spree_vpago 2.3.12 → 2.3.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f7c6fc347bce48aed54a98bf47d4432f79ec1144a882f7c6cf14b55ad1f87663
-  data.tar.gz: c62d76d1e6661bc0460b3a4be75feeb6d4c6c8a3b1278d1b62dccb53324b6e1a
+  metadata.gz: bdd8f50bd5b048c05af17f829cfccd26404d0d7cda2045bb035d13ad1538a07b
+  data.tar.gz: 4ecd233d69198bb6519c593c4fb35d72c4abe68bf113f4fc73e95178fb205aff
 SHA512:
-  metadata.gz: 2973459504b60f1f6308e6f0db319c1b2e25f19747d2f94aeb3bf48f69b75e87c508f57c197a49440920464952df30e1cb3b6797ba9a782ff375ec1a7c0b0893
-  data.tar.gz: e8418cf6a8298850075104813a93da543ab148327d7ee6cafdd63be2c1ce5eb64fe457888d695af4931a1b459ee3e60282553e22875a7b530d3099d002c60b8b
+  metadata.gz: bf536c675b11021b9c5fcbcb2eaaa4ef74e7a5ba8a201988d8254d33836a355a6bb98748fed8432ad47b5464594a6baa9c24ae843e373cffa7b1c0612cbeee66
+  data.tar.gz: 30b0d2b5289f52036d72d4062d7940075ab261e6d0a6f2dafe5ba39d04a6f21a7df18cda72ff4e4682ea95723d8d05f2a5bb02018e6876f24b411f1b7eb57b96

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    spree_vpago (2.3.12)
+    spree_vpago (2.3.13)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/spree/vpago_payments_controller.rb

@@ -23,6 +23,11 @@ module Spree
     # GET
     def processing
       @order = @payment.order
+
+      # Common, not an edge case: the gateway callback or the checkout page's transaction
+      # checker often completes the order before the browser lands here. Skipping this page
+      # also skips its Firebase listener, so success must post order_is_completed itself
+      # (render_success_script) or an embedding iframe modal never closes.
       return redirect_to @payment.success_url, allow_other_host: true if @order.completed?
 
       VpagoLogger.log(label: 'Spree::VpagoPaymentsController#processing', data: vpago_log_context)
@@ -153,9 +158,9 @@ module Spree
       raise ActiveRecord::RecordNotFound unless @payment.present?
     end
 
-    # frame-ancestors (set above) supersedes X-Frame-Options in modern
-    # browsers, but the default SAMEORIGIN header would still block legacy
-    # browsers from embedding these pages, so drop it for the iframe actions.
+    # These pages are embedded in iframes on many partner sites we don't
+    # enumerate, so framing is left unrestricted: no frame-ancestors policy, and
+    # Rails' default SAMEORIGIN header is dropped for the iframe actions.
     def allow_iframe_embedding
       response.headers.delete('X-Frame-Options')
     end

data/app/helpers/vpago/vpago_payments_helper.rb

@@ -13,6 +13,12 @@ module Vpago
       render partial: 'spree/vpago_payments/transaction_checker'
     end
 
+    # Host apps override success.html.erb; call this from every override so an
+    # embedding iframe modal still learns the order completed.
+    def render_success_script
+      render partial: 'spree/vpago_payments/success_script'
+    end
+
     # Each payment method may have their own additional processing script,
     # so we will look for the partial based on the payment method class name.
     #

data/app/views/spree/vpago_payments/_success_script.html.erb

@@ -0,0 +1,7 @@
+<script>
+  // processing redirects here without rendering once the order is complete, so its
+  // Firebase listener never posts this. success only renders for completed orders.
+  if (window.parent !== window) {
+    window.parent.postMessage("order_is_completed", "*");
+  }
+</script>

data/app/views/spree/vpago_payments/success.html.erb

@@ -1,3 +1,5 @@
 <h1>
   Success
 </h1>
+
+<%= render_success_script %>

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.3.12'.freeze
+  VERSION = '2.3.13'.freeze
 
   def version
     Gem::Version.new VERSION

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.3.12
+  version: 2.3.13
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-07 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -344,6 +344,7 @@ files:
 - app/views/spree/payway_results/success.html.erb
 - app/views/spree/payway_v2_card_popups/_form.html.erb
 - app/views/spree/payway_v2_card_popups/show.html.erb
+- app/views/spree/vpago_payments/_success_script.html.erb
 - app/views/spree/vpago_payments/_transaction_checker.html.erb
 - app/views/spree/vpago_payments/checkout.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb