spree_stripe 1.8.0 → 1.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ec2a5a3cd5e0a0b8e5160018ad055ff16dd27a2eea3e8404e4906e83b9e0758
-  data.tar.gz: b51ad1b1e21337ad780f5e2269c1850b0fd1dfb39ac778db187ae0629c933944
+  metadata.gz: cd7ae7fd51255dec03bb8bd709ceae4e9440dc8a61d64a62086fc91950937af0
+  data.tar.gz: 7f0c2798878679d21e6337269912e5a5be047c57348255b4536cf2f4de23ed87
 SHA512:
-  metadata.gz: f3f47966c0982f865f7dfa55074f4df6c2f8c90e2c5bdb656012266eb7c46ed690260b47fab15d7fabf0889fbaef8d22fbd153548d23f4316bcc6cdca4353d64
-  data.tar.gz: 4c9696c085fa47b26f0eb6c6dd06f4b855e0de02dd7ec583efea2c552e8be03c9d9f2952500001357ae04c06e0315a65374846a833d2267a7b6ed89b4b25e325
+  metadata.gz: edb953569b6fdab13d67ef13128f9edd29e2ce85a5a06f5ae7d1a4a2019dcf8a47aa313452474388ae983e2ccaacbbd8f9003dd8070ba34215fc5464a522fd1f
+  data.tar.gz: 77c47bb3f2d62f3ef0b6cbc48430dc834d6921c1a495aa293b7f3f8c82f25f17703c3a2cc0c3e7522d59e3008fedd5781bb3e9aeafb0d2183e0cf15d6e43cd8e

data/Rakefile

@@ -21,7 +21,4 @@ task :test_app do
     install_storefront: true,
     install_admin: true
   )
-  system({ 'BUNDLE_GEMFILE' => File.expand_path('Gemfile', __dir__) }, 'rails g spree_posts:install')
-  system({ 'BUNDLE_GEMFILE' => File.expand_path('Gemfile', __dir__) }, 'rails g spree_legacy_api_v2:install')
-  system({ 'BUNDLE_GEMFILE' => File.expand_path('Gemfile', __dir__) }, 'rails g spree_legacy_product_properties:install')
 end

data/app/helpers/spree_stripe/base_helper.rb

@@ -21,6 +21,13 @@ module SpreeStripe
       "cart_#{Spree::PrefixedId::SQIDS.encode([order.id])}"
     end
 
+    # Server-generated v3 Store API path for the order's cart, passed to the
+    # storefront JS so proxied/prefixed deployments resolve the API correctly.
+    # @return [String]
+    def stripe_cart_api_path(order)
+      spree.api_v3_store_cart_path(stripe_cart_prefixed_id(order))
+    end
+
     # The store's publishable Spree API key, used by the storefront JS as the
     # `X-Spree-API-Key` header for v3 Store API calls. Creates one on first use
     # when the store has no active publishable key yet.

data/app/javascript/spree_stripe/controllers/stripe_button_controller.js

@@ -10,15 +10,16 @@ const ZERO_DECIMAL_CURRENCIES = new Set([
 ])
 
 // Apple Pay / Google Pay express checkout on the v3 Store API. The wallet sheet
-// drives address + shipping selection against `/api/v3/store/carts`, then a
-// payment session is created and confirmed; completion is handled server-side by
-// ConfirmPaymentsController via the `return_url` (same as the regular flow).
+// drives address + shipping selection against the server-provided cart API
+// path, then a payment session is created and confirmed; completion is handled
+// server-side by ConfirmPaymentsController via the `return_url` (same as the
+// regular flow).
 export default class extends Controller {
   static values = {
     apiKey: String,
     spreeApiKey: String,
     paymentMethodId: String,
-    cartId: String,
+    cartApiPath: String,
     cartToken: String,
     confirmPaymentUrl: String,
     currency: String,
@@ -38,6 +39,7 @@ export default class extends Controller {
   connect() {
     this.isGooglePay = false
     this.shippingRateMap = new Map()
+    this.deliveryMethodMap = new Map()
     this.initStripe()
   }
 
@@ -139,8 +141,9 @@ export default class extends Controller {
       })
       if (!cart) return event.reject()
 
-      const { shippingRates, selectionMap } = this.buildShippingRates(cart.fulfillments || [])
+      const { shippingRates, selectionMap, methodMap } = this.buildShippingRates(cart.fulfillments || [])
       this.shippingRateMap = selectionMap
+      this.deliveryMethodMap = methodMap
 
       if (shippingRates.length === 0) return event.reject()
 
@@ -215,6 +218,17 @@ export default class extends Controller {
       return
     }
 
+    // The address patch above rebuilds fulfillments with their default rate,
+    // discarding the wallet's selection — re-select it before charging, or the
+    // order completes with the wrong delivery method and total.
+    if (this.shippingRequiredValue && event.shippingRate) {
+      const reselected = await this.reselectDeliveryRates(cart, event.shippingRate.id)
+      if (!reselected) {
+        event.paymentFailed({ reason: 'fail' })
+        return
+      }
+    }
+
     const { error: submitError } = await this.elements.submit()
     if (submitError) {
       event.paymentFailed({ reason: 'fail' })
@@ -259,7 +273,7 @@ export default class extends Controller {
   // --- v3 Store API calls -------------------------------------------------
 
   async patchCart(body) {
-    const response = await fetch(this.cartApiBase, {
+    const response = await fetch(this.cartApiPathValue, {
       method: 'PATCH',
       headers: this.spreeApiHeaders,
       body: JSON.stringify(body)
@@ -268,7 +282,7 @@ export default class extends Controller {
   }
 
   async patchFulfillment(fulfillmentId, deliveryRateId) {
-    const response = await fetch(`${this.cartApiBase}/fulfillments/${fulfillmentId}`, {
+    const response = await fetch(`${this.cartApiPathValue}/fulfillments/${fulfillmentId}`, {
       method: 'PATCH',
       headers: this.spreeApiHeaders,
       body: JSON.stringify({ selected_delivery_rate_id: deliveryRateId })
@@ -277,7 +291,7 @@ export default class extends Controller {
   }
 
   async createPaymentSession(stripePaymentMethodId) {
-    const response = await fetch(`${this.cartApiBase}/payment_sessions`, {
+    const response = await fetch(`${this.cartApiPathValue}/payment_sessions`, {
       method: 'POST',
       headers: this.spreeApiHeaders,
       body: JSON.stringify({
@@ -304,11 +318,14 @@ export default class extends Controller {
     return items
   }
 
-  // Builds deduped Stripe shipping rates (by delivery_method_id) and a map from
-  // each Stripe rate id to the per-fulfillment delivery rate ids to select.
+  // Builds deduped Stripe shipping rates (by delivery_method_id), a map from
+  // each Stripe rate id to the per-fulfillment delivery rate ids to select,
+  // and a map back to the delivery_method_id (the only id that survives a
+  // fulfillment rebuild — see reselectDeliveryRates).
   buildShippingRates(fulfillments) {
     const rateMap = new Map()
     const selectionMap = new Map()
+    const methodMap = new Map()
 
     for (const fulfillment of fulfillments) {
       for (const rate of fulfillment.delivery_rates || []) {
@@ -320,6 +337,7 @@ export default class extends Controller {
           const id = this.isGooglePay ? `${methodId}-${this.randomSuffix()}` : String(methodId)
           rateMap.set(methodId, { id, displayName: rate.name, amount: this.toCents(rate.cost) })
           selectionMap.set(id, [])
+          methodMap.set(id, methodId)
         } else {
           rateMap.get(methodId).amount += this.toCents(rate.cost)
         }
@@ -329,7 +347,26 @@ export default class extends Controller {
       }
     }
 
-    return { shippingRates: Array.from(rateMap.values()), selectionMap }
+    return { shippingRates: Array.from(rateMap.values()), selectionMap, methodMap }
+  }
+
+  // Re-selects the delivery method chosen in the wallet sheet on freshly
+  // rebuilt fulfillments. Matches by delivery_method_id: fulfillment and rate
+  // ids do not survive the rebuild that a shipping-address update triggers
+  // server-side (checkout reverts to the address step and shipments are
+  // recreated with their default rate).
+  async reselectDeliveryRates(cart, stripeRateId) {
+    const methodId = this.deliveryMethodMap.get(stripeRateId)
+    if (!methodId) return false
+
+    for (const fulfillment of cart.fulfillments || []) {
+      const rate = (fulfillment.delivery_rates || []).find((r) => r.delivery_method_id === methodId)
+      if (!rate || rate.selected) continue
+
+      const updated = await this.patchFulfillment(fulfillment.id, rate.id)
+      if (!updated) return false
+    }
+    return true
   }
 
   // True when every shippable fulfillment has at least one delivery rate — i.e.
@@ -384,10 +421,6 @@ export default class extends Controller {
     }
   }
 
-  get cartApiBase() {
-    return `/api/v3/store/carts/${this.cartIdValue}`
-  }
-
   get spreeApiHeaders() {
     return {
       'X-Spree-API-Key': this.spreeApiKeyValue,

data/app/javascript/spree_stripe/controllers/stripe_controller.js

@@ -10,7 +10,7 @@ export default class extends Controller {
   static values = {
     apiKey: String,
     clientSecret: String,
-    cartId: String,
+    cartApiPath: String,
     cartToken: String,
     spreeApiKey: String,
     orderEmail: String,
@@ -134,7 +134,7 @@ export default class extends Controller {
       return false
     }
 
-    const response = await fetch(this.cartApiBase, {
+    const response = await fetch(this.cartApiPathValue, {
       method: 'PATCH',
       headers: this.spreeApiHeaders,
       body: JSON.stringify(body)
@@ -224,10 +224,6 @@ export default class extends Controller {
     return null
   }
 
-  get cartApiBase() {
-    return `/api/v3/store/carts/${this.cartIdValue}`
-  }
-
   get spreeApiHeaders() {
     return {
       'X-Spree-API-Key': this.spreeApiKeyValue,

data/app/models/spree_stripe/credit_card_decorator.rb

@@ -1,13 +1,49 @@
 module SpreeStripe
+  # Backports Stripe's credit-card fingerprint dedup onto Spree::CreditCard for
+  # spree < 5.6.0, which doesn't ship it. spree >= 5.6.0 provides the column,
+  # scope, and validation in core, so this is only prepended (below) when core
+  # lacks it. (Wallet metadata accessors already live in core since 5.4, so they
+  # don't need backporting here.)
   module CreditCardDecorator
     def self.prepended(base)
-      base.store_accessor :private_metadata, :wallet
+      # Matches saved cards by the gateway's stable card fingerprint plus expiry,
+      # used to reuse an existing card instead of saving a duplicate when a gateway
+      # issues a fresh payment method id for the same physical card.
+      #
+      # @param fingerprint [String] gateway card fingerprint
+      # @param month [Integer, String] expiry month
+      # @param year [Integer, String] expiry year
+      base.scope :by_fingerprint, ->(fingerprint, month, year) {
+        cards_table = Spree::CreditCard.table_name
+
+        where(fingerprint: fingerprint).
+          where("CAST(#{cards_table}.month AS DECIMAL) = ?", month).
+          where("CAST(#{cards_table}.year AS DECIMAL) = ?", year)
+      }
+
+      # Prevents saving the same physical card (same gateway fingerprint + expiry)
+      # twice for a user and payment method. Skipped when the gateway does not
+      # provide a fingerprint.
+      base.validate :fingerprint_not_duplicated, if: -> { fingerprint.present? }
     end
 
-    def wallet_type
-      wallet&.[]('type')
+    private
+
+    # month/year are varchar columns exposed as integer attributes, so the
+    # match must go through #by_fingerprint's decimal cast rather than a plain
+    # equality (which Postgres rejects as `character varying = integer`).
+    def fingerprint_not_duplicated
+      duplicates = self.class.where(user_id: user_id, payment_method_id: payment_method_id).
+                   by_fingerprint(fingerprint, month, year)
+      duplicates = duplicates.where.not(id: id) if persisted?
+
+      errors.add(:fingerprint, :taken) if duplicates.exists?
     end
   end
 end
 
-Spree::CreditCard.prepend(SpreeStripe::CreditCardDecorator)
+# spree >= 5.6.0 ships fingerprint dedup in core, so only prepend the backport
+# when it's absent (spree < 5.6.0).
+unless Spree::CreditCard.respond_to?(:by_fingerprint)
+  Spree::CreditCard.prepend(SpreeStripe::CreditCardDecorator)
+end

data/app/models/spree_stripe/store_decorator.rb

@@ -3,21 +3,23 @@ module SpreeStripe
     def self.prepended(base)
       base.store_accessor :private_metadata, :stripe_apple_pay_domain_id
       base.store_accessor :private_metadata, :stripe_top_level_domain_id
+
+      base.after_commit :register_stripe_domain, on: :update, if: -> { code_previously_changed? }
     end
 
     def stripe_gateway
       @stripe_gateway ||= payment_methods.stripe.active.last
     end
 
-    def handle_code_changes
-      super
-
-      SpreeStripe::RegisterDomainJob.perform_later(id)
-    end
-
     def billing_name
       name
     end
+
+    private
+
+    def register_stripe_domain
+      SpreeStripe::RegisterDomainJob.perform_later(id)
+    end
   end
 end
 

data/app/services/spree_stripe/create_source.rb

@@ -47,14 +47,33 @@ module SpreeStripe
 
     def find_or_create_credit_card
       if user
-        source = user.credit_cards.find_by(gateway_payment_profile_id: stripe_payment_method_id)
+        exact_source = user.credit_cards.find_by(gateway_payment_profile_id: stripe_payment_method_id)
+        return exact_source if exact_source
 
-        return source if source
+        matching_source = match_credit_card_by_fingerprint
+        return matching_source if matching_source
       end
 
       Spree::CreditCard.create!(credit_card_params)
     end
 
+    # Stripe issues a new PaymentMethod (pm_xxx) on every new credit card entry, even for the same physical card,
+    # so deduping on gateway_payment_profile_id alone misses repeat cards. Stripe's card.fingerprint
+    # is stable for the same card number, so we match on fingerprint + expiry (per Stripe guidance) to
+    # reuse the existing saved card instead of creating a duplicate.
+    #
+    # @return [Spree::CreditCard, nil] the existing saved card for this physical card, or nil
+    def match_credit_card_by_fingerprint
+      card = stripe_payment_method_details.card
+      return if card.fingerprint.blank?
+
+      user.credit_cards.
+        where(payment_method: gateway).
+        by_fingerprint(card.fingerprint, card.exp_month, card.exp_year).
+        order(created_at: :desc).
+        first
+    end
+
     def credit_card_params
       card_details = stripe_payment_method_details.card
       customer = gateway.fetch_or_create_customer(user: user, order: order)
@@ -65,6 +84,7 @@ module SpreeStripe
         payment_method: gateway,
         gateway_customer_profile_id: customer&.profile_id,
         gateway_payment_profile_id: stripe_payment_method_id,
+        fingerprint: card_details.fingerprint,
         name: stripe_billing_details.name,
         month: card_details.exp_month,
         year: card_details.exp_year,

data/app/views/spree/checkout/payment/_spree_stripe.html.erb

@@ -3,7 +3,7 @@
     data-controller="checkout-stripe"
     data-checkout-stripe-api-key-value="<%= current_stripe_gateway.try(:preferred_publishable_key) %>"
     data-checkout-stripe-client-secret-value="<%= current_stripe_payment_session.client_secret %>"
-    data-checkout-stripe-cart-id-value="<%= stripe_cart_prefixed_id(@order) %>"
+    data-checkout-stripe-cart-api-path-value="<%= stripe_cart_api_path(@order) %>"
     data-checkout-stripe-cart-token-value="<%= @order.token %>"
     data-checkout-stripe-spree-api-key-value="<%= current_store_publishable_api_key %>"
     data-checkout-stripe-order-email-value="<%= @order.email %>"

data/app/views/spree_stripe/_quick_checkout.html.erb

@@ -6,7 +6,7 @@
         checkout_stripe_button_api_key_value: current_stripe_gateway.try(:preferred_publishable_key),
         checkout_stripe_button_spree_api_key_value: current_store_publishable_api_key,
         checkout_stripe_button_payment_method_id_value: current_stripe_gateway.prefixed_id,
-        checkout_stripe_button_cart_id_value: stripe_cart_prefixed_id(@order),
+        checkout_stripe_button_cart_api_path_value: stripe_cart_api_path(@order),
         checkout_stripe_button_cart_token_value: @order.token,
         checkout_stripe_button_confirm_payment_url_value: spree.stripe_confirm_payment_url(@order.prefixed_id),
         checkout_stripe_button_currency_value: @order.currency.downcase,

data/db/migrate/20260610120000_add_fingerprint_to_spree_credit_cards.rb

@@ -0,0 +1,52 @@
+class AddFingerprintToSpreeCreditCards < ActiveRecord::Migration[7.2]
+  INDEX_NAME = 'index_spree_credit_cards_unique_fingerprint'.freeze
+
+  # spree >= 5.6.0 ships this same migration in core (same name, so Rails' migration
+  # installer skips this copy). On spree < 5.6.0 it runs here, giving the gateway a
+  # place to store Stripe's card fingerprint for dedup. Guarded so it stays a no-op
+  # if the column/index already exist.
+  def up
+    add_column :spree_credit_cards, :fingerprint, :string, if_not_exists: true
+
+    return if index_name_exists?(:spree_credit_cards, INDEX_NAME)
+
+    # Prevent duplicate saved cards (same gateway fingerprint + expiry) per user and
+    # payment method at the database level. Only active, fingerprinted cards are
+    # constrained, so legacy/non-gateway cards (NULL fingerprint) and soft-deleted
+    # rows are left untouched.
+    if ActiveRecord::Base.connection.adapter_name == 'Mysql2'
+      # MySQL has no partial indexes, but treats NULL as distinct in unique indexes,
+      # so NULL fingerprints are naturally allowed. COALESCE on deleted_at keeps
+      # soft-deleted rows from colliding with active ones.
+      execute <<-SQL
+        CREATE UNIQUE INDEX #{INDEX_NAME}
+        ON spree_credit_cards(
+          user_id,
+          payment_method_id,
+          fingerprint,
+          month,
+          year,
+          (COALESCE(deleted_at, CAST('1970-01-01' AS DATETIME)))
+        )
+      SQL
+    else
+      add_index :spree_credit_cards, [:user_id, :payment_method_id, :fingerprint, :month, :year],
+                unique: true,
+                where: 'fingerprint IS NOT NULL AND deleted_at IS NULL',
+                name: INDEX_NAME
+    end
+  end
+
+  def down
+    # From spree 5.6.0 the fingerprint column AND its unique index live in core (both
+    # share the same names), and Rails' migration installer dedupes this migration
+    # against core's — so on 5.6.0+ this migration never created them. Leave core's
+    # schema untouched there, which also covers an app that added the column here on
+    # older spree and later upgraded: the column is now core-owned and must survive
+    # a rollback.
+    return if Gem::Version.new(Spree.version) >= Gem::Version.new('5.6.0')
+
+    remove_index :spree_credit_cards, name: INDEX_NAME if index_name_exists?(:spree_credit_cards, INDEX_NAME)
+    remove_column :spree_credit_cards, :fingerprint if column_exists?(:spree_credit_cards, :fingerprint)
+  end
+end

data/lib/spree_stripe/testing_support/factories/stripe_payment_session_factory.rb

@@ -1,7 +1,7 @@
 FactoryBot.define do
   factory :stripe_payment_session, class: 'Spree::PaymentSessions::Stripe' do
     order { create(:order_with_line_items) }
-    payment_method { create(:stripe_gateway, stores: [order.store]) }
+    payment_method { create(:stripe_gateway, store: order.store) }
     amount { order.total }
     currency { order.currency }
     status { 'pending' }

data/lib/spree_stripe/version.rb

@@ -1,5 +1,5 @@
 module SpreeStripe
-  VERSION = '1.8.0'.freeze
+  VERSION = '1.8.1'.freeze
 
   def gem_version
     Gem::Version.new(VERSION)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_stripe
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.8.1
 platform: ruby
 authors:
 - Vendo Connect Inc., Vendo Sp. z o.o.
@@ -227,6 +227,7 @@ files:
 - config/locales/en.yml
 - config/routes.rb
 - db/migrate/20250310152812_setup_spree_stripe_models.rb
+- db/migrate/20260610120000_add_fingerprint_to_spree_credit_cards.rb
 - lib/generators/spree_stripe/install/install_generator.rb
 - lib/spree_stripe.rb
 - lib/spree_stripe/configuration.rb
@@ -249,9 +250,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/spree/spree_stripe/issues
-  changelog_uri: https://github.com/spree/spree_stripe/releases/tag/v1.8.0
+  changelog_uri: https://github.com/spree/spree_stripe/releases/tag/v1.8.1
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree_stripe/tree/v1.8.0
+  source_code_uri: https://github.com/spree/spree_stripe/tree/v1.8.1
 rdoc_options: []
 require_paths:
 - lib
@@ -267,7 +268,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 4.0.2
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Official Spree Commerce Stripe payment gateway extension
 test_files: []