must be greater than zero" unless amount.positive?
           raise Error, "Payment amount exceeds QRIS field length" if amount.to_s.bytesize > 99
 

data/lib/rails/shopee/qris/response.rb

@@ -9,10 +9,8 @@ module Rails
         # Shopee answers many failures with a bare numeric code and no message.
         # Map the ones we have observed so callers get something actionable.
         CODE_HINTS = {
-          10002 => "The Shopee account has no password set",
           200020 => "Shopee rejected the token as invalid or expired",
           2010000 => "Shopee request carried no token",
-          48401003 => "Shopee rejected the OTP code as wrong or expired",
           48401102 => "Shopee requires the account password before sending an OTP",
           48401103 => "Shopee refused to send the OTP on the requested channel",
           48500102 => "The Shopee account session has expired; log in again with an OTP"
@@ -37,7 +35,11 @@ module Rails
           end
 
           code = payload[:code] || payload[:errorCode] || payload[:error]
-          code_i = Integer(code) rescue nil
+          code_i = if code.is_a?(Integer)
+                     code
+                   elsif code.is_a?(String) && code.match?(/\A-?\d+\z/)
+                     Integer(code, 10)
+                   end
           is_success_code = code_i == 0
 
           errors = payload[:errors] || inner[:errors]

data/lib/rails/shopee/qris/setup.rb

@@ -21,9 +21,9 @@ module Rails
         CHANNEL_NAMES = { 1 => "SMS", 2 => "voice", 3 => "WhatsApp", 4 => "email", 5 => "Zalo" }.freeze
         NEED_OTP_CODE = 48401102
         NOT_LOGIN_CODE = 48500102
-        NO_PASSWORD_CODE = 10002
+        EMPTY_PASSWORD_CONTINUATION_CODE = 10002
         OTP_CHANNEL_UNAVAILABLE_CODE = 48401103
-        WRONG_OTP_CODE = 48401003
+        OTP_REJECTED_CODE = 48401003
         PASSWORD_REQUIRED = "This Shopee account is password-protected; supply the password to receive an OTP"
 
         LIVE_TOKEN_COOKIE = "__shopee_partner_website_x_token_live"
@@ -39,6 +39,9 @@ module Rails
         def request_otp(phone_number = Rails::Shopee::Qris.configuration.phone_number, password: nil, channel: nil, device_report: Rails::Shopee::Qris.configuration.device_report)
           phone_info = parse_id_mobile(phone_number)
           raise Error, "Supply a captured Shopee device report to request an OTP" unless device_report.is_a?(String) && !device_report.strip.empty?
+          if !channel.nil? && (!channel.is_a?(Integer) || !SEND_OTP_CHANNELS.include?(channel))
+            raise Error, "Invalid Shopee OTP channel"
+          end
           phone = phone_info[:e164]
           @cookies.clear
 
@@ -61,15 +64,21 @@ module Rails
             fingerprint
           )
 
-          available = (settings[:available_channel_list] || []).select { |c| c.is_a?(Integer) }
+          available = settings[:available_channel_list].nil? ? [] : settings[:available_channel_list]
+          unless available.is_a?(Array) && available.all? { |c| c.is_a?(Integer) && SEND_OTP_CHANNELS.include?(c) }
+            raise Error, "Shopee returned invalid available OTP channels"
+          end
           default_ch = settings[:default_channel]
           resolved = channel || default_ch || DEFAULT_OTP_CHANNEL
+          unless resolved.is_a?(Integer) && SEND_OTP_CHANNELS.include?(resolved)
+            raise Error, "Shopee returned an invalid OTP channel"
+          end
           if !available.empty? && !available.include?(resolved)
             names = available.map { |c| "#{c} (#{CHANNEL_NAMES[c] || 'unknown'})" }.join(", ")
             raise Error, "Shopee OTP channel #{resolved} is unavailable for this account; available: #{names}"
           end
 
-          begin
+          sent = begin
             account_request(
               "/api/v4/account/business/send_otp",
               {
@@ -86,7 +95,7 @@ module Rails
           rescue Error => e
             raise Error.new(
               e.code == OTP_CHANNEL_UNAVAILABLE_CODE ?
-                "Shopee refused to send the OTP on channel #{resolved}; choose another available channel" :
+                "Shopee refused OTP at /api/v4/account/business/send_otp on channel #{resolved}; choose another available channel" :
                 e.message,
               e.status, e.code, e.payload
             )
@@ -101,6 +110,8 @@ module Rails
             risk_token: fingerprint,
             has_password: has_password,
             cookies: snapshot_cookies,
+            # Opaque provider field; neither its meaning nor OTP delivery is established.
+            seed: sent[:seed],
             requested_at: (Time.now.to_f * 1000).to_i
           }
         end
@@ -133,10 +144,10 @@ module Rails
               fingerprint
             )
           rescue Error => e
-            raise e unless e.code.to_s == WRONG_OTP_CODE.to_s
+            raise e unless e.code.to_s == OTP_REJECTED_CODE.to_s
 
             raise Error.new(
-              "Shopee rejected the OTP code (wrong or expired); request a new one and try again",
+              "Shopee rejected the OTP at /api/v4/account/business/verify_otp; cause is not established",
               e.status, e.code, e.payload
             )
           end
@@ -198,7 +209,7 @@ module Rails
           merchant, credential = complete_base(verification, merchant_id)
           profile = get_profile(credential[:token], merchant[:id])
 
-          data_client = client || Client.new(token: credential[:token])
+          data_client = client || Client.new(token: credential[:token], merchant_id: merchant[:id])
           stores = data_client.list_stores
           chosen_store = choose_store_id(stores, store_id, profile[:store_id])
 
@@ -220,7 +231,7 @@ module Rails
             },
             profile: profile,
             created_at: (Time.now.to_f * 1000).to_i,
-            expires_at: credential[:expires_at] ? Time.at(credential[:expires_at] / 1000) : nil
+            expires_at: credential[:expires_at] ? Time.at(credential[:expires_at] / 1000.0) : nil
           }
         end
 
@@ -246,9 +257,9 @@ module Rails
           validate_strings(switch_cred, :toc_nonce, :spc_clientid, :device_fingerprint)
 
           restore_cookies(session[:cookies] || [])
-          alive, payload = login_status
+          alive, payload, status = login_status
           unless alive
-            raise Error.new("The Shopee account session has expired; log in again with an OTP", nil, NOT_LOGIN_CODE, payload)
+            raise Error.new("The Shopee account session has expired; log in again with an OTP", status, NOT_LOGIN_CODE, payload)
           end
 
           verification = {
@@ -268,7 +279,7 @@ module Rails
           session.merge(
             cookies: snapshot_cookies,
             token: credential[:token],
-            expires_at: credential[:expires_at] ? Time.at(credential[:expires_at] / 1000) : session[:expires_at]
+            expires_at: credential[:expires_at] ? Time.at(credential[:expires_at] / 1000.0) : session[:expires_at]
           )
         end
 
@@ -303,8 +314,8 @@ module Rails
           jwt = cookie ? cookie[:value] : nil
           raise Error, "Shopee login did not return a merchant session token" unless jwt.is_a?(String) && !jwt.empty?
 
-          segments = jwt.split(".")
-          raise Error, "Invalid JWT format" unless segments.length == 3 && !segments[1].empty?
+          segments = jwt.split(".", -1)
+          raise Error, "Invalid JWT format" unless segments.length == 3 && segments.all? { |segment| segment.match?(/\A[A-Za-z0-9_-]+\z/) }
 
           padded = segments[1] + ("=" * (-segments[1].bytesize % 4))
           payload = JSON.parse(Base64.urlsafe_decode64(padded), symbolize_names: true)
@@ -327,8 +338,12 @@ module Rails
 
         def symbolize_state(value)
           case value
-          when Hash then value.to_h { |key, item| [key.to_sym, symbolize_state(item)] }
+          when Hash
+            raise Error, "Invalid Shopee state keys" unless value.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) }
+
+            value.to_h { |key, item| [key.to_sym, symbolize_state(item)] }
           when Array then value.map { |item| symbolize_state(item) }
+          when String then value.dup
           else value
           end
         end
@@ -382,6 +397,10 @@ module Rails
           body = { phone: phone, password: hash_shopee_password(password) }
           account_request("/api/v4/account/business/check_account_exist_by_password", body, fingerprint)
         rescue Error => e
+          if e.payload.is_a?(Hash)
+            data = e.payload[:data]
+            raise if e.payload[:captcha_required] == true || data.is_a?(Hash) && data[:captcha_required] == true
+          end
           raise unless e.status && (200..299).cover?(e.status) && e.code.is_a?(Integer) && e.code != 0
 
           nil
@@ -398,31 +417,35 @@ module Rails
           parsed = parse_json(resp)
 
           if parsed[:error] == NEED_OTP_CODE
-            raise Error, PASSWORD_REQUIRED if password.to_s.empty?
+            if password.to_s.empty?
+              raise Error.new("#{PASSWORD_REQUIRED} (at /api/v4/account/business/authenticate_toc_by_password)", resp.code.to_i, parsed[:error], parsed)
+            end
 
             return true
           end
 
-          return false if parsed[:error] == 0
-          # 10002: the account exists but has no password set — nothing to verify.
-          return false if parsed[:error] == NO_PASSWORD_CODE
+          return false if parsed[:error] == 0 && parsed[:data].is_a?(Hash)
+          # Only this empty-password response was observed to permit OTP requests.
+          # Its provider meaning remains unknown; never bypass a supplied password.
+          return nil if password.to_s.empty? && parsed[:error] == EMPTY_PASSWORD_CONTINUATION_CODE
 
-          account = parsed[:data].is_a?(Hash) ? parsed[:data][:toc_account] : nil
-          if account.is_a?(Hash) && account[:has_password] == true
-            raise Error, PASSWORD_REQUIRED
-          end
-
-          # Any other code means this account does not authenticate by password;
-          # OTP delivery is validated by send_otp afterwards.
-          false
+          raise Error.new(
+            "Shopee rejected password authentication at /api/v4/account/business/authenticate_toc_by_password (error #{parsed[:error]})",
+            resp.code.to_i, parsed[:error], parsed
+          )
         end
 
         def login_status
           headers = account_headers.merge("Content-Type" => "application/json")
           resp = send_request(:post, "#{ACCOUNT_BASE_URL}/api/v4/account/business/login_status", headers: headers, body: "{}")
           parsed = parse_json(resp)
-          raise Error, "Shopee returned a malformed login status" unless parsed[:error].is_a?(Integer)
-          [parsed[:error] == 0, parsed]
+          unless parsed[:error].is_a?(Integer)
+            raise Error.new("Shopee returned a malformed login status at /api/v4/account/business/login_status", resp.code.to_i, parsed[:error], parsed)
+          end
+          unless [0, NOT_LOGIN_CODE].include?(parsed[:error])
+            raise Error.new("Shopee login status failed at /api/v4/account/business/login_status", resp.code.to_i, parsed[:error], parsed)
+          end
+          [parsed[:error] == 0, parsed, resp.code.to_i]
         end
 
         def complete_base(verification, merchant_id)
@@ -546,7 +569,7 @@ module Rails
 
           if parsed[:error] != 0 || !parsed[:data].is_a?(Hash)
             err = Response.error(parsed)
-            raise Error.new(err || "Shopee account request failed at #{path}", resp.code.to_i, parsed[:error], parsed)
+            raise Error.new("Shopee account request failed at #{path}: #{err || 'invalid response'}", resp.code.to_i, parsed[:error], parsed)
           end
 
           parsed[:data].is_a?(Hash) ? parsed[:data] : {}
@@ -639,6 +662,9 @@ module Rails
           end
           parsed = JSON.parse(response.body.to_s, symbolize_names: true)
           raise Error.new("Shopee returned a malformed JSON envelope", response.code.to_i) unless parsed.is_a?(Hash)
+          if parsed[:captcha_required] == true || parsed[:data].is_a?(Hash) && parsed[:data][:captcha_required] == true
+            raise Error.new(Response.error(parsed), response.code.to_i, parsed[:error] || parsed[:errorCode] || parsed[:code], parsed)
+          end
 
           parsed
         rescue JSON::ParserError
@@ -726,7 +752,7 @@ module Rails
 
         def snapshot_cookies
           @cookies.delete_if { |_, cookie| cookie[:expires] && cookie[:expires] <= Time.now.to_f }
-          @cookies.values.map(&:dup)
+          symbolize_state(@cookies.values)
         end
 
         def restore_cookies(cookie_list)
@@ -744,7 +770,7 @@ module Rails
             next if name.match?(/[\s,;]/) || cookie[:value].to_s.match?(/[\r\n;]/)
             next if cookie[:expires] && (!cookie[:expires].is_a?(Numeric) || !cookie[:expires].finite?)
 
-            @cookies[[name, domain, path]] = cookie.merge(name: name, value: cookie[:value].to_s, domain: domain, path: path)
+            @cookies[[name, domain, path]] = symbolize_state(cookie.merge(name: name, value: cookie[:value].to_s, domain: domain, path: path))
           end
         end
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-shopee-qris
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Azmi