spree_stripe 6.0.0.rc7 → 6.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0279ebe2cc2465e37abc70e3cab226d335c5394ab5808a1631c65e00959701d
-  data.tar.gz: d71a287ac7a341db12b081b8512423545596655902bc7b4d6c4453dee59a5118
+  metadata.gz: 2e4ab3057fd40a41a397c25f79a996f56f09e2bc3c365f697b9b978ee55360b0
+  data.tar.gz: 3d6a18103e35891b4fd9bb7df0e2ad464483423c8ee03cbf45cc3d852d7fdfb4
 SHA512:
-  metadata.gz: cd526139a29420c0992cc50163dc88dd85a2d20580f3f556afba79c5e2c9d064ed99c90ff8be2146aa03f430276a0ebe789114f196e25a8d9993fb25b8820e7a
-  data.tar.gz: b37586cb450149226ea9cc413a14b19415b59e3b3616810e830815c8e28c32f7f240219e8b274ac046b19c5e8ca5e5deb6163b3814ebbfe55895c3f041999c8d
+  metadata.gz: 754a65d474d2840b3dc2e13e7ebccfdeb7ba62ae06e0c1ff7e62fb51eeb636201e83bfa073ce3b081c414d1916d257b5bd80d74a462338d11438b86fe9443b2f
+  data.tar.gz: a537698ea61e260e217f7d6b891a6d96132964d776bb558c9f2bf294d85027c41f41e7113558dd19a39edf486e3cc0a802970048d6b8745e74f7220a59e5771f

data/app/maintenance_tasks/spree_stripe/maintenance_tasks/migrate_webhook_keys.rb

@@ -0,0 +1,13 @@
+module SpreeStripe
+  module MaintenanceTasks
+    # Moves Stripe webhook signing secrets onto the gateway that uses them.
+    #
+    # Ships with this gem rather than core, which is what makes the manifest
+    # step optional: an installation without spree_stripe has neither the rake
+    # task nor this class, and the upgrade walk skips the step rather than
+    # failing on it.
+    class MigrateWebhookKeys < Spree::MaintenanceTasks::Upgrade::RakeStep
+      runs_rake_task 'spree:upgrade:migrate_stripe_webhook_keys'
+    end
+  end
+end

data/app/models/spree_stripe/payout_provider.rb

@@ -266,15 +266,58 @@ module SpreeStripe
       raise Spree::Core::AmbiguousGatewayError, e.message
     end
 
-    # Pulls a seller's money back after a refund.
+    # Pulls a seller's share of a refund back from their connected account.
     #
-    # Ledger-only in open source: the row is written either way, so the books
-    # stay correct, but reversing the Stripe transfer — and netting a negative
-    # balance against future earnings — is where a marketplace needs the money
-    # operations that Enterprise provides.
+    # Reverses the transfer that paid the earning, by the reversal's amount,
+    # so the money returns to the platform that refunded the customer. A
+    # seller who has already been paid out is left with a negative Stripe
+    # balance, which their next earnings make up before anything more is paid
+    # out to them.
+    #
+    # The reversal waits until its earning has reached Stripe: until then
+    # there is no transfer to take from. It is left pending, and the
+    # pending-transfers job asks again once the earning is sent.
+    #
+    # A retry first looks for a reversal an earlier attempt already made, so
+    # the seller is never charged twice for one refund.
     def reverse!(seller_transfer)
-      seller_transfer.update!(status: 'completed')
+      return complete_without_sending(seller_transfer) if minor_units(seller_transfer).zero?
+
+      earning = seller_transfer.reversed_from
+      raise Spree::Core::GatewayError, 'Reversal has no earning to take back from' if earning.nil?
+      # Never sent, so nothing reached the seller's account.
+      return complete_without_sending(seller_transfer) if earning.failed?
+      return seller_transfer unless earning.completed?
+
+      # Confirmed without a transfer to point at — settled by hand, say. Only
+      # a person can say where that money is.
+      if earning.reference.blank?
+        raise Spree::Core::AmbiguousGatewayError, 'The earning has no Stripe transfer to reverse'
+      end
+
+      api_options = gateway_for(seller_transfer.seller.store).api_options
+      reversal = made_reversal(earning, seller_transfer, api_options) || Stripe::Transfer.create_reversal(
+        earning.reference,
+        {
+          amount: minor_units(seller_transfer),
+          metadata: {
+            spree_seller_transfer_id: seller_transfer.id,
+            spree_order_number: seller_transfer.order.number
+          }
+        },
+        api_options.merge(idempotency_key: idempotency_key(seller_transfer))
+      )
+
+      # The earning may have been sent after this row was written, and only
+      # then learned the currency it settled in.
+      seller_transfer.update!(
+        { status: 'completed', reference: reversal.id }.merge(earning.reversal_settlement(seller_transfer.amount.abs))
+      )
       seller_transfer
+    rescue *AMBIGUOUS_ERRORS => e
+      # The reversal may have been made before the answer was lost, so core
+      # parks it rather than taking the money back twice.
+      raise Spree::Core::AmbiguousGatewayError, e.message
     end
 
     private
@@ -300,6 +343,21 @@ module SpreeStripe
       seller_transfer
     end
 
+    # The reversal an earlier attempt made but never recorded — the row failed
+    # to save, or the process stopped first. Found by the row it names, since
+    # the idempotency key that would also stop a second one lasts only a day.
+    #
+    # A failed lookup moved no money, so it is a refusal the retry job can
+    # repeat rather than an outcome nobody knows.
+    def made_reversal(earning, seller_transfer, api_options)
+      reversals = Stripe::Transfer.list_reversals(earning.reference, { limit: 100 }, api_options)
+      reversals.auto_paging_each.find do |reversal|
+        reversal.metadata['spree_seller_transfer_id'] == seller_transfer.id.to_s
+      end
+    rescue Stripe::StripeError => e
+      raise Spree::Core::GatewayError, e.message
+    end
+
     # Nil rather than raising: a checklist row asking why it is incomplete
     # must not take the page down because Stripe is unreachable.
     def retrieve_account(seller)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_stripe
 version: !ruby/object:Gem::Version
-  version: 6.0.0.rc7
+  version: 6.0.1
 platform: ruby
 authors:
 - Vendo Connect Inc.
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-10-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_core
@@ -17,14 +17,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc7
+        version: 6.0.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc7
+        version: 6.0.1
 - !ruby/object:Gem::Dependency
   name: stripe
   requirement: !ruby/object:Gem::Requirement
@@ -72,6 +72,7 @@ files:
 - Rakefile
 - app/jobs/spree_stripe/base_job.rb
 - app/jobs/spree_stripe/create_webhook_endpoint_job.rb
+- app/maintenance_tasks/spree_stripe/maintenance_tasks/migrate_webhook_keys.rb
 - app/models/spree/payment_sessions/stripe.rb
 - app/models/spree/payment_setup_sessions/stripe.rb
 - app/models/spree_stripe/gateway.rb
@@ -111,9 +112,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.rc7
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.1
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.rc7
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.1
 post_install_message:
 rdoc_options: []
 require_paths: