spree-paypal_platform 5.1.4 → 5.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10754110031d42b6574e51b4eef1c1cb1adcc5a0d09b7c203d8620eae06acae8
-  data.tar.gz: e7d3ea6129314c8cf7d2083370a8997bdd09aa655cfd826d96145378a60865ae
+  metadata.gz: 4de54a54a0c7dd935c012bf20c72711b0bf78959b2556acebfacc3c0eb14e930
+  data.tar.gz: 94c506e594ce38d454fdff782d1dad610582b81e59e658d1bce232b29cf7344c
 SHA512:
-  metadata.gz: 0e97ad651a97eba76344f666a171ad211583608a8ce307ca80fd507f5452e6a07ca2e81f04af9f4fce14594a5c507d1e95facce00eb0d334d7ea34c5b499ba2c
-  data.tar.gz: 001c8dec98b5eed5f48c20cc398b453daeaca65829b81d49bb7aa40cc33b3b6ab06beeadf2c77b6ab2dd71612216f9f877dde3d8ed3723edec956fd3d5b4a2d9
+  metadata.gz: abdce2d88ae3c2fb939cb6ce006bf1b6a654fadf98436df56ff3771c7f79b55c66e28fea31934bdc20310877b2f875c4e19fe0be873b4d15b1a05cfeee45af7c
+  data.tar.gz: 8c4d81e0b0f6e8d80da95c7febc3c6acaefda891d4dce1c5722ea0a9a0700da8f9beaeccb2dbe046ce0fd320b4dac0bccffa6a555cbd2e1356d719ce3d7077dc

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 5.1.5
+
+- Gift cards and store credit: the PayPal order is created for the amount
+  due (`total_minus_store_credits`), not the full order total. Before, PayPal
+  charged the full total while Spree recorded the gift card as paying part
+  of it, so the customer paid twice for that part. A partial charge is sent
+  as a plain amount, without the breakdown and items that sum to the full
+  total.
+- Completing a session refuses to capture when the PayPal order amount no
+  longer matches the amount due (e.g. a gift card was applied, or the cart
+  changed, after the PayPal order was created). The session fails and the
+  storefront creates a new one.
+
 ## 5.1.4
 
 - `enable_card_fields` preference (checkbox, default on).

data/app/models/spree/paypal_platform/gateway/payment_sessions.rb

@@ -42,7 +42,7 @@ module Spree
           return nil if total.zero?
 
           protect_from_error do
-            order_presenter = OrderPresenter.new(order)
+            order_presenter = OrderPresenter.new(order, amount: total)
             paypal_response = client.orders.create_order(order_presenter.to_json)
 
             session_data = paypal_response.data.as_json
@@ -101,6 +101,7 @@ module Spree
             if fetched.data.status == 'COMPLETED'
               fetched
             else
+              ensure_amount_matches!(payment_session, fetched)
               client.orders.capture_order(lookup)
             end
 
@@ -166,6 +167,26 @@ module Spree
 
         private
 
+        ##
+        # Refuses to capture a PayPal order whose amount no longer matches what
+        # is due — e.g. a gift card was applied, or the cart changed, after the
+        # PayPal order was created. Capturing would take the stale amount; the
+        # storefront recreates the session instead.
+        #
+        # @raise [Spree::Core::GatewayError]
+        #
+        def ensure_amount_matches!(payment_session, fetched)
+          value = fetched.data.as_json.dig('purchase_units', 0, 'amount', 'value')
+          return if value.blank?
+
+          due = payment_session.order.total_minus_store_credits
+          return if value.to_d == due.to_d
+
+          payment_session.fail if payment_session.can_fail?
+          raise Spree::Core::GatewayError,
+                "PayPal order amount #{value} does not match the amount due #{due}"
+        end
+
         def extract_order_id_from_webhook(event_type, resource)
           case event_type
           when /\ACHECKOUT\.ORDER\./

data/app/presenters/spree/paypal_platform/order_presenter.rb

@@ -18,9 +18,13 @@ module Spree
 
       ##
       # @param order [Spree::Order]
+      # @param amount [Numeric, NilClass] what PayPal should charge; defaults to
+      #   the order total. Less than the total when a gift card or store credit
+      #   pays part of the order.
       #
-      def initialize(order)
+      def initialize(order, amount: nil)
         @order = order
+        @amount = amount
       end
 
       attr_reader :order
@@ -41,15 +45,29 @@ module Spree
       private
 
       def purchase_unit
-        args = {
-          amount: amount_with_breakdown,
-          items: items
-        }
+        # A gift card or store credit pays part of the order, so the breakdown
+        # and items (which always sum to the full order total) can't describe
+        # what PayPal charges. PayPal accepts an amount on its own.
+        args =
+          if partial_charge?
+            { amount: PaypalServerSdk::AmountWithBreakdown.new(currency_code: order.currency.upcase,
+                                                               value: charge_amount.to_s) }
+          else
+            { amount: amount_with_breakdown, items: items }
+          end
         args[:shipping] = shipping_details if shipping_details
 
         PaypalServerSdk::PurchaseUnitRequest.new(**args)
       end
 
+      def charge_amount
+        @amount.presence || order.total
+      end
+
+      def partial_charge?
+        charge_amount.to_d != order.total.to_d
+      end
+
       # NOTE: the breakdown only sends additional (non-included) tax — sending
       # the full tax_total double-counts VAT on tax-inclusive markets and
       # trips AMOUNT_MISMATCH. Do not change to order.tax_total.

data/lib/spree/paypal_platform/version.rb

@@ -3,6 +3,6 @@
 module Spree
   module PaypalPlatform
     # Major version tracks Spree's major version: 5.x supports Spree 5.x.
-    VERSION = '5.1.4'
+    VERSION = '5.1.5'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree-paypal_platform
 version: !ruby/object:Gem::Version
-  version: 5.1.4
+  version: 5.1.5
 platform: ruby
 authors:
 - Aypex
@@ -169,7 +169,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: PayPal Checkout for Spree, including Apple Pay and Card Fields
 test_files: []