spree_gmo_pg 1.0.0

data/app/views/spree/checkout/payment/_gmo_pg.html.erb

@@ -0,0 +1,154 @@
+<% if @order.state == 'confirm' %>
+  <!-- 確認画面: カード情報の確認表示のみ -->
+  <% payment = @order.payments.valid.last %>
+  <% if payment&.source %>
+    <div class="payment-summary p-3 border rounded text-sm">
+      <%= payment.source.cc_type.upcase %> **** <%= payment.source.last_digits %>
+      (<%= payment.source.month %>/<%= payment.source.year %>)
+    </div>
+  <% end %>
+<% else %>
+  <!-- 支払い方法選択画面: 既存のフォーム表示 -->
+  <div class="payment-gateway"
+       data-controller="card-validation gmo-pg-payment"
+       data-gmo-pg-payment-shop-id-value="<%= payment_method.preferred_shop_id %>"
+       data-gmo-pg-payment-test-mode-value="<%= payment_method.preferred_test_mode %>"
+       data-gmo-pg-payment-error-messages-value="<%= {
+         'E01' => Spree.t('gmo_pg.errors.invalid_card_info'),
+         'E11' => Spree.t('gmo_pg.errors.card_declined'),
+         'E61' => Spree.t('gmo_pg.errors.invalid_security_code'),
+         'E91' => Spree.t('gmo_pg.errors.processing_error'),
+         '201' => Spree.t('gmo_pg.errors.invalid_card_number'),
+         'default' => Spree.t('gmo_pg.errors.token_acquisition_failed')
+       }.to_json %>">
+
+    <% param_prefix = "payment_source[#{payment_method.id}]" %>
+
+    <!-- エラーメッセージ表示エリア -->
+    <div class="alert alert-danger"
+         style="display: none;"
+         data-gmo-pg-payment-target="errorContainer"
+         role="alert">
+    </div>
+
+    <% if @order.user && @order.user.payment_sources.where(payment_method: payment_method).any? %>
+      <%= turbo_frame_tag "saved-cards-#{payment_method.id}" do %>
+        <%= render 'spree/checkout/payment/saved_cards',
+                   payment_method: payment_method,
+                   payment_sources: @order.user.payment_sources.where(payment_method: payment_method) %>
+      <% end %>
+
+      <div class="or-divider mt-3 mb-3">
+        <%= radio_button_tag "order[existing_card]", "", true,
+            data: {
+              gmo_pg_payment_target: "newCardRadio",
+              action: "change->gmo-pg-payment#handleCardSelection"
+            },
+            class: "mr-2"
+        %>
+        <label class="text-sm"><%= Spree.t('gmo_pg.or_enter_new_card') %></label>
+      </div>
+    <% end %>
+
+    <div data-gmo-pg-payment-target="newCardForm" class="payment-gateway-fields">
+      <!-- カード名義人 -->
+      <div class="form-group mb-3">
+        <label for="name_on_card_<%= payment_method.id %>" class="block text-xs text-neutral-600 mb-1">
+          <%= Spree.t(:name_on_card) %>
+        </label>
+        <%= text_field_tag "#{param_prefix}[name]", '',
+            id: "name_on_card_#{payment_method.id}",
+            data: { gmo_pg_payment_target: "nameInput" },
+            placeholder: Spree.t(:name_on_card),
+            class: 'text-input w-full',
+            required: true
+        %>
+      </div>
+
+      <!-- カード番号 (card-validationが自動フォーマット) -->
+      <div class="form-group mb-3 relative">
+        <label for="card_number_<%= payment_method.id %>" class="block text-xs text-neutral-600 mb-1">
+          <%= Spree.t(:card_number) %>
+        </label>
+        <%= text_field_tag "#{param_prefix}[number]", '',
+            id: "card_number_#{payment_method.id}",
+            data: {
+              card_validation_target: "number",
+              gmo_pg_payment_target: "numberInput"
+            },
+            maxlength: 19,
+            autocomplete: "off",
+            placeholder: Spree.t(:card_number),
+            class: 'text-input w-full pr-10',
+            required: true
+        %>
+        <div class="absolute right-2 top-7"
+             data-card-validation-target="typeContainer"
+             id="credit-card-type-container-<%= payment_method.id %>">
+        </div>
+      </div>
+
+      <div class="flex gap-3">
+        <!-- 有効期限 (card-validationがMM/YYYYフォーマット) -->
+        <div class="form-group">
+          <label for="card_expiry_<%= payment_method.id %>" class="block text-xs text-neutral-600 mb-1">
+            <%= Spree.t(:expiration_date) %>
+          </label>
+          <%= text_field_tag "#{param_prefix}[expiry]", '',
+              id: "card_expiry_#{payment_method.id}",
+              class: 'text-input',
+              data: {
+                card_validation_target: "expiry",
+                gmo_pg_payment_target: "expiryInput"
+              },
+              placeholder: Spree.t(:card_expiration_placeholder),
+              required: true
+          %>
+        </div>
+
+        <!-- CVV (card-validationが桁数調整) -->
+        <div class="form-group">
+          <label for="card_code_<%= payment_method.id %>" class="block text-xs text-neutral-600 mb-1">
+            <%= Spree.t(:cvv) %>
+          </label>
+          <%= text_field_tag "#{param_prefix}[verification_value]", '',
+              id: "card_code_#{payment_method.id}",
+              class: 'text-input',
+              data: {
+                card_validation_target: "cvv",
+                gmo_pg_payment_target: "cvvInput"
+              },
+              maxlength: 4,
+              pattern: '[0-9]*',
+              inputmode: 'numeric',
+              placeholder: Spree.t(:cvv),
+              required: true
+          %>
+        </div>
+      </div>
+
+      <!-- トークン格納用 (GMO-PGトークン) -->
+      <%= hidden_field_tag "#{param_prefix}[gateway_payment_profile_id]", '',
+          data: { gmo_pg_payment_target: "token" }
+      %>
+
+      <!-- マスク済みカード番号格納用 -->
+      <%= hidden_field_tag "#{param_prefix}[last_digits]", '',
+          data: { gmo_pg_payment_target: "maskedCard" }
+      %>
+
+      <!-- カードタイプ -->
+      <%= hidden_field_tag "#{param_prefix}[cc_type]", '',
+          id: "cc_type_#{payment_method.id}",
+          data: { card_validation_target: "ccType" }
+      %>
+
+      <!-- カードアイコン(card-validationが自動表示) -->
+      <% credit_card_icons.each do |card| %>
+        <div id="credit-card-icon-<%= card %>" class="hidden">
+          <%= payment_method_icon_tag card, height: 32 %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+<% end %>

data/app/views/spree/checkout/payment/_saved_cards.html.erb

@@ -0,0 +1,36 @@
+<div class="saved-cards mb-4">
+  <% if payment_sources.any? %>
+    <h3 class="text-sm font-semibold mb-2"><%= Spree.t('gmo_pg.saved_cards') %></h3>
+
+    <% payment_sources.each do |card| %>
+      <div class="saved-card-item mb-2 p-3 border rounded flex items-center justify-between">
+        <label class="flex items-center flex-1 cursor-pointer">
+          <%= radio_button_tag "order[existing_card]", card.id, false,
+              data: {
+                gmo_pg_payment_target: "existingCardRadio",
+                action: "change->gmo-pg-payment#handleCardSelection"
+              },
+              class: "mr-2"
+          %>
+          <span class="text-sm">
+            <%= card.cc_type.upcase %> **** <%= card.last_digits %>
+            (<%= card.month %>/<%= card.year %>)
+          </span>
+        </label>
+
+        <%= button_tag Spree.t('gmo_pg.delete_card'),
+            type: 'button',
+            class: 'btn-sm btn-danger ml-2',
+            data: {
+              turbo_method: :delete,
+              turbo_frame: "saved-cards-#{payment_method.id}",
+              turbo_confirm: Spree.t('gmo_pg.delete_card_confirm'),
+              action: 'click->gmo-pg-payment#deleteCard',
+              url: spree.payment_source_path(card)
+            } %>
+      </div>
+    <% end %>
+  <% else %>
+    <p class="text-sm text-gray-500"><%= Spree.t('gmo_pg.no_saved_cards') %></p>
+  <% end %>
+</div>

data/app/views/spree/gmo_pg_callback/callback.html.erb

@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>決済処理中...</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      display: flex;
+      justify-content: center;
+      align-items: center;
+      height: 100vh;
+      margin: 0;
+      background-color: #f5f5f5;
+    }
+    .loading {
+      text-align: center;
+    }
+    .spinner {
+      border: 4px solid #f3f3f3;
+      border-top: 4px solid #3498db;
+      border-radius: 50%;
+      width: 40px;
+      height: 40px;
+      animation: spin 1s linear infinite;
+      margin: 0 auto 20px;
+    }
+    @keyframes spin {
+      0% { transform: rotate(0deg); }
+      100% { transform: rotate(360deg); }
+    }
+  </style>
+</head>
+<body>
+  <div class="loading">
+    <div class="spinner"></div>
+    <p>決済処理中です。しばらくお待ちください...</p>
+  </div>
+
+  <%= form_tag spree.update_checkout_path(state: @order.state, token: @order.token),
+               method: :patch,
+               id: 'gmo_pg_callback_form' do %>
+    <!-- 必要に応じてパラメータ追加 -->
+  <% end %>
+
+  <script>
+    // 自動的にフォームをサブミット
+    document.getElementById('gmo_pg_callback_form').submit();
+  </script>
+</body>
+</html>

data/app/views/spree/shared/_error.html.erb

@@ -0,0 +1,3 @@
+<div class="alert alert-danger text-center mb-4 p-3" role="alert">
+  <p class="mb-0"><%= local_assigns[:message] || Spree.t('error') %></p>
+</div>

data/config/importmap.rb

@@ -0,0 +1,9 @@
+# Stimulusコントローラーエントリーポイント
+pin 'spree_gmo_pg', to: 'spree_gmo_pg/index.js', preload: true
+
+# Stimulusコントローラー
+# Engine.rootは初期化時に使えないため、__dir__を使用
+pin_all_from File.expand_path('../app/javascript/spree_gmo_pg/controllers', __dir__),
+             under: 'spree_gmo_pg/controllers',
+             to: 'spree_gmo_pg/controllers',
+             preload: false

data/config/locales/en.yml

@@ -0,0 +1,29 @@
+en:
+  spree:
+    gmo_pg:
+      api_credentials: "API Credentials"
+      settings: "Settings"
+      shop_id: "Shop ID"
+      shop_id_hint: "Enter the Shop ID issued by GMO-PG"
+      shop_pass: "Shop Password"
+      shop_pass_hint: "Enter the Shop Password issued by GMO-PG"
+      site_id: "Site ID"
+      site_id_hint: "Enter the Site ID issued by GMO-PG (required for member management)"
+      site_pass: "Site Password"
+      site_pass_hint: "Enter the Site Password issued by GMO-PG (required for member management)"
+      test_mode: "Test Mode"
+      test_mode_hint: "Check this to connect to the test environment (pt01.mul-pay.jp). Make sure to turn this off in production"
+      saved_cards: "Saved Cards"
+      or_enter_new_card: "Or enter a new card"
+      delete_card: "Delete"
+      delete_card_confirm: "Are you sure you want to delete this card?"
+      card_deleted: "Card has been deleted"
+      unauthorized: "You are not authorized to delete this card"
+      no_saved_cards: "No saved cards"
+      errors:
+        token_acquisition_failed: "An error occurred while processing card information"
+        invalid_card_info: "Card information is invalid"
+        card_declined: "This card cannot be used"
+        invalid_security_code: "Security code is invalid"
+        processing_error: "An error occurred during processing"
+        invalid_card_number: "Card number is invalid"

data/config/locales/ja.yml

@@ -0,0 +1,29 @@
+ja:
+  spree:
+    gmo_pg:
+      api_credentials: "API認証情報"
+      settings: "動作設定"
+      shop_id: "ショップID"
+      shop_id_hint: "GMO-PGから発行されたショップIDを入力してください"
+      shop_pass: "ショップパスワード"
+      shop_pass_hint: "GMO-PGから発行されたショップパスワードを入力してください"
+      site_id: "サイトID"
+      site_id_hint: "GMO-PGから発行されたサイトIDを入力してください（会員管理機能利用時）"
+      site_pass: "サイトパスワード"
+      site_pass_hint: "GMO-PGから発行されたサイトパスワードを入力してください（会員管理機能利用時）"
+      test_mode: "テストモード"
+      test_mode_hint: "チェックを入れるとテスト環境（pt01.mul-pay.jp）に接続します。本番環境では必ずオフにしてください"
+      saved_cards: "登録済みのカード"
+      or_enter_new_card: "または新規カードを入力"
+      delete_card: "削除"
+      delete_card_confirm: "このカードを削除してもよろしいですか?"
+      card_deleted: "カードを削除しました"
+      unauthorized: "このカードを削除する権限がありません"
+      no_saved_cards: "登録済みのカードはありません"
+      errors:
+        token_acquisition_failed: "カード情報の処理中にエラーが発生しました"
+        invalid_card_info: "カード情報が正しくありません"
+        card_declined: "このカードはご利用いただけません"
+        invalid_security_code: "セキュリティコードが正しくありません"
+        processing_error: "処理中にエラーが発生しました"
+        invalid_card_number: "カード番号が正しくありません"

data/config/routes.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+Spree::Core::Engine.routes.draw do
+  resources :payment_sources, only: [ :destroy ]
+
+  # 3DSコールバックエンドポイント
+  # GMO-PGのCallbackType=3（GET方式）に対応
+  # GET方式はSameSite=Lax cookieが送信されるため、セッション維持が可能
+  get '/gmo_pg/3ds_callback', to: 'gmo_pg_callback#callback', as: :gmo_pg_3ds_callback
+end

data/lib/spree/payment_redirect_required.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Spree
+  # 3DS認証リダイレクトが必要な場合に投げる例外
+  # StandardErrorではなくExceptionから継承することで、
+  # state_machineのrescue StandardErrorをバイパスする
+  class PaymentRedirectRequired < Exception
+    attr_reader :redirect_url, :payment, :gmo_pg_data
+
+    # @param redirect_url [String] 3DS認証のリダイレクト先URL
+    # @param payment [Spree::Payment] 対象の決済
+    # @param gmo_pg_data [Hash] コールバックでの再処理に必要な access_id / access_pass 等
+    #   この例外は process_payments! の with_lock トランザクション内で raise されるため、
+    #   そこで metadata を save してもロールバックで消えてしまう。トランザクション外
+    #   (CheckoutController の rescue)で永続化できるよう、必要情報を例外に積んで渡す。
+    def initialize(redirect_url, payment: nil, gmo_pg_data: nil)
+      @redirect_url = redirect_url
+      @payment = payment
+      @gmo_pg_data = gmo_pg_data
+      super("Payment redirect required: #{redirect_url}")
+    end
+  end
+end

data/lib/spree_gmo_pg/engine.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module SpreeGmoPg
+  class Engine < Rails::Engine
+    require 'spree/core'
+    isolate_namespace Spree
+    engine_name 'spree_gmo_pg'
+
+    # Decoratorの読み込み
+    def self.activate
+      Dir.glob(File.join(File.dirname(__FILE__), '../../app/**/*_decorator*.rb')) do |c|
+        Rails.configuration.cache_classes ? require(c) : load(c)
+      end
+    end
+
+    # Zeitwerk対応（overridesの除外）
+    initializer 'spree_gmo_pg.autoloader' do |app|
+      if Rails.autoloaders.zeitwerk_enabled?
+        Rails.autoloaders.main.ignore("#{root}/app/overrides")
+      end
+    end
+
+    # アセットパスの追加
+    initializer 'spree_gmo_pg.assets' do |app|
+      app.config.assets.paths << root.join('app/javascript')
+      app.config.assets.precompile += %w[spree_gmo_pg_manifest]
+    end
+
+    # importmapの読み込み
+    initializer 'spree_gmo_pg.importmap', before: 'importmap' do |app|
+      if defined?(Importmap)
+        app.config.importmap.paths << root.join('config/importmap.rb')
+        app.config.importmap.cache_sweepers << root.join('app/javascript')
+      end
+    end
+
+    # 決済方法の登録
+    config.after_initialize do |app|
+      app.config.spree.payment_methods << Spree::PaymentMethod::GmoPg
+    end
+
+    config.to_prepare(&method(:activate).to_proc)
+  end
+end

data/lib/spree_gmo_pg/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module SpreeGmoPg
+  VERSION = '1.0.0'
+end

data/lib/spree_gmo_pg.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'spree_core'
+require 'deface'
+
+# Spree::PaymentMethod::GmoPg はクラス本体で Spree::PaymentMethod::AutoCaptureDigitalConcern を
+# include し（= クラス定義の評価時点で解決できていなければならない）、provider_class で
+# ActiveMerchant::Billing::GmoPgGateway を返す。後者を定義するのは active_merchant_gmo_pg の
+# lib エントリなので、gemspec の add_dependency だけでは足りずここで require する必要がある。
+# @see https://github.com/be-agile/giga-repeat/issues/1307
+require 'active_merchant_gmo_pg'
+require 'spree_auto_capture_digital'
+
+require 'spree_gmo_pg/version'
+require 'spree_gmo_pg/engine'
+require 'spree/payment_redirect_required'

data/spec/controllers/spree/gmo_pg_callback_controller_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Spree::GmoPgCallbackController, type: :controller do
+  routes { Spree::Core::Engine.routes }
+
+  describe "GET #callback" do
+    let(:order) { create(:order, token: 'test_token_123') }
+    let(:payment_method) { create(:payment_method_gmo_pg) }
+    let(:credit_card) { create(:credit_card, user: nil) }
+    let(:payment) { create(:payment, order: order, payment_method: payment_method, source: credit_card) }
+
+    context "Order が見つかる場合" do
+      before do
+        payment.update!(private_metadata: { gmo_pg: { access_id: 'stored_access_id', access_pass: 'stored_access_pass' } })
+      end
+
+      it "ビューをレンダリングする" do
+        get :callback, params: { token: order.token, AccessID: 'stored_access_id' }
+
+        expect(response).to have_http_status(:success)
+        expect(response).to render_template(:callback)
+        expect(assigns(:order)).to eq(order)
+      end
+    end
+
+    context "Order が見つからない場合" do
+      it "root_path にリダイレクトする" do
+        get :callback, params: { token: 'invalid_token', AccessID: 'test_access_id', AccessPass: 'test_access_pass' }
+
+        expect(response).to redirect_to('/')
+        expect(flash[:alert]).to eq('ご注文が見つかりませんでした')
+      end
+    end
+
+    context "Payment が見つからない場合" do
+      it "checkout_state_path にリダイレクトする" do
+        get :callback, params: { token: order.token, AccessID: 'test_access_id', AccessPass: 'test_access_pass' }
+
+        # Spree 5.x のルーティング形式: /checkout/:token/:state
+        expect(response).to redirect_to("/checkout/#{order.token}/#{order.state}")
+      end
+    end
+  end
+end

data/spec/controllers/spree/payment_sources_controller_spec.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Spree::PaymentSourcesController, type: :controller do
+  routes { Spree::Core::Engine.routes }
+
+  let(:user) { create(:user) }
+  let(:other_user) { create(:user) }
+  let(:payment_method) { create(:payment_method_gmo_pg) }
+  let(:credit_card) { create(:credit_card, user: user, payment_method: payment_method, gateway_payment_profile_id: 'card_seq_123') }
+
+  before do
+    allow(controller).to receive_messages(spree_current_user: user, authenticate_user!: true)
+  end
+
+  describe "DELETE #destroy" do
+    context "自分のカードを削除する場合" do
+      context "削除成功時" do
+        before do
+          # Stub GMO-PG API call
+          stub_request(:post, "https://pt01.mul-pay.jp/payment/DeleteCard.idPass")
+            .to_return(status: 200, body: "", headers: {})
+        end
+
+        it "カードを削除し、更新後のカード一覧をturbo_streamで返す" do
+          delete :destroy, params: { id: credit_card.id }, format: :turbo_stream
+          expect(response).to have_http_status(:success)
+          expect(response.body).to include("turbo-stream")
+          expect(response.body).to include("saved-cards-#{payment_method.id}")
+        end
+      end
+
+      context "削除失敗時" do
+        before do
+          # Stub GMO-PG API call to return error (GMO-PG returns HTTP 200 with error code in body)
+          stub_request(:post, "https://pt01.mul-pay.jp/payment/DeleteCard.idPass")
+            .to_return(
+              status: 200,
+              body: "ErrCode=E01&ErrInfo=E01390008",
+              headers: { 'Content-Type' => 'application/x-www-form-urlencoded' }
+            )
+        end
+
+        it "エラーメッセージを返す" do
+          delete :destroy, params: { id: credit_card.id }, format: :turbo_stream
+          expect(response).to have_http_status(:unprocessable_entity)
+          expect(response.body).to include("turbo-stream")
+        end
+      end
+    end
+
+    context "他人のカードを削除しようとした場合" do
+      let(:other_card) { create(:credit_card, user: other_user, payment_method: payment_method) }
+
+      it "権限エラーを返す" do
+        delete :destroy, params: { id: other_card.id }, format: :turbo_stream
+        expect(response).to have_http_status(:forbidden)
+        expect(response.body).to include("turbo-stream")
+      end
+    end
+
+    context "ログインしていない場合" do
+      before do
+        allow(controller).to receive(:spree_current_user).and_return(nil)
+        allow(controller).to receive(:authenticate_user!).and_call_original
+      end
+
+      it "認証エラーを返す" do
+        delete :destroy, params: { id: credit_card.id }, format: :turbo_stream
+        expect(response).to have_http_status(:redirect)
+      end
+    end
+  end
+end

data/spec/factories/payment_method_factory.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :payment_method_gmo_pg, class: 'Spree::PaymentMethod::GmoPg' do
+    name { 'GMO-PG Credit Card' }
+    active { true }
+    auto_capture { false }
+
+    preferred_shop_id { 'test_shop_id' }
+    preferred_shop_pass { 'test_shop_pass' }
+    preferred_site_id { 'test_site_id' }
+    preferred_site_pass { 'test_site_pass' }
+    preferred_test_mode { true }
+
+    after(:build) do |payment_method|
+      payment_method.stores << (Spree::Store.first || FactoryBot.create(:store))
+    end
+  end
+end