spree_adyen 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: efdb74fe9f9d7848da506be961b930c3b2352d6726a1e5fdf81a160ee1688fc6
-  data.tar.gz: 997de8336c6d59668a1830c576d26778600bf20dcdf79c4307a64b22ee4ab69f
+  metadata.gz: 68dde4ded2953b96ce5ba2b1573fc01d88b596025ad17b2e280eaedf472afd32
+  data.tar.gz: 1c6becb64dbda8435584ff7cf5b506c10da7cd118918a7ce99b4b94d5c05b966
 SHA512:
-  metadata.gz: 9d78966a7463a76cf3dd572d50b09845928be5e6842c30f79cb8139f1c47489cef675c8689ee5b9aaf21a7ec79026d80a081ca8f20e1204ab65f274c5f5f8174
-  data.tar.gz: 90c1367fa54b80f8194252cfe03e19157d38933a6ed64cf6d18e00467ad43c643cf97b9974626bdf814ac250174e8dec89e96088df70317d03b4f287dc23b765
+  metadata.gz: 02db8bc2a625ed1bbe3a96b0b2b976f0551d848f6426bdfb405e331e77dd2ffac1da8576618b1781e0b820b6612dc91f80e70565a54acfa33beecb82fe5bcd01
+  data.tar.gz: b534ff3643c997f65c5d7b71d314a47cda463e7cf17067deeef93bcf8473a6a56900bd4daed197399eb34d7ebb925f89ecce025859a644bfd93aea2b3637bb29

data/app/models/spree/payment_setup_sessions/adyen.rb

@@ -0,0 +1,29 @@
+module Spree
+  class PaymentSetupSessions::Adyen < PaymentSetupSession
+    delegate :preferred_client_key, to: :payment_method
+
+    def adyen_id
+      external_id
+    end
+
+    def session_data
+      external_data&.dig('session_data')
+    end
+
+    def client_key
+      preferred_client_key
+    end
+
+    def channel
+      external_data&.dig('channel') || Spree::PaymentSessions::Adyen::AVAILABLE_CHANNELS[:web]
+    end
+
+    def return_url
+      external_data&.dig('return_url')
+    end
+
+    def successful?
+      status == 'completed'
+    end
+  end
+end

data/app/models/spree_adyen/gateway/payment_setup_sessions.rb

@@ -0,0 +1,168 @@
+module SpreeAdyen
+  class Gateway < ::Spree::Gateway
+    module PaymentSetupSessions
+      extend ActiveSupport::Concern
+
+      def setup_session_supported?
+        true
+      end
+
+      def payment_setup_session_class
+        Spree::PaymentSetupSessions::Adyen
+      end
+
+      # Creates an Adyen zero-auth tokenization session via the Sessions API
+      # and persists a Spree::PaymentSetupSessions::Adyen record.
+      #
+      # @param customer [Spree::User] the customer to vault the payment method for
+      # @param external_data [Hash] additional data (e.g., channel, return_url, currency)
+      # @return [Spree::PaymentSetupSessions::Adyen] the created setup session
+      def create_payment_setup_session(customer:, external_data: {})
+        channel = external_data[:channel] || external_data['channel'] || Spree::PaymentSessions::Adyen::AVAILABLE_CHANNELS[:web]
+        return_url = external_data[:return_url] || external_data['return_url'] || default_setup_return_url
+        currency = external_data[:currency] || external_data['currency']
+
+        response = create_adyen_setup_session(customer, channel, return_url, currency)
+
+        payment_setup_session_class.create!(
+          customer: customer,
+          payment_method: self,
+          status: 'pending',
+          external_id: response.params['id'],
+          external_data: external_data.to_h.stringify_keys.merge(
+            'session_data' => response.params['sessionData'],
+            'channel' => channel,
+            'return_url' => return_url,
+            'shopper_reference' => "customer_#{customer.id}"
+          )
+        )
+      end
+
+      # Completes a setup session by checking with Adyen and creating a payment source
+      # from the stored payment method. Idempotent — if the source was already created
+      # by the AUTHORISATION webhook, returns the session unchanged.
+      #
+      # @param setup_session [Spree::PaymentSetupSessions::Adyen]
+      # @param params [Hash] must include :session_result (or :external_data with :redirect_result)
+      def complete_payment_setup_session(setup_session:, params: {})
+        session_result = params[:session_result] || params['session_result']
+
+        if session_result.blank?
+          external_data = params[:external_data] || params['external_data'] || {}
+          redirect_result = external_data[:redirect_result] || external_data['redirect_result']
+
+          raise Spree::Core::GatewayError, 'session_result or redirect_result is required' if redirect_result.blank?
+
+          return complete_setup_session_from_redirect(setup_session, redirect_result)
+        end
+
+        complete_setup_session_from_result(setup_session, session_result)
+      end
+
+      # Creates a zero-auth tokenization session via Adyen's Sessions API.
+      #
+      # @param customer [Spree::User]
+      # @param channel [String] Web, iOS, Android
+      # @param return_url [String]
+      # @param currency [String, nil] defaults to USD
+      # @return [Spree::PaymentResponse]
+      def create_adyen_setup_session(customer, channel, return_url, currency = nil)
+        payload = SpreeAdyen::PaymentSetupSessions::RequestPayloadPresenter.new(
+          customer: customer,
+          merchant_account: preferred_merchant_account,
+          payment_method: self,
+          channel: channel,
+          return_url: return_url,
+          currency: currency
+        ).to_h
+
+        response = send_request do
+          client.checkout.payments_api.sessions(payload, headers: { 'Idempotency-Key' => SecureRandom.uuid })
+        end
+        response_body = response.response
+
+        if response.status.to_i == 201
+          success(response_body.id, response_body)
+        else
+          failure(response_body.slice('pspReference', 'message').values.join(' - '))
+        end
+      end
+
+      private
+
+      def complete_setup_session_from_result(setup_session, session_result)
+        response = payment_session_result(setup_session.external_id, session_result)
+        raise Spree::Core::GatewayError, response.message.presence || 'Adyen session result failed' unless response.success?
+
+        status = response.params['status']
+        raise Spree::Core::GatewayError, 'Adyen session result missing status' if status.blank?
+
+        process_setup_session_status(setup_session, status, response.params)
+      end
+
+      def complete_setup_session_from_redirect(setup_session, redirect_result)
+        response = send_request do
+          client.checkout.payments_api.payments_details({ details: { redirectResult: redirect_result } })
+        end
+
+        raise Spree::Core::GatewayError, "Adyen /payments/details returned #{response.status}" if response.status.to_i != 200
+
+        result_code = response.response&.dig('resultCode')
+        raise Spree::Core::GatewayError, 'Adyen /payments/details response missing resultCode' if result_code.blank?
+
+        status = case result_code
+                 when 'Authorised' then 'completed'
+                 when 'Pending', 'Received' then 'paymentPending'
+                 when 'Cancelled' then 'canceled'
+                 when 'Refused', 'Error' then 'refused'
+                 else result_code
+                 end
+        process_setup_session_status(setup_session, status, response.response || {})
+      end
+
+      def process_setup_session_status(setup_session, status, response_params)
+        case status
+        when 'completed'
+          create_source_from_session_result(setup_session, response_params)
+          setup_session.complete if setup_session.can_complete?
+        when 'canceled'
+          setup_session.cancel if setup_session.can_cancel?
+        when 'refused', 'expired'
+          setup_session.fail if setup_session.can_fail?
+        when 'paymentPending'
+          setup_session.process if setup_session.can_process?
+        else
+          Rails.error.unexpected(
+            'Unexpected Adyen setup session status',
+            context: { setup_session_id: setup_session.id, status: status },
+            source: 'spree_adyen'
+          )
+        end
+
+        setup_session
+      end
+
+      # Creates a payment source from the Adyen Sessions result payload.
+      # Card details (last4/expiry) may be missing — they are backfilled by the
+      # AUTHORISATION webhook via SpreeAdyen::PaymentSetupSessions::HandleAuthorisation.
+      # Idempotent: if the webhook already created the source, this is a no-op.
+      def create_source_from_session_result(setup_session, response_params)
+        return if setup_session.payment_source.present?
+
+        source = SpreeAdyen::PaymentSetupSessions::CreateSourceFromResult.new(
+          setup_session: setup_session,
+          response_params: response_params
+        ).call
+
+        setup_session.update!(payment_source: source) if source.present?
+      end
+
+      def default_setup_return_url
+        store = stores.first
+        return nil unless store
+
+        "#{store.storefront_url}/adyen/payment_setup_sessions/redirect"
+      end
+    end
+  end
+end

data/app/models/spree_adyen/gateway.rb

@@ -1,6 +1,7 @@
 module SpreeAdyen
   class Gateway < ::Spree::Gateway
     include PaymentSessions
+    include PaymentSetupSessions
 
     CAPTURE_PSP_REFERENCE_METAFIELD_KEY = 'adyen.capture_psp_reference'.freeze
     CANCELLATION_PSP_REFERENCE_METAFIELD_KEY = 'adyen.cancellation_psp_reference'.freeze
@@ -224,10 +225,17 @@ module SpreeAdyen
         raise Spree::PaymentMethod::WebhookSignatureError, 'Invalid HMAC signature'
       end
 
-      # Find payment session — scoped to this gateway
-      payment_session = event.session_id.present? ?
-        Spree::PaymentSessions::Adyen.find_by(payment_method: self, external_id: event.session_id) : nil
+      return nil if event.session_id.blank?
 
+      # Setup sessions (zero-auth tokenization) are processed inline here — they don't
+      # fit core's payment-session webhook dispatch shape and there is no order to complete.
+      setup_session = Spree::PaymentSetupSessions::Adyen.find_by(payment_method: self, external_id: event.session_id)
+      if setup_session
+        SpreeAdyen::PaymentSetupSessions::HandleAuthorisation.new(setup_session: setup_session, event: event).call if event.code == 'AUTHORISATION'
+        return nil
+      end
+
+      payment_session = Spree::PaymentSessions::Adyen.find_by(payment_method: self, external_id: event.session_id)
       return nil unless payment_session
 
       case event.code

data/app/presenters/spree_adyen/payment_setup_sessions/request_payload_presenter.rb

@@ -0,0 +1,81 @@
+module SpreeAdyen
+  module PaymentSetupSessions
+    # Builds the payload for a zero-auth (tokenization-only) Adyen Sessions API request.
+    # Used to vault a payment method without charging the customer — Adyen returns an
+    # AUTHORISATION webhook with the stored payment method ID in additionalData.
+    class RequestPayloadPresenter
+      DEFAULT_PARAMS = {
+        recurringProcessingModel: 'UnscheduledCardOnFile',
+        shopperInteraction: 'Ecommerce',
+        storePaymentMethodMode: 'enabled'
+      }.freeze
+
+      DEFAULT_CURRENCY = 'USD'.freeze
+
+      def initialize(customer:, merchant_account:, payment_method:, channel:, return_url:, currency: nil)
+        @customer = customer
+        @merchant_account = merchant_account
+        @payment_method = payment_method
+        @channel = channel
+        @return_url = return_url
+        @currency = currency || DEFAULT_CURRENCY
+      end
+
+      def to_h
+        {
+          metadata: {
+            spree_payment_method_id: payment_method.id,
+            spree_setup_session: true
+          },
+          amount: {
+            value: 0,
+            currency: currency
+          },
+          returnUrl: return_url,
+          reference: reference,
+          merchantAccount: merchant_account,
+          expiresAt: expires_at
+        }.merge!(shopper_details, DEFAULT_PARAMS, channel_params, SpreeAdyen::ApplicationInfoPresenter.new.to_h)
+      end
+
+      private
+
+      attr_reader :customer, :merchant_account, :payment_method, :channel, :return_url, :currency
+
+      # Format: SETUP_<payment_method_id>_<unique_guard>
+      # Mirrors the order-tied reference convention used in PaymentSessions::RequestPayloadPresenter,
+      # but uses a SETUP prefix because there is no order to anchor against.
+      def reference
+        ['SETUP', payment_method.id, SecureRandom.hex(6)].join('_')
+      end
+
+      def channel_params
+        case channel
+        when 'iOS'
+          { blockedPaymentMethods: ['googlepay'], channel: 'iOS' }
+        when 'Android'
+          { blockedPaymentMethods: ['applepay'], channel: 'Android' }
+        when 'Web'
+          { channel: 'Web' }
+        else
+          {}
+        end
+      end
+
+      def shopper_details
+        {
+          shopperName: {
+            firstName: customer.first_name,
+            lastName: customer.last_name
+          }.compact,
+          shopperEmail: customer.email,
+          shopperReference: "customer_#{customer.id}"
+        }
+      end
+
+      def expires_at
+        SpreeAdyen::Config.payment_session_expiration_in_minutes.minutes.from_now.iso8601
+      end
+    end
+  end
+end

data/app/services/spree_adyen/payment_setup_sessions/create_source_from_result.rb

@@ -0,0 +1,71 @@
+module SpreeAdyen
+  module PaymentSetupSessions
+    # Creates a payment source from an Adyen Sessions result payload (the synchronous
+    # complete-session response, not a webhook). Cards may be missing last4/expiry —
+    # those are backfilled by the AUTHORISATION webhook handler.
+    class CreateSourceFromResult
+      def initialize(setup_session:, response_params:)
+        @setup_session = setup_session
+        @response_params = response_params.to_h.with_indifferent_access
+      end
+
+      def call
+        return nil if stored_payment_method_id.blank?
+
+        if credit_card_brand?
+          find_or_create_credit_card
+        else
+          find_or_create_alternative_source
+        end
+      end
+
+      private
+
+      attr_reader :setup_session, :response_params
+
+      delegate :payment_method, :customer, to: :setup_session
+
+      def additional_data
+        @additional_data ||= response_params.fetch('additionalData', {})
+      end
+
+      def stored_payment_method_id
+        additional_data['tokenization.storedPaymentMethodId'] ||
+          additional_data['recurring.recurringDetailReference']
+      end
+
+      def payment_method_reference
+        @payment_method_reference ||= additional_data['paymentMethod']&.to_sym
+      end
+
+      def credit_card_brand?
+        payment_method_reference.present? &&
+          payment_method_reference.in?(SpreeAdyen::Config.credit_card_sources)
+      end
+
+      def find_or_create_credit_card
+        payment_method.credit_cards.capturable.find_or_create_by(
+          gateway_payment_profile_id: stored_payment_method_id
+        ) do |cc|
+          cc.user = customer
+          cc.payment_method = payment_method
+          cc.cc_type = SpreeAdyen::Webhooks::CreditCardPresenter::CREDIT_CARD_BRANDS.fetch(
+            payment_method_reference.to_s, payment_method_reference.to_s
+          )
+        end
+      end
+
+      def find_or_create_alternative_source
+        source_klass = SpreeAdyen::Webhooks::Actions::CreateSource::SOURCE_KLASS_MAP[payment_method_reference] ||
+                       SpreeAdyen::PaymentSources::Unknown
+
+        source_klass.find_or_create_by(
+          gateway_payment_profile_id: stored_payment_method_id,
+          payment_method: payment_method
+        ) do |source|
+          source.user = customer
+        end
+      end
+    end
+  end
+end

data/app/services/spree_adyen/payment_setup_sessions/handle_authorisation.rb

@@ -0,0 +1,48 @@
+module SpreeAdyen
+  module PaymentSetupSessions
+    # Processes an AUTHORISATION webhook for a zero-auth (tokenization-only) setup session.
+    # Creates the payment source from the stored payment method ID and transitions the
+    # session. Idempotent — safe to invoke for retries.
+    class HandleAuthorisation
+      def initialize(setup_session:, event:)
+        @setup_session = setup_session
+        @event = event
+        @gateway = setup_session.payment_method
+        @user = setup_session.customer
+      end
+
+      def call
+        return setup_session if setup_session.completed?
+
+        Rails.logger.info("[SpreeAdyen][setup_session=#{setup_session.id}][#{event.psp_reference}]: Processing setup authorisation")
+
+        if event.success?
+          handle_success
+        else
+          handle_failure
+        end
+
+        setup_session
+      end
+
+      private
+
+      attr_reader :setup_session, :event, :gateway, :user
+
+      def handle_success
+        source = SpreeAdyen::Webhooks::Actions::CreateSource.new(
+          event: event,
+          payment_method: gateway,
+          user: user
+        ).call
+
+        setup_session.update!(payment_source: source) if source.present?
+        setup_session.complete if setup_session.can_complete?
+      end
+
+      def handle_failure
+        setup_session.fail if setup_session.can_fail?
+      end
+    end
+  end
+end

data/lib/spree_adyen/testing_support/factories/payment_setup_session_factory.rb

@@ -0,0 +1,15 @@
+FactoryBot.define do
+  factory :adyen_payment_setup_session, class: 'Spree::PaymentSetupSessions::Adyen' do
+    sequence(:external_id) { |n| "CS_setup_#{n}" }
+    status { 'pending' }
+    payment_method { create(:adyen_gateway) }
+    customer factory: :user
+
+    external_data do
+      {
+        'session_data' => 'a very long session data string',
+        'channel' => 'Web'
+      }
+    end
+  end
+end

data/lib/spree_adyen/version.rb

@@ -1,5 +1,5 @@
 module SpreeAdyen
-  VERSION = '0.10.0'.freeze
+  VERSION = '0.11.0'.freeze
 
   def gem_version
     Gem::Version.new(VERSION)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_adyen
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Vendo Connect Inc., Vendo Sp. z o.o.
@@ -150,10 +150,12 @@ files:
 - app/jobs/spree_adyen/webhooks/process_cancellation_event_job.rb
 - app/jobs/spree_adyen/webhooks/process_capture_event_job.rb
 - app/models/spree/payment_sessions/adyen.rb
+- app/models/spree/payment_setup_sessions/adyen.rb
 - app/models/spree_adyen/base.rb
 - app/models/spree_adyen/custom_domain_decorator.rb
 - app/models/spree_adyen/gateway.rb
 - app/models/spree_adyen/gateway/payment_sessions.rb
+- app/models/spree_adyen/gateway/payment_setup_sessions.rb
 - app/models/spree_adyen/order_decorator.rb
 - app/models/spree_adyen/payment_decorator.rb
 - app/models/spree_adyen/payment_method_decorator.rb
@@ -225,6 +227,7 @@ files:
 - app/presenters/spree_adyen/capture_payload_presenter.rb
 - app/presenters/spree_adyen/checkout_presenter.rb
 - app/presenters/spree_adyen/payment_sessions/request_payload_presenter.rb
+- app/presenters/spree_adyen/payment_setup_sessions/request_payload_presenter.rb
 - app/presenters/spree_adyen/payments/request_payload_presenter.rb
 - app/presenters/spree_adyen/refund_payload_presenter.rb
 - app/presenters/spree_adyen/webhook_payload_presenter.rb
@@ -234,6 +237,8 @@ files:
 - app/services/spree_adyen/gateways/configure.rb
 - app/services/spree_adyen/payment_sessions/find_or_create.rb
 - app/services/spree_adyen/payment_sessions/process_with_result.rb
+- app/services/spree_adyen/payment_setup_sessions/create_source_from_result.rb
+- app/services/spree_adyen/payment_setup_sessions/handle_authorisation.rb
 - app/services/spree_adyen/webhooks/actions/create_source.rb
 - app/services/spree_adyen/webhooks/actions/find_or_create_credit_card.rb
 - app/services/spree_adyen/webhooks/event.rb
@@ -266,6 +271,7 @@ files:
 - lib/spree_adyen/factories.rb
 - lib/spree_adyen/testing_support/factories/gateway_factory.rb
 - lib/spree_adyen/testing_support/factories/payment_session_factory.rb
+- lib/spree_adyen/testing_support/factories/payment_setup_session_factory.rb
 - lib/spree_adyen/version.rb
 - lib/spree_api_v2/spree/api/v2/storefront/adyen/base_controller.rb
 - lib/spree_api_v2/spree/api/v2/storefront/adyen/payment_sessions_controller.rb
@@ -277,9 +283,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/spree/spree_adyen/issues
-  changelog_uri: https://github.com/spree/spree_adyen/releases/tag/v0.10.0
+  changelog_uri: https://github.com/spree/spree_adyen/releases/tag/v0.11.0
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree_adyen/tree/v0.10.0
+  source_code_uri: https://github.com/spree/spree_adyen/tree/v0.11.0
 rdoc_options: []
 require_paths:
 - lib