solidus_core_devise_token_auth 2.8.0.alpha.0

data/app/models/spree/payment/processing.rb

@@ -0,0 +1,225 @@
+# frozen_string_literal: true
+
+module Spree
+  class Payment < Spree::Base
+    module Processing
+      # "process!" means:
+      #   - Do nothing when:
+      #     - There is no payment method
+      #     - The payment method does not require a source
+      #     - The payment is in the "processing" state
+      #     - 'auto_capture?' is false and the payment is already authorized.
+      #   - Raise an exception when:
+      #     - The source is missing or invalid
+      #     - The payment is in a state that cannot transition to 'processing'
+      #       (failed/void/invalid states). Note: 'completed' can transition to
+      #       'processing' and thus calling #process! on a completed Payment
+      #       will attempt to re-authorize/re-purchase the payment.
+      #   - Otherwise:
+      #     - If 'auto_capture?' is true:
+      #       - Call #purchase on the payment gateway. (i.e. authorize+capture)
+      #         even if the payment is already completed.
+      #     - Else:
+      #       - Call #authorize on the payment gateway even if the payment is
+      #         already completed.
+      def process!
+        return if payment_method.nil?
+
+        if payment_method.auto_capture?
+          purchase!
+        elsif pending?
+          # do nothing. already authorized.
+        else
+          authorize!
+        end
+      end
+
+      def authorize!
+        handle_payment_preconditions { process_authorization }
+      end
+
+      # Captures the entire amount of a payment.
+      def purchase!
+        handle_payment_preconditions { process_purchase }
+      end
+
+      # Takes the amount in cents to capture.
+      # Can be used to capture partial amounts of a payment, and will create
+      # a new pending payment record for the remaining amount to capture later.
+      def capture!(amount = nil)
+        return true if completed?
+        amount ||= money.money.cents
+        started_processing!
+        protect_from_connection_error do
+          # Standard ActiveMerchant capture usage
+          response = payment_method.capture(
+            amount,
+            response_code,
+            gateway_options
+          )
+          money = ::Money.new(amount, currency)
+          capture_events.create!(amount: money.to_d)
+          update_attributes!(amount: captured_amount)
+          handle_response(response, :complete, :failure)
+        end
+      end
+
+      def void_transaction!
+        return true if void?
+        protect_from_connection_error do
+          if payment_method.payment_profiles_supported?
+            # Gateways supporting payment profiles will need access to credit card object because this stores the payment profile information
+            # so supply the authorization itself as well as the credit card, rather than just the authorization code
+            response = payment_method.void(response_code, source, gateway_options)
+          else
+            # Standard ActiveMerchant void usage
+            response = payment_method.void(response_code, gateway_options)
+          end
+
+          handle_void_response(response)
+        end
+      end
+
+      def cancel!
+        Spree::Config.payment_canceller.cancel(self)
+      end
+
+      def gateway_options
+        order.reload
+        options = {
+          email: order.email,
+          customer: order.email,
+          customer_id: order.user_id,
+          ip: order.last_ip_address,
+          # Need to pass in a unique identifier here to make some
+          # payment gateways happy.
+          #
+          # For more information, please see Spree::Payment#set_unique_identifier
+          order_id: gateway_order_id,
+          # The originator is passed to options used by the payment method.
+          # One example of a place that it is used is in:
+          # app/models/spree/payment_method/store_credit.rb
+          originator: self
+        }
+
+        options[:shipping] = order.ship_total * 100
+        options[:tax] = order.additional_tax_total * 100
+        options[:subtotal] = order.item_total * 100
+        options[:discount] = order.promo_total * 100
+        options[:currency] = currency
+
+        bill_address = source.try(:address)
+        bill_address ||= order.bill_address
+
+        options[:billing_address] = bill_address.try!(:active_merchant_hash)
+        options[:shipping_address] = order.ship_address.try!(:active_merchant_hash)
+
+        options
+      end
+
+      private
+
+      def process_authorization
+        started_processing!
+        gateway_action(source, :authorize, :pend)
+      end
+
+      def process_purchase
+        started_processing!
+        gateway_action(source, :purchase, :complete)
+        # This won't be called if gateway_action raises a GatewayError
+        capture_events.create!(amount: amount)
+      end
+
+      def handle_payment_preconditions(&_block)
+        unless block_given?
+          raise ArgumentError.new("handle_payment_preconditions must be called with a block")
+        end
+
+        return if payment_method.nil?
+        return if !payment_method.source_required?
+
+        if source
+          if !processing?
+            if payment_method.supports?(source)
+              yield
+            else
+              invalidate!
+              raise Core::GatewayError.new(I18n.t('spree.payment_method_not_supported'))
+            end
+          end
+        else
+          raise Core::GatewayError.new(I18n.t('spree.payment_processing_failed'))
+        end
+      end
+
+      def gateway_action(source, action, success_state)
+        protect_from_connection_error do
+          response = payment_method.send(action, money.money.cents,
+                                         source,
+                                         gateway_options)
+          handle_response(response, success_state, :failure)
+        end
+      end
+
+      def handle_response(response, success_state, failure_state)
+        record_response(response)
+
+        if response.success?
+          unless response.authorization.nil?
+            self.response_code = response.authorization
+            self.avs_response = response.avs_result['code']
+
+            if response.cvv_result
+              self.cvv_response_code = response.cvv_result['code']
+              self.cvv_response_message = response.cvv_result['message']
+            end
+          end
+          send("#{success_state}!")
+        else
+          send(failure_state)
+          gateway_error(response)
+        end
+      end
+
+      def handle_void_response(response)
+        record_response(response)
+
+        if response.success?
+          self.response_code = response.authorization
+          void
+        else
+          gateway_error(response)
+        end
+      end
+
+      def record_response(response)
+        log_entries.create!(details: response.to_yaml)
+      end
+
+      def protect_from_connection_error
+          yield
+      rescue ActiveMerchant::ConnectionError => e
+          gateway_error(e)
+      end
+
+      def gateway_error(error)
+        if error.is_a? ActiveMerchant::Billing::Response
+          text = error.params['message'] || error.params['response_reason_text'] || error.message
+        elsif error.is_a? ActiveMerchant::ConnectionError
+          text = I18n.t('spree.unable_to_connect_to_gateway')
+        else
+          text = error.to_s
+        end
+        logger.error(I18n.t('spree.gateway_error'))
+        logger.error("  #{error.to_yaml}")
+        raise Core::GatewayError.new(text)
+      end
+
+      # The unique identifier to be passed in to the payment gateway
+      def gateway_order_id
+        "#{order.number}-#{number}"
+      end
+    end
+  end
+end

data/app/models/spree/payment.rb

@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+module Spree
+  # Manage and process a payment for an order, from a specific
+  # source (e.g. `Spree::CreditCard`) using a specific payment method (e.g
+  # `Solidus::Gateway::Braintree`).
+  #
+  class Payment < Spree::Base
+    include Spree::Payment::Processing
+
+    alias_attribute :identifier, :number
+    deprecate :identifier, :identifier=, deprecator: Spree::Deprecation
+
+    IDENTIFIER_CHARS    = (('A'..'Z').to_a + ('0'..'9').to_a - %w(0 1 I O)).freeze
+    NON_RISKY_AVS_CODES = ['B', 'D', 'H', 'J', 'M', 'Q', 'T', 'V', 'X', 'Y'].freeze
+    RISKY_AVS_CODES     = ['A', 'C', 'E', 'F', 'G', 'I', 'K', 'L', 'N', 'O', 'P', 'R', 'S', 'U', 'W', 'Z'].freeze
+
+    belongs_to :order, class_name: 'Spree::Order', touch: true, inverse_of: :payments
+    belongs_to :source, polymorphic: true
+    belongs_to :payment_method, -> { with_deleted }, class_name: 'Spree::PaymentMethod', inverse_of: :payments
+
+    has_many :offsets, -> { offset_payment }, class_name: "Spree::Payment", foreign_key: :source_id
+    has_many :log_entries, as: :source
+    has_many :state_changes, as: :stateful
+    has_many :capture_events, class_name: 'Spree::PaymentCaptureEvent'
+    has_many :refunds, inverse_of: :payment
+
+    before_validation :validate_source, unless: :invalid?
+    before_create :set_unique_identifier
+
+    after_save :create_payment_profile, if: :profiles_supported?
+
+    # update the order totals, etc.
+    after_save :update_order
+
+    after_create :create_eligible_credit_event
+
+    # invalidate previously entered payments
+    after_create :invalidate_old_payments
+
+    attr_accessor :request_env
+
+    validates :amount, numericality: true
+    validates :source, presence: true, if: :source_required?
+    validates :payment_method, presence: true
+
+    default_scope -> { order(:created_at) }
+
+    scope :from_credit_card, -> { where(source_type: 'Spree::CreditCard') }
+    scope :with_state, ->(s) { where(state: s.to_s) }
+    # "offset" is reserved by activerecord
+    scope :offset_payment, -> { where("source_type = 'Spree::Payment' AND amount < 0 AND state = 'completed'") }
+
+    scope :checkout, -> { with_state('checkout') }
+    scope :completed, -> { with_state('completed') }
+    scope :pending, -> { with_state('pending') }
+    scope :processing, -> { with_state('processing') }
+    scope :failed, -> { with_state('failed') }
+
+    scope :risky, -> { where("avs_response IN (?) OR (cvv_response_code IS NOT NULL and cvv_response_code != 'M') OR state = 'failed'", RISKY_AVS_CODES) }
+    scope :valid, -> { where.not(state: %w(failed invalid)) }
+
+    scope :store_credits, -> { where(source_type: Spree::StoreCredit.to_s) }
+    scope :not_store_credits, -> { where(arel_table[:source_type].not_eq(Spree::StoreCredit.to_s).or(arel_table[:source_type].eq(nil))) }
+
+    # order state machine (see http://github.com/pluginaweek/state_machine/tree/master for details)
+    state_machine initial: :checkout do
+      # With card payments, happens before purchase or authorization happens
+      #
+      # Setting it after creating a profile and authorizing a full amount will
+      # prevent the payment from being authorized again once Order transitions
+      # to complete
+      event :started_processing do
+        transition from: [:checkout, :pending, :completed, :processing], to: :processing
+      end
+      # When processing during checkout fails
+      event :failure do
+        transition from: [:pending, :processing], to: :failed
+      end
+      # With card payments this represents authorizing the payment
+      event :pend do
+        transition from: [:checkout, :processing], to: :pending
+      end
+      # With card payments this represents completing a purchase or capture transaction
+      event :complete do
+        transition from: [:processing, :pending, :checkout], to: :completed
+      end
+      event :void do
+        transition from: [:pending, :processing, :completed, :checkout], to: :void
+      end
+      # when the card brand isnt supported
+      event :invalidate do
+        transition from: [:checkout], to: :invalid
+      end
+
+      after_transition do |payment, transition|
+        payment.state_changes.create!(
+          previous_state: transition.from,
+          next_state:     transition.to,
+          name:           'payment'
+        )
+      end
+    end
+
+    # @return [String] this payment's response code
+    def transaction_id
+      response_code
+    end
+
+    # @return [String] this payment's currency
+    delegate :currency, to: :order
+
+    # @return [Spree::Money] this amount of this payment as money object
+    def money
+      Spree::Money.new(amount, { currency: currency })
+    end
+    alias display_amount money
+
+    # Sets the amount, parsing it based on i18n settings if it is a string.
+    #
+    # @param amount [BigDecimal, String] the desired new amount
+    def amount=(amount)
+      self[:amount] =
+        case amount
+        when String
+          separator = I18n.t('number.currency.format.separator')
+          number    = amount.delete("^0-9-#{separator}\.").tr(separator, '.')
+          number.to_d if number.present?
+        end || amount
+    end
+
+    # The total amount of the offsets (for old-style refunds) for this payment.
+    #
+    # @return [BigDecimal] the total amount of this payment's offsets
+    def offsets_total
+      offsets.pluck(:amount).sum
+    end
+
+    # The total amount this payment can be credited.
+    #
+    # @return [BigDecimal] the amount of this payment minus the offsets
+    #   (old-style refunds) and refunds
+    def credit_allowed
+      amount - (offsets_total.abs + refunds.sum(:amount))
+    end
+
+    # @return [Boolean] true when this payment can be credited
+    def can_credit?
+      credit_allowed > 0
+    end
+
+    # @return [Boolean] true when this payment has been fully refunded
+    def fully_refunded?
+      refunds.map(&:amount).sum == amount
+    end
+
+    # @return [Array<String>] the actions available on this payment
+    def actions
+      sa = source_actions
+      sa |= ["failure"] if processing?
+      sa
+    end
+
+    # @return [Object] the source of ths payment
+    def payment_source
+      res = source.is_a?(Payment) ? source.source : source
+      res || payment_method
+    end
+
+    # @return [Boolean] true when this payment is risky based on address
+    def is_avs_risky?
+      return false if avs_response.blank? || NON_RISKY_AVS_CODES.include?(avs_response)
+      true
+    end
+
+    # @return [Boolean] true when this payment is risky based on cvv
+    def is_cvv_risky?
+      return false if cvv_response_code == "M"
+      return false if cvv_response_code.nil?
+      return false if cvv_response_message.present?
+      true
+    end
+
+    # @return [BigDecimal] the total amount captured on this payment
+    def captured_amount
+      capture_events.sum(:amount)
+    end
+
+    # @return [BigDecimal] the total amount left uncaptured on this payment
+    def uncaptured_amount
+      amount - captured_amount
+    end
+
+    # @return [Boolean] true when the payment method exists and is a store credit payment method
+    def store_credit?
+      payment_method.try!(:store_credit?)
+    end
+
+    private
+
+    def source_actions
+      return [] unless payment_source && payment_source.respond_to?(:actions)
+      payment_source.actions.select { |action| !payment_source.respond_to?("can_#{action}?") || payment_source.send("can_#{action}?", self) }
+    end
+
+    def validate_source
+      if source && !source.valid?
+        source.errors.each do |field, error|
+          field_name = I18n.t("activerecord.attributes.#{source.class.to_s.underscore}.#{field}")
+          errors.add(I18n.t(source.class.to_s.demodulize.underscore, scope: 'spree'), "#{field_name} #{error}")
+        end
+      end
+      if errors.any?
+        throw :abort
+      end
+    end
+
+    def source_required?
+      payment_method.present? && payment_method.source_required?
+    end
+
+    def profiles_supported?
+      payment_method.respond_to?(:payment_profiles_supported?) && payment_method.payment_profiles_supported?
+    end
+
+    def create_payment_profile
+      # Don't attempt to create on bad payments.
+      return if %w(invalid failed).include?(state)
+      # Payment profile cannot be created without source
+      return unless source
+      # Imported payments shouldn't create a payment profile.
+      return if source.imported
+
+      payment_method.create_profile(self)
+    rescue ActiveMerchant::ConnectionError => e
+      gateway_error e
+    end
+
+    def invalidate_old_payments
+      if !store_credit? && !['invalid', 'failed'].include?(state)
+        order.payments.select { |payment|
+          payment.state == 'checkout' && !payment.store_credit? && payment.id != id
+        }.each(&:invalidate!)
+      end
+    end
+
+    def update_order
+      if order.completed? || completed? || void?
+        order.recalculate
+      end
+    end
+
+    # Necessary because some payment gateways will refuse payments with
+    # duplicate IDs. We *were* using the Order number, but that's set once and
+    # is unchanging. What we need is a unique identifier on a per-payment basis,
+    # and this is it. Related to https://github.com/spree/spree/issues/1998.
+    # See https://github.com/spree/spree/issues/1998#issuecomment-12869105
+    def set_unique_identifier
+      loop do
+        self.number = generate_identifier
+        break unless self.class.exists?(number: number)
+      end
+    end
+
+    def generate_identifier
+      Array.new(8){ IDENTIFIER_CHARS.sample }.join
+    end
+
+    def create_eligible_credit_event
+      # When cancelling an order, a payment with the negative amount
+      # of the payment total is created to refund the customer. That
+      # payment has a source of itself (Spree::Payment) no matter the
+      # type of payment getting refunded, hence the additional check
+      # if the source is a store credit.
+      if store_credit? && source.is_a?(Spree::StoreCredit)
+        source.update_attributes!({
+          action: Spree::StoreCredit::ELIGIBLE_ACTION,
+          action_amount: amount,
+          action_authorization_code: response_code
+        })
+      end
+    end
+  end
+end

data/app/models/spree/payment_capture_event.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Spree
+  class PaymentCaptureEvent < Spree::Base
+    belongs_to :payment, class_name: 'Spree::Payment'
+
+    def display_amount
+      Spree::Money.new(amount, { currency: payment.currency })
+    end
+  end
+end

data/app/models/spree/payment_create.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Spree
+  # Service object for creating new payments on an Order
+  class PaymentCreate
+    # @param order [Order] The order for the new payment
+    # @param attributes [Hash,ActionController::Parameters] attributes which are assigned to the new payment
+    #   * :payment_method_id Id of payment method used for this payment
+    #   * :source_attributes Attributes used to build the source of this payment. Usually a {CreditCard}
+    #     * :existing_card_id (Integer) Deprecated: The id of an existing {CreditCard} object to use
+    #     * :wallet_payment_source_id (Integer): The id of a {WalletPaymentSource} to use
+    # @param request_env [Hash] rack env of user creating the payment
+    # @param payment [Payment] Internal use only. Instead of making a new payment, change the attributes for an existing one.
+    def initialize(order, attributes, payment: nil, request_env: {})
+      @order = order
+      @payment = payment
+
+      # If AC::Params are passed in, attributes.to_h gives us a hash of only
+      # the permitted attributes.
+      @attributes = attributes.to_h.with_indifferent_access
+      @source_attributes = @attributes.delete(:source_attributes) || {}
+      @request_env = request_env
+    end
+
+    # Build the new Payment
+    # @return [Payment] a new (unpersisted) Payment
+    def build
+      @payment ||= order.payments.new
+      @payment.request_env = @request_env if @request_env
+      @payment.attributes = @attributes
+
+      if source_attributes[:existing_card_id].present?
+        Spree::Deprecation.warn(
+          "Passing existing_card_id to PaymentCreate is deprecated. Use wallet_payment_source_id instead.",
+          caller,
+        )
+        build_existing_card
+      elsif source_attributes[:wallet_payment_source_id].present?
+        build_from_wallet_payment_source
+      else
+        build_source
+      end
+
+      @payment
+    end
+
+    private
+
+    attr_reader :order, :payment, :attributes, :source_attributes
+
+    def build_source
+      payment_method = payment.payment_method
+      if source_attributes.present? && payment_method.try(:payment_source_class)
+        payment.source = payment_method.payment_source_class.new(source_attributes)
+        payment.source.payment_method_id = payment_method.id
+        if order && payment.source.respond_to?(:user=)
+          payment.source.user = order.user
+        end
+      end
+    end
+
+    def build_from_wallet_payment_source
+      wallet_payment_source_id = source_attributes.fetch(:wallet_payment_source_id)
+      raise(ActiveRecord::RecordNotFound) if order.user.nil?
+      wallet_payment_source = order.user.wallet.find(wallet_payment_source_id)
+      raise(ActiveRecord::RecordNotFound) if wallet_payment_source.nil?
+      build_from_payment_source(wallet_payment_source.payment_source)
+    end
+
+    def build_existing_card
+      credit_card = available_cards.find(source_attributes[:existing_card_id])
+      build_from_payment_source(credit_card)
+    end
+
+    def build_from_payment_source(payment_source)
+      # FIXME: does this work?
+      if source_attributes[:verification_value]
+        payment_source.verification_value = source_attributes[:verification_value]
+      end
+
+      payment.source = payment_source
+      payment.payment_method_id = payment_source.payment_method_id
+    end
+
+    def available_cards
+      if user_id = order.user_id
+        Spree::CreditCard.where(user_id: user_id)
+      else
+        Spree::CreditCard.none
+      end
+    end
+  end
+end

data/app/models/spree/payment_method/bogus_credit_card.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Spree
+  class PaymentMethod::BogusCreditCard < PaymentMethod::CreditCard
+    TEST_VISA = ['4111111111111111', '4012888888881881', '4222222222222']
+    TEST_MC   = ['5500000000000004', '5555555555554444', '5105105105105100']
+    TEST_AMEX = ['378282246310005', '371449635398431', '378734493671000', '340000000000009']
+    TEST_DISC = ['6011000000000004', '6011111111111117', '6011000990139424']
+
+    VALID_CCS = ['1', TEST_VISA, TEST_MC, TEST_AMEX, TEST_DISC].flatten
+
+    attr_accessor :test
+
+    def gateway_class
+      self.class
+    end
+
+    def create_profile(payment)
+      return if payment.source.has_payment_profile?
+      # simulate the storage of credit card profile using remote service
+      if success = VALID_CCS.include?(payment.source.number)
+        payment.source.update_attributes(gateway_customer_profile_id: generate_profile_id(success))
+      end
+    end
+
+    def authorize(_money, credit_card, _options = {})
+      profile_id = credit_card.gateway_customer_profile_id
+      if VALID_CCS.include?(credit_card.number) || (profile_id && profile_id.starts_with?('BGS-'))
+        ActiveMerchant::Billing::Response.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345', avs_result: { code: 'D' })
+      else
+        ActiveMerchant::Billing::Response.new(false, 'Bogus Gateway: Forced failure', { message: 'Bogus Gateway: Forced failure' }, test: true)
+      end
+    end
+
+    def purchase(_money, credit_card, _options = {})
+      profile_id = credit_card.gateway_customer_profile_id
+      if VALID_CCS.include?(credit_card.number) || (profile_id && profile_id.starts_with?('BGS-'))
+        ActiveMerchant::Billing::Response.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345', avs_result: { code: 'M' })
+      else
+        ActiveMerchant::Billing::Response.new(false, 'Bogus Gateway: Forced failure', message: 'Bogus Gateway: Forced failure', test: true)
+      end
+    end
+
+    def credit(_money, _credit_card, _response_code, _options = {})
+      ActiveMerchant::Billing::Response.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345')
+    end
+
+    def capture(_money, authorization, _gateway_options)
+      if authorization == '12345'
+        ActiveMerchant::Billing::Response.new(true, 'Bogus Gateway: Forced success', {}, test: true)
+      else
+        ActiveMerchant::Billing::Response.new(false, 'Bogus Gateway: Forced failure', error: 'Bogus Gateway: Forced failure', test: true)
+      end
+    end
+
+    def void(_response_code, _credit_card, _options = {})
+      ActiveMerchant::Billing::Response.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345')
+    end
+
+    # @see Spree::PaymentMethod#try_void
+    def try_void(_payment)
+      ActiveMerchant::Billing::Response.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345')
+    end
+
+    def test?
+      # Test mode is not really relevant with bogus gateway (no such thing as live server)
+      true
+    end
+
+    def payment_profiles_supported?
+      true
+    end
+
+    def actions
+      %w(capture void credit)
+    end
+
+    private
+
+    def generate_profile_id(success)
+      record = true
+      prefix = success ? 'BGS' : 'FAIL'
+      while record
+        random = "#{prefix}-#{Array.new(6){ rand(6) }.join}"
+        record = Spree::CreditCard.where(gateway_customer_profile_id: random).first
+      end
+      random
+    end
+  end
+end