spree_doordash 0.1.0

data/app/models/spree_doordash/delivery_mapping.rb

@@ -0,0 +1,27 @@
+module SpreeDoordash
+  # Maps a Spree::Order to the DoorDash delivery it was dispatched to on
+  # acceptance — the DoorDash analog of SpreeSquare::OrderMapping.
+  # external_delivery_id is the accepted quote's id, reused as the
+  # delivery's own id for its whole lifecycle (DoorDash issues no separate
+  # delivery id).
+  class DeliveryMapping < Spree.base_class
+    self.table_name = 'spree_doordash_delivery_mappings'
+
+    belongs_to :order, class_name: 'Spree::Order'
+
+    validates :order, presence: true, uniqueness: true
+    # No presence requirement — mirrors SpreeSquare::OrderMapping's own
+    # square_order_id: DeliveryDispatchJob's dead-letter block does
+    # `find_or_initialize_by(order:).mark_failed!(error)` on a dispatch that
+    # can fail before a delivery (and therefore an external_delivery_id)
+    # ever exists — e.g. no LocationMapping, or the underlying quote itself
+    # failed. allow_nil so two such failed-before-dispatch rows don't
+    # collide on the uniqueness check (nil is a valid, repeatable "no
+    # delivery yet" state, not itself a real id).
+    validates :external_delivery_id, uniqueness: true, allow_nil: true
+
+    def mark_failed!(error)
+      update!(dispatch_error: error.to_s.truncate(2000))
+    end
+  end
+end

data/app/models/spree_doordash/location_mapping.rb

@@ -0,0 +1,16 @@
+module SpreeDoordash
+  # Maps a DoorDash Store (their own Business/Store hierarchy — a Business
+  # owns multiple physical pickup Stores) 1:1 to a Spree::StockLocation.
+  # Structural twin of SpreeSquare::LocationMapping — see that class's own
+  # comment for why restaurant branches map onto Spree's existing
+  # multi-warehouse StockLocation model rather than a bespoke concept.
+  class LocationMapping < Spree.base_class
+    self.table_name = 'spree_doordash_location_mappings'
+
+    belongs_to :stock_location, class_name: 'Spree::StockLocation'
+    belongs_to :store, class_name: 'Spree::Store'
+
+    validates :doordash_store_id, presence: true, uniqueness: true
+    validates :stock_location, presence: true, uniqueness: true
+  end
+end

data/app/models/spree_doordash/quote_mapping.rb

@@ -0,0 +1,20 @@
+module SpreeDoordash
+  # Tracks the most recent DoorDash Drive quote requested for an order,
+  # generated as checkout progresses (see Spree::Calculator::Shipping::
+  # DoordashQuote) and consulted again at order.completed to decide whether
+  # to accept it as-is or re-quote (see SpreeDoordash::DeliveryDispatcher,
+  # M4) — DoorDash quotes are only valid 5 minutes, and checkout can easily
+  # take longer than that.
+  class QuoteMapping < Spree.base_class
+    self.table_name = 'spree_doordash_quote_mappings'
+
+    belongs_to :order, class_name: 'Spree::Order'
+
+    validates :order, presence: true, uniqueness: true
+    validates :external_delivery_id, presence: true, uniqueness: true
+
+    def expired?
+      quote_expires_at.blank? || quote_expires_at <= Time.current
+    end
+  end
+end

data/app/models/spree_doordash/webhook_event.rb

@@ -0,0 +1,36 @@
+module SpreeDoordash
+  # Idempotency + audit log for inbound DoorDash webhook notifications.
+  #
+  # Unlike SpreeSquare::WebhookEvent, there's no single event_id in the
+  # payload to key off — the unique index instead covers
+  # (external_delivery_id, event_name, payload_digest), see the migration
+  # for why each piece is needed. That's what makes DoorDash's documented
+  # up-to-3x redelivery-on-non-200 safe to process without duplicating side
+  # effects.
+  class WebhookEvent < Spree.base_class
+    self.table_name = 'spree_doordash_webhook_events'
+
+    # Ruby-level, not a DB-level `default: {}` on the migration — MySQL
+    # rejects a literal DEFAULT on a JSON column outright (see that
+    # migration's own comment). Works identically on every adapter.
+    attribute :payload, default: -> { {} }
+
+    validates :external_delivery_id, presence: true
+    validates :event_name, presence: true
+    validates :payload_digest, presence: true, uniqueness: { scope: %i[external_delivery_id event_name] }
+
+    scope :pending, -> { where(status: 'pending') }
+
+    def self.digest(raw_body)
+      Digest::SHA256.hexdigest(raw_body)
+    end
+
+    def mark_processed!
+      update!(status: 'processed', processed_at: Time.current)
+    end
+
+    def mark_failed!(error)
+      update!(status: 'failed', processed_at: Time.current, error_message: error.to_s.truncate(1000))
+    end
+  end
+end

data/app/services/spree_doordash/alerting.rb

@@ -0,0 +1,19 @@
+module SpreeDoordash
+  # One place for "this needs a human" — used when a job exhausts its
+  # retries. A standalone copy of SpreeSquare::Alerting's pattern rather
+  # than a dependency on that gem — spree_doordash stays independently
+  # installable on its own. Reports to Sentry when available, always logs
+  # at error level regardless so nothing depends on Sentry being configured
+  # to at least be visible in the server log.
+  class Alerting
+    def self.capture(error, context: {})
+      context = { source: 'spree_doordash' }.merge(context.is_a?(String) ? { area: context } : context)
+
+      Rails.logger.error("[SpreeDoordash] #{context[:area] || 'error'}: #{error.class}: #{error.message}")
+
+      return unless defined?(Sentry)
+
+      Sentry.capture_exception(error, extra: context)
+    end
+  end
+end

data/app/services/spree_doordash/client.rb

@@ -0,0 +1,122 @@
+require 'jwt'
+require 'faraday'
+
+module SpreeDoordash
+  # Thin wrapper around the DoorDash Drive API (v2). All Drive API access in
+  # this extension goes through here.
+  #
+  # Auth is fundamentally different from SpreeSquare::Client: DoorDash Drive
+  # has no OAuth/refresh flow. A static access key (developer_id/key_id/
+  # signing_secret), created once in DoorDash's Developer Portal, signs a
+  # fresh short-lived (5 min) JWT on every call — there's nothing to cache
+  # or refresh, unlike Square's 30-day access token.
+  class Client
+    class MissingCredentialsError < StandardError; end
+
+    BASE_URL = 'https://openapi.doordash.com'.freeze
+    JWT_TTL = 300 # seconds — matches DoorDash's own documented recipe
+
+    # Deliberately NOT memoized, same rationale as SpreeSquare::Client: a
+    # store's credential can be created/edited by an admin mid-process, and
+    # nothing here is expensive enough to cache (a JWT is cheap to sign, and
+    # is only valid 5 minutes anyway).
+    def self.instance
+      for_store
+    end
+
+    def self.for_store(store = Spree::Store.default)
+      new(credential: SpreeDoordash::Credential.find_by(store: store))
+    end
+
+    def initialize(credential: nil)
+      @credential = credential
+      raise MissingCredentialsError, 'No DoorDash credential connected for this store' unless @credential
+    end
+
+    def sandbox?
+      @credential.sandbox?
+    end
+
+    # Validates coverage/pricing for a delivery before formally creating it —
+    # DoorDash's own recommended first call (see docs/how_to/quote_deliveries).
+    # Quotes are valid 5 minutes; accept_quote (M2) formally creates the
+    # delivery.
+    def create_quote(payload)
+      request(:post, '/drive/v2/quotes', payload)
+    end
+
+    # Formally creates the delivery from a still-open quote. Must be called
+    # within 5 minutes of the quote (DoorDash's own documented limit — see
+    # SpreeDoordash::QuoteMapping#expired?). external_delivery_id is reused
+    # as the delivery's own id for its whole lifecycle; DoorDash issues no
+    # separate one (confirmed against
+    # developer.doordash.com/en-US/docs/drive/how_to/quote_deliveries/).
+    def accept_quote(external_delivery_id, tip_cents: nil)
+      body = tip_cents ? { tip: tip_cents } : {}
+      request(:post, "/drive/v2/quotes/#{external_delivery_id}/accept", body)
+    end
+
+    private
+
+    def request(method, path, body = nil)
+      response = connection.send(method) do |req|
+        req.url path
+        req.headers['Authorization'] = "Bearer #{jwt}"
+        req.headers['Content-Type'] = 'application/json'
+        req.body = body.to_json if body
+      end
+      handle_response(response)
+    end
+
+    def connection
+      @connection ||= Faraday.new(url: BASE_URL)
+    end
+
+    def handle_response(response)
+      parsed = response.body.present? ? JSON.parse(response.body) : {}
+      return parsed if response.status.between?(200, 299)
+
+      raise RequestError.new("DoorDash API error (#{response.status}): #{parsed.inspect}", status: response.status, body: parsed)
+    end
+
+    # JWT claims exactly matching DoorDash's own documented recipe —
+    # including `kid` living in the payload/claims rather than the JWT
+    # header, which is non-standard (kid is normally a header parameter)
+    # but is what DoorDash's API actually expects; `dd-ver` is the one true
+    # header field.
+    def jwt
+      now = Time.now.to_i
+      payload = {
+        aud: 'doordash',
+        iss: @credential.developer_id,
+        kid: @credential.key_id,
+        iat: now,
+        exp: now + JWT_TTL
+      }
+      # base64url, NOT standard base64 — confirmed directly against a real
+      # Sandbox 401 ("please make sure... the signing secret was base64url
+      # decoded prior to signing") the first time this was tested live.
+      # DoorDash's own JS tutorial code uses plain `Buffer.from(secret,
+      # 'base64')`, which is misleading/wrong (or Node's 'base64' decoder
+      # happens to be lenient about the url-safe alphabet in a way Ruby's
+      # strict Base64.decode64 is not) — trust the API's own error over the
+      # sample code.
+      key = Base64.urlsafe_decode64(@credential.signing_secret)
+      # `typ: 'JWT'` explicitly — the `jwt` gem (v3.x here) doesn't add it
+      # automatically the way Node's `jsonwebtoken` (DoorDash's own sample
+      # code) does, and DoorDash's validator rejects a JWT with no `typ` at
+      # all rather than treating it as implied.
+      JWT.encode(payload, key, 'HS256', { 'dd-ver' => 'DD-JWT-V1', typ: 'JWT' })
+    end
+  end
+
+  class RequestError < StandardError
+    attr_reader :status, :body
+
+    def initialize(message, status:, body:)
+      super(message)
+      @status = status
+      @body = body
+    end
+  end
+end

data/app/services/spree_doordash/delivery_dispatcher.rb

@@ -0,0 +1,54 @@
+module SpreeDoordash
+  # Dispatches a completed order to DoorDash: accepts its already-open
+  # quote if one exists and hasn't expired, or requests a fresh quote and
+  # accepts that instead. Quotes are only valid 5 minutes (DoorDash's own
+  # limit) — checkout can easily take longer, so by the time an order
+  # actually completes the quote generated during checkout (M3) may already
+  # be stale.
+  class DeliveryDispatcher
+    def self.call(...) = new.call(...)
+
+    def call(order)
+      quote_mapping = quote_mapping_for(order)
+      return nil unless quote_mapping
+
+      client = SpreeDoordash::Client.for_store(order.store || Spree::Store.default)
+      response = client.accept_quote(quote_mapping.external_delivery_id)
+
+      persist_delivery!(order, quote_mapping.external_delivery_id, response)
+    rescue SpreeDoordash::Client::MissingCredentialsError, SpreeDoordash::RequestError => e
+      Rails.logger.error("[SpreeDoordash] dispatch failed for order #{order.number}: #{e.message}")
+      SpreeDoordash::DeliveryMapping.find_or_initialize_by(order: order).mark_failed!(e)
+      SpreeDoordash::Alerting.capture(e, context: { area: 'dispatch', order_number: order.number })
+      nil
+    end
+
+    private
+
+    # A fresh quote (not the order's existing one, if any) — same rationale
+    # as SpreeDoordash::Quote's own external_delivery_id comment: reusing an
+    # id DoorDash has already seen gets rejected. Requesting via the same
+    # Quote service keeps this in one place rather than duplicating
+    # quote-building here.
+    def quote_mapping_for(order)
+      existing = SpreeDoordash::QuoteMapping.find_by(order: order)
+      return existing if existing && !existing.expired?
+
+      SpreeDoordash::Quote.call(order)
+      SpreeDoordash::QuoteMapping.find_by(order: order)
+    end
+
+    def persist_delivery!(order, external_delivery_id, response)
+      mapping = SpreeDoordash::DeliveryMapping.find_or_initialize_by(order: order)
+      mapping.update!(
+        external_delivery_id: external_delivery_id,
+        last_status: response['delivery_status'],
+        tracking_url: response['tracking_url'],
+        dasher_name: response['dasher_name'],
+        dasher_phone: response['dasher_dropoff_phone_number'],
+        raw_response: response
+      )
+      mapping
+    end
+  end
+end

data/app/services/spree_doordash/delivery_status_mapper.rb

@@ -0,0 +1,74 @@
+module SpreeDoordash
+  # Applies a DoorDash delivery webhook event to the mapped Spree order —
+  # the DoorDash analog of SpreeSquare::OrderStatusMapper.
+  #
+  # DoorDash's own event_name vocabulary (verified against
+  # developer.doordash.com/en-US/docs/drive/reference/webhooks/, not
+  # assumed): DASHER_CONFIRMED, DASHER_CONFIRMED_PICKUP_ARRIVAL,
+  # DASHER_PICKED_UP, DASHER_CONFIRMED_DROPOFF_ARRIVAL, DASHER_DROPPED_OFF,
+  # DELIVERY_CANCELLED, plus return-to-pickup-only events
+  # (DELIVERY_RETURN_INITIALIZED, DASHER_CONFIRMED_RETURN_ARRIVAL,
+  # DELIVERY_RETURNED) and DELIVERY_BATCHED for pre-staged batches.
+  #
+  # No version/sequence field exists in DoorDash's payload the way Square's
+  # does, so — like OrderStatusMapper — this doesn't attempt to gate on
+  # ordering. Safety against duplicate delivery instead comes entirely from
+  # WebhookEvent's idempotency key (a genuine redelivery never reaches this
+  # class a second time) and from the state-guarded, idempotent operations
+  # below. DoorDash's own docs note events are sent "as soon as the event
+  # takes place," in the natural lifecycle order, but that ordering
+  # guarantee (or lack of one) across concurrent webhook workers is
+  # unverified until seen live — flagged here rather than assumed, same
+  # precedent as OrderStatusMapper's own comment.
+  class DeliveryStatusMapper
+    SHIP_EVENTS = %w[DASHER_DROPPED_OFF].freeze
+    CANCEL_EVENTS = %w[DELIVERY_CANCELLED].freeze
+    # Real, DoorDash-lifecycle events with no Spree shipment_state
+    # equivalent — recorded as a friendly last_status label only, same
+    # "label vs. state transition" split as OrderStatusMapper's
+    # FULFILLMENT_LABEL_STATES. DELIVERY_RETURNED (the order came back to
+    # the store, never reached the customer) arguably deserves the same
+    # treatment as a cancellation, but is left label-only until this
+    # extension has actually observed one live — not assumed.
+    LABEL_ONLY_EVENTS = %w[
+      DASHER_CONFIRMED DASHER_CONFIRMED_PICKUP_ARRIVAL DASHER_CONFIRMED_DROPOFF_ARRIVAL
+      DELIVERY_RETURN_INITIALIZED DASHER_CONFIRMED_RETURN_ARRIVAL DELIVERY_RETURNED DELIVERY_BATCHED
+    ].freeze
+
+    def self.call(...) = new.call(...)
+
+    def call(payload)
+      mapping = SpreeDoordash::DeliveryMapping.find_by(external_delivery_id: payload['external_delivery_id'])
+      return unless mapping
+
+      event_name = payload['event_name']
+      order = mapping.order
+
+      case event_name
+      when *SHIP_EVENTS
+        ship!(order)
+      when *CANCEL_EVENTS
+        cancel!(order)
+      when *LABEL_ONLY_EVENTS
+        # No Spree-side transition — last_status below is the only effect.
+      end
+
+      mapping.update!(
+        last_status: event_name || mapping.last_status,
+        tracking_url: payload['tracking_url'].presence || mapping.tracking_url,
+        dasher_name: payload['dasher_name'].presence || mapping.dasher_name,
+        dasher_phone: payload['dasher_dropoff_phone_number'].presence || mapping.dasher_phone
+      )
+    end
+
+    private
+
+    def ship!(order)
+      order.shipments.each { |shipment| shipment.ship! if shipment.ready? }
+    end
+
+    def cancel!(order)
+      order.cancel! unless order.canceled?
+    end
+  end
+end

data/app/services/spree_doordash/quote.rb

@@ -0,0 +1,118 @@
+module SpreeDoordash
+  # Requests a live DoorDash Drive delivery-fee quote for an order — the
+  # storefront-facing half of this extension (called from
+  # Spree::Calculator::Shipping::DoordashQuote during checkout, M3) and
+  # again at order.completed if the original quote expired (M4).
+  #
+  # `order.total` at whichever moment this is called is what's sent as
+  # order_value — Spree recalculates on every checkout step already, and
+  # DoorDash isn't in the money path (Spree's own payment method still
+  # charges the customer; DoorDash only uses this for delivery-fee/
+  # insurance math).
+  class Quote
+    Result = Struct.new(:fee_cents, :currency, :external_delivery_id, :expires_at, keyword_init: true)
+
+    def self.call(...) = new.call(...)
+
+    def call(order)
+      location_mapping = location_mapping_for(order)
+      return nil unless location_mapping && order.ship_address
+
+      client = SpreeDoordash::Client.for_store(order.store || Spree::Store.default)
+      # A random suffix per attempt, not just order.number — confirmed live
+      # against a real Sandbox quote: DoorDash rejects a *second*
+      # /drive/v2/quotes call reusing the same external_delivery_id with a
+      # 409 duplicate_delivery_id, even though the first quote is still open
+      # (not yet accepted or expired). Checkout recalculates shipping rates
+      # on essentially every step, so calling this twice for the same order
+      # is the normal case, not an edge case — a stable per-order id made
+      # the DoorDash rate silently vanish (RequestError is rescued below,
+      # same as any other unserviceable-rate case) after the very first
+      # quote. QuoteMapping upserts on order, so only the most recent
+      # attempt's id is kept — the one that matters for accept (M4).
+      external_delivery_id = "spree-doordash-#{order.number}-#{SecureRandom.hex(4)}"
+
+      response = client.create_quote(build_payload(order, location_mapping, external_delivery_id))
+      mapping = persist_quote!(order, external_delivery_id, response)
+
+      Result.new(
+        fee_cents: mapping.quoted_fee_cents,
+        currency: mapping.currency,
+        external_delivery_id: mapping.external_delivery_id,
+        expires_at: mapping.quote_expires_at
+      )
+    rescue SpreeDoordash::Client::MissingCredentialsError, SpreeDoordash::RequestError => e
+      # Unserviceable address, no credential connected, DoorDash-side
+      # rejection — none of these should ever raise into checkout. The
+      # calculator (M3) treats a nil Result as "this rate isn't available",
+      # Spree's normal shape for "can't quote this," same as a carrier
+      # simply not covering an address.
+      Rails.logger.info("[SpreeDoordash] quote skipped for order #{order.number}: #{e.message}")
+      nil
+    end
+
+    private
+
+    def location_mapping_for(order)
+      # Queried directly rather than `order.shipments.first` — creating a
+      # shipment via `Spree::Shipment.create(order: order, ...)` (setting
+      # the FK directly, as spec factories and some checkout code paths do)
+      # doesn't invalidate an already-loaded `order` object's cached
+      # `shipments` association the way `order.shipments.create(...)`
+      # would. Querying fresh here means this is correct regardless of
+      # what the caller already touched on `order`.
+      stock_location = Spree::Shipment.where(order_id: order.id).first&.stock_location ||
+                        Spree::StockLocation.find_by(default: true)
+      return nil unless stock_location
+
+      SpreeDoordash::LocationMapping.find_by(stock_location: stock_location)
+    end
+
+    def build_payload(order, location_mapping, external_delivery_id)
+      {
+        external_delivery_id: external_delivery_id,
+        pickup_address: format_address(location_mapping.stock_location),
+        pickup_business_name: location_mapping.stock_location.name,
+        pickup_phone_number: location_mapping.stock_location.phone.presence || '+10000000000',
+        pickup_instructions: location_mapping.stock_location.pickup_instructions,
+        dropoff_address: format_address(order.ship_address),
+        dropoff_phone_number: order.ship_address.phone.presence || '+10000000000',
+        order_value: (order.total * 100).to_i
+      }
+    end
+
+    # Spree::StockLocation and Spree::Address share the same field shape
+    # (address1/address2/city/state/zipcode/country) even though they're
+    # unrelated classes — DoorDash wants one flat string, not structured
+    # fields.
+    def format_address(record)
+      [
+        record.address1,
+        record.address2,
+        record.city,
+        record.state&.abbr || record.state_name,
+        record.zipcode,
+        record.country&.iso_name
+      ].compact_blank.join(', ')
+    end
+
+    def persist_quote!(order, external_delivery_id, response)
+      mapping = SpreeDoordash::QuoteMapping.find_or_initialize_by(order: order)
+      mapping.update!(
+        external_delivery_id: external_delivery_id,
+        quoted_fee_cents: response['fee'],
+        currency: response['currency'] || 'USD',
+        # DoorDash's own documented quote validity window.
+        quote_expires_at: 5.minutes.from_now,
+        pickup_time_estimated: parse_time(response['pickup_time_estimated']),
+        dropoff_time_estimated: parse_time(response['dropoff_time_estimated']),
+        raw_response: response
+      )
+      mapping
+    end
+
+    def parse_time(value)
+      value.present? ? Time.iso8601(value) : nil
+    end
+  end
+end

data/app/services/spree_doordash/webhook_verifier.rb

@@ -0,0 +1,17 @@
+module SpreeDoordash
+  # Verifies inbound DoorDash webhooks. Architecturally different from
+  # SpreeSquare::WebhookVerifier: DoorDash has no HMAC signing scheme for
+  # webhooks. Per DoorDash's own docs (Configure your webhook in the
+  # Portal): Basic Auth here means "enter the contents you'd like DoorDash
+  # to send in the HTTP Authorization header" — a static string DoorDash
+  # echoes back verbatim on every call, not a credential DoorDash itself
+  # authenticates. Comparison is still constant-time to avoid a timing
+  # oracle on that string.
+  class WebhookVerifier
+    def self.valid?(authorization_header:, expected_token:)
+      return false if authorization_header.blank? || expected_token.blank?
+
+      ActiveSupport::SecurityUtils.secure_compare(authorization_header, expected_token)
+    end
+  end
+end

data/app/subscribers/spree_doordash/order_completed_subscriber.rb

@@ -0,0 +1,29 @@
+module SpreeDoordash
+  # Events & Subscribers is the preferred pattern for this kind of side
+  # effect (per this app's own CLAUDE.md conventions) — react to
+  # order.completed without touching Spree::Order itself. Mirrors
+  # SpreeSquare::OrderCompletedSubscriber's shape exactly; independent of
+  # it — spree_square's own order push (kitchen ticket) still fires for
+  # every order regardless of fulfillment method, DoorDash only decides who
+  # carries it out the door.
+  class OrderCompletedSubscriber < Spree::Subscriber
+    subscribes_to 'order.completed'
+
+    def handle(event)
+      order = Spree::Order.find_by_prefix_id(event.payload['id'])
+      return unless order
+      return unless doordash_delivery?(order)
+
+      SpreeDoordash::DeliveryDispatchJob.perform_later(order.id)
+    end
+
+    private
+
+    # Only dispatch orders actually fulfilled via a "DoorDash Delivery"
+    # shipping method — pickup/other-carrier orders should never reach
+    # DoorDash at all.
+    def doordash_delivery?(order)
+      order.shipments.any? { |shipment| shipment.shipping_method&.calculator.is_a?(Spree::Calculator::Shipping::DoordashQuote) }
+    end
+  end
+end

data/app/views/spree/admin/doordash_credentials/show.html.erb

@@ -0,0 +1,55 @@
+<% content_for :page_title do %>
+  DoorDash Connection
+<% end %>
+
+<div class="card w-full max-w-2xl">
+  <div class="card-header flex items-center justify-between <%= 'bg-green-50' if @credential.persisted? %>">
+    <span class="font-medium">DoorDash Drive</span>
+    <% if @credential.persisted? %>
+      <span class="inline-flex items-center text-xs font-medium text-green-700">
+        <span class="w-1.5 h-1.5 rounded-full bg-green-500 mr-1"></span>
+        Configured
+      </span>
+    <% else %>
+      <span class="inline-flex items-center text-xs font-medium text-gray-500">
+        <span class="w-1.5 h-1.5 rounded-full bg-gray-400 mr-1"></span>
+        Not configured
+      </span>
+    <% end %>
+  </div>
+
+  <%= form_for @credential, url: admin_doordash_credential_path, method: :patch,
+        as: :spree_doordash_credential, html: { class: 'card-body space-y-4' } do |f| %>
+    <p class="text-sm text-gray-600">
+      Create an access key in the
+      <a href="https://developer.doordash.com" target="_blank" rel="noopener" class="text-blue-600 underline">DoorDash Developer Portal</a>
+      and paste its three values below. Stored encrypted — no OAuth redirect needed.
+    </p>
+
+    <div>
+      <%= f.label :doordash_environment, 'Environment', class: 'label' %>
+      <%= f.select :doordash_environment, %w[sandbox production], {}, class: 'select' %>
+    </div>
+    <div>
+      <%= f.label :developer_id, 'Developer ID', class: 'label' %>
+      <%= f.text_field :developer_id, class: 'form-control' %>
+    </div>
+    <div>
+      <%= f.label :key_id, 'Key ID', class: 'label' %>
+      <%= f.text_field :key_id, class: 'form-control' %>
+    </div>
+    <div>
+      <%= f.label :signing_secret, 'Signing Secret', class: 'label' %>
+      <%= f.password_field :signing_secret, value: '', placeholder: (@credential.persisted? ? '••••••••  (leave blank to keep current)' : nil), class: 'form-control' %>
+    </div>
+    <div>
+      <%= f.label :webhook_basic_auth_token, 'Webhook Basic Auth value', class: 'label' %>
+      <%= f.password_field :webhook_basic_auth_token, value: '', placeholder: (@credential.webhook_basic_auth_token.present? ? '••••••••  (leave blank to keep current)' : 'e.g. Basic dGVzdDp0ZXN0'), class: 'form-control' %>
+      <p class="text-xs text-gray-500 mt-1">The exact Authorization header value configured for this store's webhook endpoint in DoorDash's dashboard.</p>
+    </div>
+
+    <div class="card-footer -mx-4 -mb-4">
+      <%= f.submit 'Save', class: 'btn btn-primary' %>
+    </div>
+  <% end %>
+</div>

data/app/views/spree/admin/doordash_delivery_mappings/index.html.erb

@@ -0,0 +1,5 @@
+<% content_for :page_title do %>
+  DoorDash Deliveries
+<% end %>
+
+<%= render_table @collection, :doordash_delivery_mappings %>

data/app/views/spree/admin/doordash_webhook_events/index.html.erb

@@ -0,0 +1,5 @@
+<% content_for :page_title do %>
+  DoorDash Webhook Events
+<% end %>
+
+<%= render_table @collection, :doordash_webhook_events %>

data/config/brakeman.ignore

@@ -0,0 +1,28 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Cross-Site Request Forgery",
+      "warning_code": 86,
+      "fingerprint": "94410153d7554be55a85180f6c1c03417ecd7547075ef01e8c34b9ceb69785c6",
+      "check_name": "ForgerySetting",
+      "message": "`protect_from_forgery` should be configured with `with: :exception`",
+      "file": "app/controllers/spree_doordash/webhooks_controller.rb",
+      "line": 17,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/",
+      "code": "protect_from_forgery(:with => :null_session)",
+      "render_path": null,
+      "location": {
+        "type": "controller",
+        "controller": "SpreeDoordash::WebhooksController"
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        352
+      ],
+      "note": "Intentional, not a false positive to fix: this is a webhook endpoint authenticated by DoorDash's Basic Auth header (SpreeDoordash::WebhookVerifier), not by a Rails session, so there's no session-based state for CSRF to protect in the first place. `:exception` (Brakeman's preferred default) would make every legitimate webhook POST raise ActionController::InvalidAuthenticityToken, since DoorDash never sends a Rails CSRF token — that would break the endpoint entirely, not harden it. `:null_session` is the correct, standard Rails pattern for an unauthenticated-by-session API/webhook endpoint. Same finding, same justification, as the identical pattern in the sibling spree_square gem's own WebhooksController."
+    }
+  ],
+  "updated": "2026-08-13 23:33:31 +0530",
+  "brakeman_version": "8.0.5"
+}