solidus_mollie 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9dc0df8101384051b947487223e3b8aac8092e7da9dcbc394cb4bcfc5cac77a2
-  data.tar.gz: 32b058d3cdd52adac6b85b98e9eb2b267e688a111f29447879a654812951ea9f
+  metadata.gz: f592e8878266fb1b4b38e6f42092fcb187672afff238eb443a9bab7c848070f1
+  data.tar.gz: 58736fe2073d3299bb7c3e2c5ad129b56b09cf1f884ab6bf72a9553a4c2f0241
 SHA512:
-  metadata.gz: 1f3e7bdaf7b94a4235ca2cf91c4d61f056f0fd0f320300fe3c3f584227bbd9ca701bc903cefa08931fc8742959c9da1d1da318069b74af853a83af5a9111b483
-  data.tar.gz: 4cc1d2a6542ee1b2fc401a676ee9275e6422fde82af2c510cff051b8504f89ca69e69138ddfa55b3c70384146630cba68df67b55aff0163fac86e25face74dbd
+  metadata.gz: 717c362a01ab15f28e0688aaef56afd03a5843dc0550820af0c8efd55e3095c10818279f5abd5e38fd72f483e6c52c26c453bf6ef5254368e5966f1e602cc113
+  data.tar.gz: b2d900cf170ba23ee52ffda9af13a407fecf9eb5dd508186720048578781c515194ef1cd79e0de16476809f624aa7ced8b12f13950286791d5b224d1d49f8883

data/LICENSE

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2026, Kalopa Robotics
+Copyright (c) 2026, Kalopa Robotics Limited.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:

data/README.md

@@ -1,5 +1,7 @@
 # solidus_mollie
 
+[![Gem Version](https://badge.fury.io/rb/solidus_mollie.svg)](https://badge.fury.io/rb/solidus_mollie)
+
 Accept [Mollie](https://www.mollie.com) payments in your [Solidus](https://solidus.io)
 store using Mollie's **hosted checkout** (the buyer is redirected to Mollie to pay)
 and **webhooks** for settlement.
@@ -57,23 +59,53 @@ The key prefix (`test_`/`live_`) determines test vs live mode automatically.
 
 ## Frontend
 
-The gem ships a `spree/checkout/payment/_mollie` partial (an informational note)
-and prepends a `Spree::CheckoutController#update` override that performs the
-redirect. This works with `solidus_starter_frontend` out of the box.
+Solidus stores come in three shapes and the gem detects which one it is running in
+(see `SolidusMollie::Frontend`):
+
+| Store                                            | Checkout hook                        | Buyer returns to                          |
+|--------------------------------------------------|--------------------------------------|-------------------------------------------|
+| **Starter frontend** (copied into your app)      | `CheckoutsController#update`         | `token_order_url(order, token)`           |
+| **Legacy `solidus_frontend`**                    | `Spree::CheckoutController#update`   | `spree.order_url(order, token:)`          |
+| **Headless / API**                               | none - you call the service yourself | wherever your `order_url` lambda says     |
+
+Payment-step and order-page partials are shipped for both storefronts
+(`checkouts/payment/_mollie`, `orders/payment_info/_mollie` and the `spree/...`
+equivalents), plus the admin `source_views`/`source_forms` partials so an order's
+Mollie payment is viewable in the backend.
+
+Anything the auto-detection gets wrong can be overridden in an initializer:
+
+```ruby
+SolidusMollie.configure do |config|
+  config.checkout_controller = 'MyCheckoutController' # or false to disable the hook
+  config.order_url = ->(controller, order) { controller.main_app.my_order_url(order) }
+  config.payment_step_path = ->(controller) { controller.main_app.my_payment_path }
+  config.root_path = ->(controller) { '/' }
+end
+```
+
+### Headless / API stores
 
-If you run a **headless / API frontend**, the controller override is skipped.
-Trigger the redirect yourself after confirm:
+There is no checkout controller to hook, so trigger the redirect yourself once
+the order reaches `confirm`:
 
 ```ruby
 result = SolidusMollie::CreateOrderPayment.call(
   order: order,
   payment: order.payments.detect { |p| p.checkout? && p.payment_method.is_a?(SolidusMollie::PaymentMethod) },
-  redirect_url: mollie_return_url(order_number: order.number, token: order.token),
-  webhook_url: mollie_webhook_url
+  redirect_url: spree.mollie_return_url(order_number: order.number, token: order.guest_token),
+  webhook_url: spree.mollie_webhook_url
 )
 # => redirect the buyer to result.checkout_url
 ```
 
+### Abandoned payments
+
+If a buyer comes back from Mollie without paying and presses "Place order" again,
+the stale `pending` payment is voided (and cancelled at Mollie when still
+cancelable) and a fresh Mollie payment is started, so an order can never complete
+against an unpaid Mollie payment.
+
 ## Refunds & cancellation
 
 Refunds from the Solidus admin call `PaymentMethod#credit`, which creates a Mollie
@@ -99,9 +131,21 @@ Bundled specs to build on:
   failed / idempotent / unknown-id). This is the behaviour most worth covering.
 - `spec/requests/solidus_mollie/callbacks_spec.rb` — webhook + return endpoints.
 - `spec/models/solidus_mollie/payment_method_spec.rb` — test-mode detection, refunds.
+- `spec/decorators/solidus_mollie/checkout_controller_decorator_spec.rb` — the
+  confirm-step redirect, run against a stand-in checkout controller.
+- `spec/solidus_mollie/frontend_spec.rb` — storefront detection and overrides.
 - `spec/support/mollie_stubs.rb` — helpers to fake the Mollie API so specs never
   hit the network (`stub_mollie_get`, `stub_mollie_create`).
 
+The dummy app is generated against the Solidus branch in `SOLIDUS_BRANCH`, and
+`bundle` re-reads that variable every time, so export it once per shell:
+
+```bash
+export SOLIDUS_BRANCH=v4.6
+bin/setup
+bundle exec rspec
+```
+
 ### Testing against Mollie for real
 
 Mollie has no separate sandbox URL — use a **test API key** (`test_…`) on the
@@ -115,8 +159,9 @@ run a tunnel (`ngrok http 3000`) and use the public host.
 
 - No one-click / reusable mandates (sources are non-reusable in this version).
 - No partial-payment handling beyond a single payment per order.
-- A buyer can technically re-enter checkout while an order sits in `confirm`
-  awaiting a Mollie result; revisit if this matters for your flow.
+- Mollie's webhook is unauthenticated by design (it only carries an id and the
+  gem re-fetches the payment from Mollie), so it must stay that way; do not put
+  it behind auth.
 
 ## License
 

data/app/controllers/solidus_mollie/callbacks_controller.rb

@@ -4,7 +4,10 @@ module SolidusMollie
   # Handles the two requests Mollie sends us:
   #   * #webhook  - server-to-server POST with the payment id (source of truth)
   #   * #return   - the buyer's browser coming back from Mollie's hosted page
-  class CallbacksController < ::Spree::StoreController
+  #
+  # Inherits from Spree::BaseController (solidus_core) rather than a storefront
+  # controller so it loads regardless of which frontend the store uses.
+  class CallbacksController < ::Spree::BaseController
     skip_before_action :verify_authenticity_token, only: :webhook
 
     # POST /mollie/webhook  (body: id=tr_xxxxx)
@@ -15,7 +18,7 @@ module SolidusMollie
       # 422 so Mollie retries (covers the rare webhook-before-persist race).
       Rails.logger.warn("[solidus_mollie] webhook payment not found: #{e.message}")
       head :unprocessable_entity
-    rescue StandardError => e
+    rescue => e
       Rails.logger.error("[solidus_mollie] webhook error: #{e.message}")
       head :internal_server_error
     end
@@ -23,21 +26,27 @@ module SolidusMollie
     # GET /mollie/return?order_number=R123&token=abc
     def return
       order = ::Spree::Order.find_by!(number: params[:order_number])
-
-      if params[:token].present? && order.token.present? &&
-         !ActiveSupport::SecurityUtils.secure_compare(params[:token].to_s, order.token.to_s)
-        raise ActiveRecord::RecordNotFound
-      end
+      raise ActiveRecord::RecordNotFound unless token_matches?(order)
 
       unless order.completed?
         flash[:notice] = I18n.t('solidus_mollie.confirming_payment',
-                                default: "Thanks! We're confirming your payment with Mollie.")
+          default: "Thanks! We're confirming your payment with Mollie.")
       end
 
-      redirect_to spree.order_url(order, token: order.token)
+      redirect_to SolidusMollie::Frontend.order_url(self, order)
     rescue ActiveRecord::RecordNotFound
       flash[:error] = I18n.t('solidus_mollie.order_not_found', default: 'Order not found.')
-      redirect_to spree.root_path
+      redirect_to SolidusMollie::Frontend.root_path(self)
+    end
+
+    private
+
+    # The guest token is what lets the buyer see their order page, so the
+    # return URL must carry the right one. Never fall through on a blank token.
+    def token_matches?(order)
+      token = params[:token].to_s
+      token.present? && order.guest_token.present? &&
+        ActiveSupport::SecurityUtils.secure_compare(token, order.guest_token.to_s)
     end
   end
 end

data/app/decorators/solidus_mollie/checkout_controller_decorator.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module SolidusMollie
+  # Prepended to the storefront checkout controller (see SolidusMollie::Frontend
+  # for which one). When the buyer places an order that is paying with Mollie,
+  # they are redirected to Mollie's hosted checkout instead of the order being
+  # completed synchronously; the webhook finishes the order later
+  # (SolidusMollie::ProcessWebhook).
+  #
+  # Works with both the starter frontend (CheckoutsController#update) and the
+  # legacy solidus_frontend (Spree::CheckoutController#update): both expose
+  # +@order+, +params[:state]+ and the +spree+ route proxy.
+  module CheckoutControllerDecorator
+    def update
+      return redirect_to_mollie if divert_to_mollie?
+
+      super
+    end
+
+    private
+
+    # Both frontends route "Place order" to update with params[:state] ==
+    # 'confirm' (and set @order.state from it), so the param is the reliable
+    # signal; an order that merely *is* in confirm must not be diverted while
+    # the buyer is editing an earlier step.
+    def divert_to_mollie?
+      return false unless @order
+      return false unless params[:state].to_s == 'confirm'
+
+      mollie_payment.present?
+    end
+
+    # The Mollie payment to send the buyer off with. Normally the payment the
+    # buyer created at the payment step (state +checkout+). If an earlier
+    # attempt is still +pending+ (the buyer came back from Mollie without
+    # paying and pressed "Place order" again) it is voided and replaced, so the
+    # order can never complete against an unpaid Mollie payment.
+    def mollie_payment
+      return @mollie_payment if defined?(@mollie_payment)
+
+      payments = @order.payments.select { |p| p.payment_method.is_a?(SolidusMollie::PaymentMethod) }
+      @mollie_payment = payments.find(&:checkout?) || replace_pending_mollie_payment(payments.find(&:pending?))
+    end
+
+    def replace_pending_mollie_payment(pending)
+      return nil unless pending
+
+      pending.payment_method.try_void(pending) if pending.response_code.present?
+      pending.void!
+      @order.payments.create!(payment_method: pending.payment_method, amount: @order.total)
+    end
+
+    def redirect_to_mollie
+      result = SolidusMollie::CreateOrderPayment.call(
+        order: @order,
+        payment: mollie_payment,
+        redirect_url: spree.mollie_return_url(order_number: @order.number, token: @order.guest_token),
+        webhook_url: spree.mollie_webhook_url
+      )
+
+      if result.success?
+        redirect_to result.checkout_url, allow_other_host: true
+      else
+        flash[:error] = I18n.t('solidus_mollie.payment_error',
+          message: result.error,
+          default: "We couldn't start your Mollie payment.")
+        redirect_to SolidusMollie::Frontend.payment_step_path(self)
+      end
+    end
+  end
+end

data/app/models/solidus_mollie/client.rb

@@ -15,9 +15,9 @@ module SolidusMollie
 
     # amount: a BigDecimal/Numeric in MAJOR units (e.g. 10.00 for €10).
     def create_payment(amount:, currency:, description:, redirect_url:, webhook_url:,
-                       method: nil, metadata: {})
+      method: nil, metadata: {})
       Mollie::Payment.create(
-        amount: { value: self.class.format_amount(amount, currency), currency: currency },
+        amount: {value: self.class.format_amount(amount, currency), currency: currency},
         description: description,
         redirect_url: redirect_url,
         webhook_url: webhook_url,
@@ -38,7 +38,7 @@ module SolidusMollie
     def create_refund(payment_id:, amount:, currency:)
       Mollie::Payment::Refund.create(
         payment_id: payment_id,
-        amount: { value: self.class.format_amount(amount, currency), currency: currency },
+        amount: {value: self.class.format_amount(amount, currency), currency: currency},
         api_key: @api_key
       )
     end
@@ -59,7 +59,7 @@ module SolidusMollie
 
     def self.currency_exponent(currency)
       ::Money::Currency.new(currency).exponent
-    rescue StandardError
+    rescue
       2
     end
   end

data/app/models/solidus_mollie/mollie_source.rb

@@ -7,6 +7,8 @@ module SolidusMollie
   class MollieSource < ::Spree::PaymentSource
     self.table_name = 'solidus_mollie_sources'
 
+    belongs_to :user, class_name: ::Spree::UserClassHandle.new, optional: true
+
     # Off-site payments are not reusable for one-click in this version.
     def reusable?
       false

data/app/models/solidus_mollie/payment_method.rb

@@ -23,8 +23,12 @@ module SolidusMollie
       'mollie'
     end
 
+    # No card data is collected in the store: the MollieSource is created when
+    # the buyer is redirected (CreateOrderPayment), not at the payment step.
+    # Returning false lets every frontend (starter, legacy, API) create the
+    # payment with just a payment_method_id.
     def source_required?
-      true
+      false
     end
 
     def payment_profiles_supported?
@@ -75,7 +79,7 @@ module SolidusMollie
         currency: currency
       )
       SolidusMollie::Response.success('Mollie refund created', authorization: response_code)
-    rescue StandardError => e
+    rescue => e
       Rails.logger.error("[solidus_mollie] refund failed: #{e.message}")
       SolidusMollie::Response.failure(e.message)
     end
@@ -89,7 +93,7 @@ module SolidusMollie
 
       client.cancel_payment(payment.response_code)
       SolidusMollie::Response.success('Mollie payment canceled', authorization: payment.response_code)
-    rescue StandardError => e
+    rescue => e
       Rails.logger.error("[solidus_mollie] void failed: #{e.message}")
       false
     end

data/app/services/solidus_mollie/create_order_payment.rb

@@ -31,12 +31,12 @@ module SolidusMollie
         redirect_url: @redirect_url,
         webhook_url: @webhook_url,
         method: payment_method.preferred_mollie_method,
-        metadata: { order_number: @order.number, payment_number: @payment.number }
+        metadata: {order_number: @order.number, payment_number: @payment.number}
       )
 
       persist(mollie)
       Result.new(checkout_url: mollie.checkout_url)
-    rescue StandardError => e
+    rescue => e
       Rails.logger.error("[solidus_mollie] failed to create payment for #{@order.number}: #{e.message}")
       Result.new(error: e.message)
     end

data/app/views/checkouts/payment/_mollie.html.erb

@@ -0,0 +1,5 @@
+<%# Starter frontend: rendered inside the payment-method card at the payment step.
+    Buyers enter nothing here - they are redirected to Mollie when they place the order. %>
+<div class="mollie-payment-method" data-payment-method-type="mollie">
+  <p><%= t('solidus_mollie.redirect_notice') %></p>
+</div>

data/app/views/orders/payment_info/_mollie.html.erb

@@ -0,0 +1,5 @@
+<%# Starter frontend: order page / confirm step summary of a Mollie payment. %>
+<%= payment.payment_method.name %>
+<% if payment.source.respond_to?(:mollie_method) && payment.source.mollie_method.present? %>
+  (<%= payment.source.mollie_method.to_s.titleize %>)
+<% end %>

data/app/views/spree/admin/payments/source_forms/_mollie.html.erb

@@ -0,0 +1,3 @@
+<%# Admin: "New payment" form. Mollie payments can only be started by the buyer
+    (they must be redirected to Mollie), so there is nothing to fill in here. %>
+<p class="note"><%= t('solidus_mollie.admin.cannot_create') %></p>

data/app/views/spree/admin/payments/source_views/_mollie.html.erb

@@ -0,0 +1,28 @@
+<%# Admin: Orders -> Payments -> a Mollie payment. %>
+<fieldset class="no-border-bottom">
+  <legend align="center"><%= t('solidus_mollie.admin.legend') %></legend>
+  <table>
+    <tbody>
+      <tr>
+        <th><%= t('solidus_mollie.admin.mollie_payment_id') %></th>
+        <td>
+          <% if payment.source&.mollie_payment_id.present? %>
+            <%= link_to payment.source.mollie_payment_id,
+                        "https://my.mollie.com/dashboard/payments/#{payment.source.mollie_payment_id}",
+                        target: '_blank', rel: 'noopener' %>
+          <% else %>
+            <%= t('solidus_mollie.admin.not_started') %>
+          <% end %>
+        </td>
+      </tr>
+      <tr>
+        <th><%= t('solidus_mollie.admin.mollie_method') %></th>
+        <td><%= payment.source&.mollie_method.presence || '-' %></td>
+      </tr>
+      <tr>
+        <th><%= t('solidus_mollie.admin.mollie_status') %></th>
+        <td><%= payment.source&.status.presence || '-' %></td>
+      </tr>
+    </tbody>
+  </table>
+</fieldset>

data/app/views/spree/checkout/payment/_mollie.html.erb

@@ -1,3 +1,5 @@
+<%# Buyers enter no card data here – they choose Mollie and are redirected to
+    Mollie's hosted checkout when they place the order. %>
 <div class="mollie-payment-method" data-payment-method-type="mollie">
   <p><%= t('solidus_mollie.redirect_notice') %></p>
 </div>

data/app/views/spree/orders/payment_info/_mollie.html.erb

@@ -0,0 +1,5 @@
+<%# Legacy solidus_frontend: order page / confirm step summary of a Mollie payment. %>
+<%= payment.payment_method.name %>
+<% if payment.source.respond_to?(:mollie_method) && payment.source.mollie_method.present? %>
+  (<%= payment.source.mollie_method.to_s.titleize %>)
+<% end %>

data/config/locales/en.yml

@@ -4,3 +4,10 @@ en:
     confirming_payment: "Thanks! We're confirming your payment with Mollie."
     order_not_found: "Order not found."
     redirect_notice: "You'll be redirected to Mollie to complete your payment securely."
+    admin:
+      legend: "Mollie"
+      mollie_payment_id: "Mollie payment"
+      mollie_method: "Method"
+      mollie_status: "Mollie status"
+      not_started: "Not started (buyer has not been redirected to Mollie yet)"
+      cannot_create: "Mollie payments are started by the customer during checkout and cannot be created from the admin."

data/config/routes.rb

@@ -2,7 +2,11 @@
 
 # Mount onto Spree's engine so the helpers are available as
 # spree.mollie_webhook_url / spree.mollie_return_url.
+#
+# The leading slash on the controller is essential: Spree::Core::Engine is an
+# isolated engine, so a bare 'solidus_mollie/callbacks' would resolve to
+# Spree::SolidusMollie::CallbacksController.
 ::Spree::Core::Engine.routes.draw do
-  post '/mollie/webhook', to: 'solidus_mollie/callbacks#webhook', as: :mollie_webhook
-  get  '/mollie/return',  to: 'solidus_mollie/callbacks#return',  as: :mollie_return
+  post '/mollie/webhook', to: '/solidus_mollie/callbacks#webhook', as: :mollie_webhook
+  get '/mollie/return', to: '/solidus_mollie/callbacks#return', as: :mollie_return
 end

data/lib/generators/solidus_mollie/install/install_generator.rb

@@ -19,7 +19,7 @@ module SolidusMollie
 
       def run_migrations
         run_migrations = options[:auto_run_migrations] ||
-                         ['', 'y', 'Y'].include?(ask('Run migrations now? [Yn]'))
+          ['', 'y', 'Y'].include?(ask('Run migrations now? [Yn]'))
         if run_migrations
           rake 'db:migrate'
         else

data/lib/solidus_mollie/configuration.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module SolidusMollie
+  # Global settings. Everything here has a sensible default that is detected
+  # from the host application, so most stores never need to touch it:
+  #
+  #   SolidusMollie.configure do |config|
+  #     config.checkout_controller = 'MyCheckoutController'
+  #     config.order_url = ->(controller, order) { controller.main_app.my_order_url(order) }
+  #   end
+  class Configuration
+    # Name of the storefront controller whose #update action places the order
+    # at the confirm step. nil = auto-detect (see SolidusMollie::Frontend).
+    # Set to false to disable the override entirely (headless stores).
+    attr_accessor :checkout_controller
+
+    # Optional lambdas, each called with (controller, order) / (controller),
+    # returning where the buyer should be sent. nil = auto-detect.
+    attr_accessor :order_url, :payment_step_path, :root_path
+  end
+
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+    end
+  end
+end

data/lib/solidus_mollie/engine.rb

@@ -10,29 +10,31 @@ module SolidusMollie
     # so helpers resolve as spree.mollie_webhook_url / spree.mollie_return_url.
 
     # Register the payment method so it appears in the admin "New Payment Method"
-    # provider dropdown.
-    initializer 'solidus_mollie.register_payment_method' do |app|
-      app.reloader.to_prepare do
-        methods = Rails.application.config.spree.payment_methods
-        methods << SolidusMollie::PaymentMethod unless methods.include?(SolidusMollie::PaymentMethod)
-      rescue StandardError => e
-        Rails.logger.warn("[solidus_mollie] could not auto-register payment method: #{e.message}")
-      end
+    # provider dropdown. Runs right after core populates its defaults; the string
+    # form avoids autoloading the model during boot and survives code reloads
+    # (config.spree.payment_methods is a ClassConstantizer::Set that constantizes
+    # on read and dedupes inserts).
+    initializer 'solidus_mollie.register_payment_method', after: 'spree.register.payment_methods' do |app|
+      app.config.spree.payment_methods << 'SolidusMollie::PaymentMethod'
     end
 
-    # Prepend our checkout override so confirm-step orders paying with Mollie are
-    # redirected to Mollie's hosted checkout instead of completing synchronously.
+    # Hook the storefront's checkout controller so confirm-step orders paying
+    # with Mollie are redirected to Mollie's hosted checkout instead of being
+    # completed synchronously. Re-runs on every code reload in development.
     config.to_prepare do
       SolidusMollie::Engine.prepare_decorators
     end
 
     def self.prepare_decorators
-      Spree::CheckoutController.prepend(SolidusMollie::Spree::CheckoutControllerDecorator)
-    rescue NameError
-      Rails.logger.info(
-        '[solidus_mollie] Spree::CheckoutController not found; skipping checkout override. ' \
-        'For an API/headless frontend, call SolidusMollie::CreateOrderPayment yourself.'
-      )
+      controller = SolidusMollie::Frontend.checkout_controller
+      if controller
+        controller.prepend(SolidusMollie::CheckoutControllerDecorator)
+      else
+        Rails.logger.info(
+          '[solidus_mollie] no storefront checkout controller found; skipping checkout override. ' \
+          'For an API/headless frontend, call SolidusMollie::CreateOrderPayment yourself.'
+        )
+      end
     end
   end
 end

data/lib/solidus_mollie/frontend.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module SolidusMollie
+  # Resolves the storefront-specific pieces of the Mollie flow. Solidus stores
+  # come in three shapes and this module papers over the differences:
+  #
+  #   * the starter frontend copied into the host app (Solidus 3.2+): checkout
+  #     lives in +CheckoutsController+ and order/checkout routes are main-app
+  #     routes (+token_order_url+, +checkout_state_path+);
+  #   * the legacy +solidus_frontend+ engine: +Spree::CheckoutController+ and
+  #     +spree.order_url+ / +spree.checkout_state_path+;
+  #   * headless / API stores: no checkout controller at all - the host app
+  #     drives SolidusMollie::CreateOrderPayment itself.
+  #
+  # Every lookup can be overridden through SolidusMollie.config.
+  module Frontend
+    CHECKOUT_CONTROLLERS = %w[CheckoutsController Spree::CheckoutController].freeze
+
+    module_function
+
+    # The controller class to hook, or nil when there is none (headless).
+    def checkout_controller
+      configured = SolidusMollie.config.checkout_controller
+      return nil if configured == false
+      return configured.to_s.constantize if configured.present?
+
+      CHECKOUT_CONTROLLERS.lazy.map(&:safe_constantize).find(&:itself)
+    end
+
+    # Where to send the buyer once they come back from Mollie.
+    def order_url(controller, order)
+      custom = SolidusMollie.config.order_url
+      return custom.call(controller, order) if custom
+
+      main = controller.main_app
+      spree = controller.spree
+      if main.respond_to?(:token_order_url)
+        main.token_order_url(order, order.guest_token)
+      elsif spree.respond_to?(:order_url)
+        spree.order_url(order, token: order.guest_token)
+      else
+        root_path(controller)
+      end
+    end
+
+    # Where to send the buyer if the Mollie payment could not be created.
+    def payment_step_path(controller)
+      custom = SolidusMollie.config.payment_step_path
+      return custom.call(controller) if custom
+
+      routes = [controller.main_app, controller.spree].find { |r| r.respond_to?(:checkout_state_path) }
+      routes ? routes.checkout_state_path(:payment) : root_path(controller)
+    end
+
+    def root_path(controller)
+      custom = SolidusMollie.config.root_path
+      return custom.call(controller) if custom
+
+      routes = [controller.main_app, controller.spree].find { |r| r.respond_to?(:root_path) }
+      routes ? routes.root_path : '/'
+    end
+  end
+end

data/lib/solidus_mollie/{factories.rb → testing_support/factories.rb}

@@ -5,7 +5,7 @@ FactoryBot.define do
     name { 'Mollie' }
     available_to_admin { true }
     available_to_users { true }
-    preferences { { api_key: 'test_fakekey', mollie_method: '' } }
+    preferences { {api_key: 'test_fakekey', mollie_method: ''} }
   end
 
   factory :mollie_source, class: 'SolidusMollie::MollieSource' do

data/lib/solidus_mollie/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SolidusMollie
-  VERSION = '0.9.0'
+  VERSION = '0.10.0'
 end

data/lib/solidus_mollie.rb

@@ -3,6 +3,8 @@
 require 'mollie-api-ruby'
 require 'solidus_core'
 require 'solidus_mollie/version'
+require 'solidus_mollie/configuration'
+require 'solidus_mollie/frontend'
 require 'solidus_mollie/engine'
 
 module SolidusMollie

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: solidus_mollie
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Kalopa Robotics
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-20 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mollie-api-ruby
@@ -83,29 +82,35 @@ files:
 - LICENSE
 - README.md
 - app/controllers/solidus_mollie/callbacks_controller.rb
-- app/decorators/solidus_mollie/spree/checkout_controller_decorator.rb
+- app/decorators/solidus_mollie/checkout_controller_decorator.rb
 - app/models/solidus_mollie/client.rb
 - app/models/solidus_mollie/mollie_source.rb
 - app/models/solidus_mollie/payment_method.rb
 - app/models/solidus_mollie/response.rb
 - app/services/solidus_mollie/create_order_payment.rb
 - app/services/solidus_mollie/process_webhook.rb
+- app/views/checkouts/payment/_mollie.html.erb
+- app/views/orders/payment_info/_mollie.html.erb
+- app/views/spree/admin/payments/source_forms/_mollie.html.erb
+- app/views/spree/admin/payments/source_views/_mollie.html.erb
 - app/views/spree/checkout/payment/_mollie.html.erb
+- app/views/spree/orders/payment_info/_mollie.html.erb
 - config/locales/en.yml
 - config/routes.rb
 - db/migrate/20260620143922_create_solidus_mollie_sources.rb
 - lib/generators/solidus_mollie/install/install_generator.rb
 - lib/generators/solidus_mollie/install/templates/initializer.rb
 - lib/solidus_mollie.rb
+- lib/solidus_mollie/configuration.rb
 - lib/solidus_mollie/engine.rb
-- lib/solidus_mollie/factories.rb
+- lib/solidus_mollie/frontend.rb
+- lib/solidus_mollie/testing_support/factories.rb
 - lib/solidus_mollie/version.rb
 homepage: https://github.com/kalopa/solidus_mollie
 licenses:
 - BSD-2-Clause
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -120,8 +125,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.19
-signing_key:
+rubygems_version: 4.0.21
 specification_version: 4
 summary: Mollie payments for Solidus
 test_files: []

data/app/decorators/solidus_mollie/spree/checkout_controller_decorator.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-module SolidusMollie
-  module Spree
-    # Intercepts the checkout confirm step. When the order is paying with a
-    # Mollie payment method, the buyer is redirected to Mollie's hosted checkout
-    # instead of the order being completed synchronously. The order is finished
-    # later by the webhook (see SolidusMollie::ProcessWebhook).
-    module CheckoutControllerDecorator
-      def update
-        return redirect_to_mollie if divert_to_mollie?
-
-        super
-      end
-
-      private
-
-      def divert_to_mollie?
-        return false unless params[:state].to_s == 'confirm' || @order&.confirm?
-
-        mollie_payment.present?
-      end
-
-      def mollie_payment
-        @mollie_payment ||= @order&.payments&.detect do |payment|
-          payment.checkout? && payment.payment_method.is_a?(SolidusMollie::PaymentMethod)
-        end
-      end
-
-      def redirect_to_mollie
-        result = SolidusMollie::CreateOrderPayment.call(
-          order: @order,
-          payment: mollie_payment,
-          redirect_url: spree.mollie_return_url(mollie_url_options.merge(
-                                                  order_number: @order.number,
-                                                  token: @order.token
-                                                )),
-          webhook_url: spree.mollie_webhook_url(mollie_url_options)
-        )
-
-        if result.success?
-          redirect_to result.checkout_url, allow_other_host: true
-        else
-          flash[:error] = I18n.t('solidus_mollie.payment_error',
-                                 message: result.error,
-                                 default: "We couldn't start your Mollie payment.")
-          redirect_to spree.checkout_state_path(:payment)
-        end
-      end
-
-      def mollie_url_options
-        {
-          host: request.host,
-          port: request.optional_port,
-          protocol: request.ssl? ? 'https' : 'http'
-        }.compact
-      end
-    end
-  end
-end