spree_razorpay_checkout 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4200b3ff85e0fea3d0c4412d81dd7af4cf4a66cdb5d582b871b88a8ac6bc2fc
-  data.tar.gz: d142c51d56ba5b2f1eb445780fc887012e1e199abb767f5edaf85f8badc8ce17
+  metadata.gz: 59ea8bc12e162b79eacdbefce1a1ee167cd9a4d4e7c2cd7cd3bd53ce47a8d716
+  data.tar.gz: a4b9a022d525bb254c0b932f415ebedf63dbfc4aac3be42d648546163b149d87
 SHA512:
-  metadata.gz: 48701e4dda07a8fa192f320981418ae79c5b744bff3e650935a4fac1485c66878bd19414bc4ca72d7411b5ad829bcbf2b0161ed214818057a459630e76cc267d
-  data.tar.gz: 800b0a224a91684f8f7072adc953665091702bda9aafba80f6898bc009cf466300567a579707f53fba9ab855218e76da543beafacc24c562c6a8f3dd6b77eee5
+  metadata.gz: cc7bedce60a230b32703ff7e8613153f9eee91eee5554b51c42e7de2aa235799038825b5b103eddd4948e26e9ac8a13850d2353e1d240b514b839dd58c686fc2
+  data.tar.gz: eb72bd494b0f178939f8ad4463281ec3bb793f8bf6ef0bb0c751b8d1fa2c976ec1b42b1a9a81b774fff1680c411b783f2a2c31327f679c1d842a35dd63ce6bc1

data/app/controllers/spree/razorpay/_webhooks_controller.rb

@@ -0,0 +1,78 @@
+module Spree
+  class RazorpayWebhooksController < ActionController::API
+    skip_before_action :verify_authenticity_token, raise: false
+
+    # Handles asynchronous background webhooks directly from Razorpay's servers
+    def create
+      payload = request.body.read
+      signature = request.headers['X-Razorpay-Signature'] || request.headers['HTTP_X_RAZORPAY_SIGNATURE']
+      
+      gateway = Spree::Gateway::RazorpayGateway.active.first
+      return head :not_found unless gateway && gateway.preferred_webhook_secret.present?
+
+      begin
+        # 1. Use the gateway's parser to verify signature and map the action
+        parsed_event = gateway.parse_webhook_event(payload, { 'HTTP_X_RAZORPAY_SIGNATURE' => signature })
+        
+        # If it's an event we don't care about, acknowledge and return
+        return head :ok unless parsed_event
+
+        # 2. Extract Data
+        payment_session = parsed_event[:payment_session]
+        action = parsed_event[:action]
+        
+        event_data = JSON.parse(payload)
+        metadata = event_data.dig('payload', 'payment', 'entity') || {}
+
+        # 3. Trigger the Core Spree 5.5 Webhook Handler Service
+        Spree::Payments::HandleWebhook.call(
+          payment_method: gateway,
+          action: action,
+          payment_session: payment_session,
+          metadata: metadata
+        )
+
+      rescue Spree::PaymentMethod::WebhookSignatureError => e
+        Rails.logger.error("Razorpay Webhook Verification Failed: #{e.message}")
+        return head :unauthorized
+      rescue StandardError => e
+        Rails.logger.error("Razorpay Webhook Processing Error: #{e.message}")
+        return head :unprocessable_entity
+      end
+
+      head :ok
+    end
+
+    # Handles synchronous frontend verification from Next.js Storefront
+    def verify
+      razorpay_order_id = params[:razorpay_order_id]
+      razorpay_payment_id = params[:razorpay_payment_id]
+      razorpay_signature = params[:razorpay_signature]
+
+      session = Spree::PaymentSession.find_by(external_id: razorpay_order_id)
+      return head :not_found unless session
+      
+      gateway = Spree::Gateway::RazorpayGateway.active.first
+      return render json: { success: false, error: 'Gateway not configured' }, status: :internal_server_error unless gateway
+      gateway.provider 
+
+      begin
+        ::Razorpay::Utility.verify_payment_signature(
+          razorpay_order_id: razorpay_order_id,
+          razorpay_payment_id: razorpay_payment_id,
+          razorpay_signature: razorpay_signature
+        )
+        
+        session.external_data ||= {}
+        session.external_data['razorpay_payment_id'] = razorpay_payment_id
+        session.external_data['razorpay_signature'] = razorpay_signature
+        session.save!
+
+        render json: { success: true }
+      rescue ::Razorpay::Errors::SignatureVerificationError => e
+        Rails.logger.error("Razorpay Frontend Verification Failed: #{e.message}")
+        render json: { success: false, error: e.message }, status: :unprocessable_entity
+      end
+    end
+  end
+end

data/app/models/spree/gateway/razorpay_gateway.rb

@@ -14,6 +14,9 @@ module Spree
     preference :merchant_address, :string, default: 'Razorpay, Bangalore, India'
     preference :theme_color, :string, default: '#2e5bff'
     preference :headless_api_mode, :boolean, default: false
+    
+    # NEW: Allow manual capture vs auto-capture choice from Spree Admin Panel
+    preference :auto_capture, :boolean, default: true
 
     def name
       'Razorpay Secure (UPI, Wallets, Cards & Netbanking)'
@@ -52,7 +55,7 @@ module Spree
     end
 
     def auto_capture?
-      true
+      preferred_auto_capture
     end
 
     def request_type
@@ -95,7 +98,9 @@ module Spree
       Spree::PaymentSessions::Razorpay if defined?(Spree::PaymentSession)
     end
 
+    # =========================================================================
     # SPREE 5.4+ HEADLESS API FLOW (Protected by defined? check)
+    # =========================================================================
 
     if defined?(Spree::PaymentSession)
       def create_payment_session(order:, amount: nil, external_data: {})
@@ -107,7 +112,7 @@ module Spree
           amount: amount_in_cents,
           currency: order.currency || 'INR',
           receipt: order.number,
-          payment_capture: 1,
+          payment_capture: auto_capture? ? 1 : 0, # UPDATED: Respects Manual Capture
           notes: { spree_order_number: order.number, email: order.email }
         )
 
@@ -140,7 +145,7 @@ module Spree
             amount: amount_in_cents,
             currency: payment_session.currency,
             receipt: payment_session.order.number,
-            payment_capture: 1
+            payment_capture: auto_capture? ? 1 : 0 # UPDATED: Respects Manual Capture
           )
           
           payment_session.update!(amount: amount, external_id: new_rzp_order.id)
@@ -151,48 +156,60 @@ module Spree
       def complete_payment_session(payment_session:, params: {})
         provider
         
-        ext_data = params[:external_data] || params['external_data'] || {}
-        rzp_payment_id = ext_data[:razorpay_payment_id] || ext_data['razorpay_payment_id'] || payment_session.external_data['razorpay_payment_id']
-        rzp_signature  = ext_data[:razorpay_signature] || ext_data['razorpay_signature'] || payment_session.external_data['razorpay_signature']
+        # Robustly parse the JSON string sent from Next.js via the Spree API
+        result_data = {}
+        if params[:session_result].present?
+          begin
+            result_data = params[:session_result].is_a?(String) ? JSON.parse(params[:session_result]) : params[:session_result]
+          rescue JSON::ParserError
+            result_data = {}
+          end
+        end
+        
+        rzp_payment_id = result_data['razorpay_payment_id'] || result_data[:razorpay_payment_id] || payment_session.external_data['razorpay_payment_id']
+        rzp_signature  = result_data['razorpay_signature'] || result_data[:razorpay_signature] || payment_session.external_data['razorpay_signature']
 
         begin
+          # Verify the Signature
           ::Razorpay::Utility.verify_payment_signature(
             razorpay_order_id: payment_session.external_id,
             razorpay_payment_id: rzp_payment_id,
             razorpay_signature: rzp_signature
           )
 
-          # Lock the order database row to prevent race conditions with Webhooks
+         # Lock the order database row to prevent race conditions with Webhooks
           payment_session.order.with_lock do
             
-            # Save the verified IDs into the session so the new Session Class can read them
+            # Save the verified IDs into the session
             session_data = payment_session.external_data || {}
             session_data['razorpay_payment_id'] = rzp_payment_id
             session_data['razorpay_signature'] = rzp_signature
             payment_session.update!(external_data: session_data)
 
-            # Capture the payment
+            # Fetch payment status directly from Razorpay for instant frontend resolution
             rzp_payment = ::Razorpay::Payment.fetch(rzp_payment_id)
-            if rzp_payment.status == 'authorized'
-              rzp_payment.capture({ amount: (payment_session.amount.to_f * 100).to_i }) 
-            end
 
             # Process and Create Payment
             payment_session.process! if payment_session.can_process?
             
-            # This safely calls your new Spree::PaymentSessions::Razorpay class!
             payment = payment_session.find_or_create_payment!
             
             if payment.present? && !payment.completed?
               payment.started_processing! if payment.checkout?
-              payment.complete! if payment.can_complete?
+              
+              # SYNCHRONOUS FIX: Immediately transition payment state so Next.js can complete the order
+              if rzp_payment.status == 'captured'
+                payment.complete! if payment.can_complete?
+              elsif rzp_payment.status == 'authorized'
+                payment.pend! if payment.can_pend?
+              end
             end
 
             payment_session.complete! if payment_session.can_complete?
           end
 
         rescue StandardError => e
-          Rails.logger.error("Razorpay 5.4 API Completion Failed: #{e.message}")
+          Rails.logger.error("Razorpay 5.4+ API Completion Failed: #{e.message}")
           payment_session.fail! if payment_session.can_fail?
           raise Spree::Core::GatewayError, e.message
         end
@@ -212,9 +229,12 @@ module Spree
         session = Spree::PaymentSession.find_by(external_id: payment_entity['order_id'])
         return nil unless session
 
+        # UPDATED: Split authorized vs captured to align with new Spree webhook architecture
         case event['event']
-        when 'payment.captured', 'payment.authorized'
+        when 'payment.captured', 'order.paid'
           { action: :captured, payment_session: session }
+        when 'payment.authorized'
+          { action: :authorized, payment_session: session }
         when 'payment.failed'
           { action: :failed, payment_session: session }
         else
@@ -225,6 +245,10 @@ module Spree
       end
     end
 
+    # =========================================================================
+    # LEGACY / ACTIVEMERCHANT FLOW
+    # =========================================================================
+
     def purchase(_amount, source, _gateway_options = {})
       provider
 
@@ -271,8 +295,24 @@ module Spree
       end
     end
 
-    def capture(*args)
-      ActiveMerchant::Billing::Response.new(true, 'Already Captured', {}, test: preferred_test_mode)
+    # UPDATED: Fully implemented Capture method so you can click "Capture" inside Spree Admin
+    def capture(amount_in_cents, response_code, gateway_options = {})
+      provider
+      begin
+        rzp_payment_id = resolve_razorpay_payment_id(response_code)
+
+        raise StandardError, "Missing Razorpay Payment ID." if rzp_payment_id.blank?
+
+        rzp_payment = ::Razorpay::Payment.fetch(rzp_payment_id)
+        if rzp_payment.status == 'authorized'
+          rzp_payment.capture({ amount: amount_in_cents, currency: gateway_options[:currency] || 'INR' })
+        end
+
+        ActiveMerchant::Billing::Response.new(true, 'Razorpay Capture Successful', {}, test: preferred_test_mode, authorization: rzp_payment_id)
+      rescue StandardError => e
+        Rails.logger.error("Razorpay Capture Failed: #{e.message}")
+        ActiveMerchant::Billing::Response.new(false, "Capture failed: #{e.message}", {}, test: preferred_test_mode)
+      end
     end
 
     def credit(credit_cents, response_code, _gateway_options = {})

data/app/models/spree/payment_sessions/razorpay.rb

@@ -10,16 +10,13 @@ module Spree
         external_id
       end
 
-      # Required for Headless API V3 to properly create the source and prevent double-charges
       def find_or_create_payment!(metadata = {})
         return unless persisted?
         return payment if payment.present?
 
-        # 1. Lock the order to prevent race conditions from Webhooks
         order.with_lock do
-          rzp_payment_id = external_data['razorpay_payment_id']
+          rzp_payment_id = external_data['razorpay_payment_id'] || metadata['id']
           
-          # 2. Check if the webhook already created this payment
           existing_payment = order.payments.where(
             payment_method: payment_method,
             response_code: rzp_payment_id || external_id
@@ -27,17 +24,17 @@ module Spree
 
           return existing_payment if existing_payment.present?
 
-          # 3. Create your custom RazorpayCheckout source record for Headless!
+          rzp_status = metadata['status'] || 'pending'
+
           source = ::Spree::RazorpayCheckout.create!(
             order_id: order.id,
             razorpay_payment_id: rzp_payment_id,
             razorpay_order_id: external_id,
             razorpay_signature: external_data['razorpay_signature'],
-            status: 'captured',
+            status: rzp_status,
             payment_method: payment_method.name
           )
 
-          # 4. Create the actual Spree::Payment
           order.payments.create!(
             payment_method: payment_method,
             amount: amount,

data/config/routes.rb

@@ -1,7 +1,4 @@
 Spree::Core::Engine.add_routes do
-  
-  namespace :razorpay do
-    post :webhooks, to: 'webhooks#create'
-    post :verify, to: 'webhooks#verify'
-  end
-end
+  post '/razorpay/webhooks', to: 'razorpay_webhooks#create'
+  post '/razorpay/verify',   to: 'razorpay_webhooks#verify'
+end

data/lib/spree_razorpay_checkout/version.rb

@@ -1,5 +1,5 @@
 module SpreeRazorpayCheckout
-  VERSION = '0.3.1'.freeze
+  VERSION = '0.3.2'.freeze
 
   module_function
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_razorpay_checkout
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Umesh Ravani
@@ -79,7 +79,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Seamless Razorpay checkout integration for Spree 5.4. Features include
+description: Seamless Razorpay checkout integration for Spree 5.5. Features include
   Hotwire/Turbo compatibility, Zero Drop-off Webhook captures, native Spree Dashboard
   refunds, and the Affordability Widget.
 email:
@@ -95,7 +95,7 @@ files:
 - app/assets/images/payment_icons/window_modal.svg
 - app/controllers/concerns/spree/razor_pay.rb
 - app/controllers/spree/products_controller_decorator.rb
-- app/controllers/spree/razorpay/webhooks_controller.rb
+- app/controllers/spree/razorpay/_webhooks_controller.rb
 - app/controllers/spree/razorpay_controller.rb
 - app/javascript/spree_razorpay/application.js
 - app/javascript/spree_razorpay/controllers/checkout_razorpay_controller.js

data/app/controllers/spree/razorpay/webhooks_controller.rb

@@ -1,72 +0,0 @@
-module Spree
-  module Razorpay
-    class WebhooksController < ActionController::API
-      skip_before_action :verify_authenticity_token, raise: false
-
-      # Handles asynchronous background webhooks directly from Razorpay's servers
-      def create
-        payload = request.body.read
-        signature = request.headers['X-Razorpay-Signature']
-        
-        gateway = Spree::Gateway::RazorpayGateway.active.first
-        return head :not_found unless gateway && gateway.preferred_webhook_secret.present?
-
-        begin
-          ::Razorpay::Utility.verify_webhook_signature(
-            payload, 
-            signature, 
-            gateway.preferred_webhook_secret
-          )
-        rescue ::Razorpay::Errors::SignatureVerificationError => e
-          Rails.logger.error("Razorpay Webhook Verification Failed: #{e.message}")
-          return head :unauthorized
-        end
-
-        event = JSON.parse(payload)
-
-        # Listen for 'payment.authorized' which fires immediately after OTP!
-        if ['order.paid', 'payment.captured', 'payment.authorized'].include?(event['event'])
-          ::SpreeRazorpayCheckout::HandleWebhookEventJob.perform_later(event)
-        end
-
-        head :ok
-      end
-
-      # Handles synchronous frontend verification from Next.js Storefront
-      def verify
-        razorpay_order_id = params[:razorpay_order_id]
-        razorpay_payment_id = params[:razorpay_payment_id]
-        razorpay_signature = params[:razorpay_signature]
-
-        session = Spree::PaymentSession.find_by(external_id: razorpay_order_id)
-        return head :not_found unless session
-        
-        # Initialize the Razorpay gem with your active API keys
-        gateway = Spree::Gateway::RazorpayGateway.active.first
-        return render json: { success: false, error: 'Gateway not configured' }, status: :internal_server_error unless gateway
-        gateway.provider 
-
-        begin
-          # 1. Verify the signature securely on the server
-          ::Razorpay::Utility.verify_payment_signature(
-            razorpay_order_id: razorpay_order_id,
-            razorpay_payment_id: razorpay_payment_id,
-            razorpay_signature: razorpay_signature
-          )
-          
-          # 2. Inject the signatures into the session's external_data
-          session.external_data ||= {}
-          session.external_data['razorpay_payment_id'] = razorpay_payment_id
-          session.external_data['razorpay_signature'] = razorpay_signature
-          session.save!
-
-          render json: { success: true }
-        rescue ::Razorpay::Errors::SignatureVerificationError => e
-          Rails.logger.error("Razorpay Frontend Verification Failed: #{e.message}")
-          render json: { success: false, error: e.message }, status: :unprocessable_entity
-        end
-      end
-
-    end
-  end
-end