spree_vpago 2.3.13.pre.pre1 → 2.3.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a704b3b4c6172fcfac73d2b395be971f8706c137260c6d122e530160260f276
-  data.tar.gz: fc86b46f2cde8a9de6426b413196cc707b32dc141c78d756d17ae9de654893f3
+  metadata.gz: bdd8f50bd5b048c05af17f829cfccd26404d0d7cda2045bb035d13ad1538a07b
+  data.tar.gz: 4ecd233d69198bb6519c593c4fb35d72c4abe68bf113f4fc73e95178fb205aff
 SHA512:
-  metadata.gz: 229e3073db012f2f0a1ab6a9b47ea893eaf751b0d3937211490743d81a41800024e2263dd07269fdfdc3549449288bf13263df0737bf6a4dcda2a4a768acae53
-  data.tar.gz: a8ea4e06485c9bd95d6f6616379c6c8dee5e8b6090dddb1a30446ec16ea0697984db1480a027ad7150b68e801bf295c50e13998fcc8232eddeb2fe9e32605920
+  metadata.gz: bf536c675b11021b9c5fcbcb2eaaa4ef74e7a5ba8a201988d8254d33836a355a6bb98748fed8432ad47b5464594a6baa9c24ae843e373cffa7b1c0612cbeee66
+  data.tar.gz: 30b0d2b5289f52036d72d4062d7940075ab261e6d0a6f2dafe5ba39d04a6f21a7df18cda72ff4e4682ea95723d8d05f2a5bb02018e6876f24b411f1b7eb57b96

data/Gemfile.lock

@@ -1,13 +1,13 @@
 PATH
   remote: .
   specs:
-    spree_vpago (2.3.13.pre.pre1)
+    spree_vpago (2.3.13)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)
       spree_backend (>= 4.5)
       spree_core (>= 4.5)
-      spree_extension (< 1.0)
+      spree_extension
       spree_multi_vendor (>= 2.4.1)
 
 GEM

data/app/assets/config/spree_vpago_manifest.js

@@ -1,5 +1,4 @@
 //= link_tree ../images
 //= link vpago/vpago_payments/check_transaction_periodically.js
-//= link vpago/vpago_payments/create_transaction.js
 //= link vpago/vpago_payments/request_process_payment.js
 //= link vpago/vpago_payments/user_informers/firebase.js

data/app/controllers/spree/vpago_payments_controller.rb

@@ -23,6 +23,11 @@ module Spree
     # GET
     def processing
       @order = @payment.order
+
+      # Common, not an edge case: the gateway callback or the checkout page's transaction
+      # checker often completes the order before the browser lands here. Skipping this page
+      # also skips its Firebase listener, so success must post order_is_completed itself
+      # (render_success_script) or an embedding iframe modal never closes.
       return redirect_to @payment.success_url, allow_other_host: true if @order.completed?
 
       VpagoLogger.log(label: 'Spree::VpagoPaymentsController#processing', data: vpago_log_context)
@@ -69,27 +74,6 @@ module Spree
       render json: { status: :pending }, status: :ok
     end
 
-    # POST
-    def create_transaction
-      @payment = Vpago::PaymentFinder.new(params.permit!.to_h).find_and_verify
-      raise ActiveRecord::RecordNotFound unless @payment.present?
-
-      return render json: { error: true, message: 'unsupported' }, status: :not_implemented unless @payment.payment_method.support_create_transaction_api?
-
-      result = VpagoLogger.log(
-        label: 'Spree::VpagoPaymentsController#create_transaction',
-        data: vpago_log_context
-      ) { @payment.payment_method.create_transaction(@payment, platform: params[:platform]) }
-
-      render json: result, status: :ok
-    rescue Faraday::Error, JSON::ParserError, NoMethodError => e
-      VpagoLogger.error(
-        label: 'Spree::VpagoPaymentsController#create_transaction failed',
-        data: vpago_log_context(error_class: e.class.name, error_message: e.message)
-      )
-      render json: { error: true, message: 'Failed to create transaction' }, status: :bad_gateway
-    end
-
     # POST
     def process_payment
       return render json: { status: :ok }, status: :ok if request.method != 'POST'
@@ -174,9 +158,9 @@ module Spree
       raise ActiveRecord::RecordNotFound unless @payment.present?
     end
 
-    # frame-ancestors (set above) supersedes X-Frame-Options in modern
-    # browsers, but the default SAMEORIGIN header would still block legacy
-    # browsers from embedding these pages, so drop it for the iframe actions.
+    # These pages are embedded in iframes on many partner sites we don't
+    # enumerate, so framing is left unrestricted: no frame-ancestors policy, and
+    # Rails' default SAMEORIGIN header is dropped for the iframe actions.
     def allow_iframe_embedding
       response.headers.delete('X-Frame-Options')
     end

data/app/helpers/vpago/vpago_payments_helper.rb

@@ -13,6 +13,12 @@ module Vpago
       render partial: 'spree/vpago_payments/transaction_checker'
     end
 
+    # Host apps override success.html.erb; call this from every override so an
+    # embedding iframe modal still learns the order completed.
+    def render_success_script
+      render partial: 'spree/vpago_payments/success_script'
+    end
+
     # Each payment method may have their own additional processing script,
     # so we will look for the partial based on the payment method class name.
     #

data/app/models/spree/gateway/payway_v2.rb

@@ -168,12 +168,6 @@ module Spree
       checker
     end
 
-    def create_transaction(payment, options = {})
-      creator = Vpago::PaywayV2::TransactionCreator.new(payment, disable_return_deeplink: options[:platform] == 'web')
-      creator.call
-      creator.json_response
-    end
-
     private
 
     def cancel_pre_auth(payment)

data/app/models/spree/gateway/true_money.rb

@@ -78,9 +78,5 @@ module Spree
       checker.call
       checker
     end
-
-    def create_transaction(payment, options = {})
-      Vpago::TrueMoney::Checkout.new(payment).generate_payment_urls(options[:platform])
-    end
   end
 end

data/app/models/vpago/payment_decorator.rb

@@ -24,7 +24,6 @@ module Vpago
                     :success_url,
                     :success_deeplink_url,
                     :check_transaction_url,
-                    :create_transaction_url,
                     :process_payment_url,
                     to: :url_constructor
 

data/app/models/vpago/payment_method_decorator.rb

@@ -43,12 +43,6 @@ module Vpago
       respond_to?(:check_transaction)
     end
 
-    # The payment method must implement `create_transaction(payment, options = {})`,
-    # returning a Hash suitable for `render json:` directly.
-    def support_create_transaction_api?
-      respond_to?(:create_transaction)
-    end
-
     # TODO: we have already implement purchase for payway_v2.
     # make sure to implement this on other payment method as well.
     def purchase(_amount, _source, _gateway_options = {})

data/app/services/vpago/payment_url_constructor.rb

@@ -18,7 +18,6 @@ module Vpago
     def success_deeplink_url = "#{app_scheme}://#{URI(base_url).host}/book/payment?number=#{order.number}&tk=#{order.token}"
 
     def check_transaction_url = "#{base_url}/vpago_payments/check_transaction?#{query}"
-    def create_transaction_url = "#{base_url}/vpago_payments/create_transaction?#{query}"
     def process_payment_url = "#{base_url}/vpago_payments/process_payment?#{query}"
 
     def query

data/app/views/layouts/vpago_payments.html.erb

@@ -11,7 +11,6 @@
   <%= yield :head %>
 
   <%= javascript_include_tag "vpago/vpago_payments/check_transaction_periodically", 'data-turbo-track': 'reload' %>
-  <%= javascript_include_tag "vpago/vpago_payments/create_transaction", 'data-turbo-track': 'reload' %>
   <%= javascript_include_tag "vpago/vpago_payments/request_process_payment", 'data-turbo-track': 'reload' %>
   <%= javascript_include_tag "vpago/vpago_payments/user_informers/#{user_informer}", 'data-turbo-track': 'reload' %>
 </head>

data/app/views/spree/vpago_payments/_success_script.html.erb

@@ -0,0 +1,7 @@
+<script>
+  // processing redirects here without rendering once the order is complete, so its
+  // Firebase listener never posts this. success only renders for completed orders.
+  if (window.parent !== window) {
+    window.parent.postMessage("order_is_completed", "*");
+  }
+</script>

data/app/views/spree/vpago_payments/forms/spree/gateway/_payway_v2.html.erb

@@ -43,48 +43,55 @@
   }
 
   function submitFormViaJs(){
-    window.createTransaction({
-      url: "<%= raw @payment.create_transaction_url %>&platform=<%= params[:platform] %>",
-      onSuccess: function(data) {
-        console.log("[Vpago] checkout response data:", JSON.stringify(data));
-
-        // When status code is 4 (duplicated transaction),
-        // Possibly user refresh the checkout page even after the transaction is completed.
-        // So in this case, we should hide loading spinner and show redirect container UI
-        // While it check transaction status in the background. It will automatically redirect user to the result page after checking.
-        if (data.status.code === 4){
-          showRedirectContainer();
-          return;
-        }
+    var formData = new FormData(document.getElementById("aba_merchant_request"));
+    var checkoutUrl = document.getElementById("aba_merchant_request").action;
 
-        let deeplinkTriggered = false;
+    fetch(checkoutUrl, {
+      method: "POST",
+      body: formData
+    })
+    .then(function(response) {
+      return response.json();
+    })
+    .then(function(data) {
+      console.log("[Vpago] checkout response data:", JSON.stringify(data));
 
-        if (data.abapay_deeplink && shouldOpenAbaPayDeeplink) {
-          window.location.href = data.abapay_deeplink;
-          deeplinkTriggered = true;
-        }
+      // When status code is 4 (duplicated transaction),
+      // Possibly user refresh the checkout page even after the transaction is completed.
+      // So in this case, we should hide loading spinner and show redirect container UI
+      // While it check transaction status in the background. It will automatically redirect user to the result page after checking.
+      if (data.status.code === 4){
+        showRedirectContainer();
+        return;
+      }
+
+      let deeplinkTriggered = false;
 
-        if (data.checkout_qr_url && shouldOpenCheckoutUrl) {
-          // If a deeplink is triggered, add a short delay before navigating to the checkout URL.
-          // Without this delay, some platforms (especially Android) may ignore or cancel the deeplink
-          // because a second navigation happens too quickly.
-          if (deeplinkTriggered){
-            setTimeout(() => {
-              window.location.href = data.checkout_qr_url;
-            }, 300);
-          } else {
+      if (data.abapay_deeplink && shouldOpenAbaPayDeeplink) {
+        window.location.href = data.abapay_deeplink;
+        deeplinkTriggered = true;
+      }
+
+      if (data.checkout_qr_url && shouldOpenCheckoutUrl) {
+        // If a deeplink is triggered, add a short delay before navigating to the checkout URL.
+        // Without this delay, some platforms (especially Android) may ignore or cancel the deeplink
+        // because a second navigation happens too quickly.
+        if (deeplinkTriggered){
+          setTimeout(() => {
             window.location.href = data.checkout_qr_url;
-          }
+          }, 300);
+        } else {
+          window.location.href = data.checkout_qr_url;
         }
+      }
 
-        var shouldShowRedirectContainer = !shouldOpenCheckoutUrl && shouldOpenAbaPayDeeplink;
-        if(shouldShowRedirectContainer){
-          showRedirectContainer("Open ABA Mobile", () => window.location.href = data.abapay_deeplink);
-        }
-      },
-      onError: function() {
-        document.getElementById('vpago_loading_container').textContent = "We couldn't start your payment. Please go back and try again.";
+      var shouldShowRedirectContainer = !shouldOpenCheckoutUrl && shouldOpenAbaPayDeeplink;
+      if(shouldShowRedirectContainer){
+        showRedirectContainer("Open ABA Mobile", () => window.location.href = data.abapay_deeplink);
       }
+    })
+    .catch(function(error) {
+      console.error("Payment request failed:", error);
     });
   }
 

data/app/views/spree/vpago_payments/forms/spree/gateway/_true_money.html.erb

@@ -1,3 +1,6 @@
+<% @checkout = ::Vpago::TrueMoney::Checkout.new(@payment) %>
+<% redirect_urls = @checkout.generate_payment_urls(params[:platform]) %>
+
 <script>
   function showRedirectContainer(buttonLabel, onClick) {
     const loadingContainer = document.getElementById('vpago_loading_container');
@@ -13,22 +16,19 @@
 
   document.addEventListener("DOMContentLoaded", () => {
     const platform = "<%= params[:platform] %>";
+    const redirectUrls = <%= redirect_urls.to_json.html_safe %>;
 
-    window.createTransaction({
-      url: "<%= raw @payment.create_transaction_url %>&platform=<%= params[:platform] %>",
-      onSuccess: function(redirectUrls) {
-        if (platform === "app") {
-          window.location.href = redirectUrls.deeplink;
-          setTimeout(() => {
-            window.location.href = redirectUrls.webview;
-          }, 1500);
-        } else {
-          window.open(redirectUrls.webview, '_blank');
-        }
-      },
-      onError: function() {
-        document.getElementById('vpago_loading_container').textContent = "We couldn't start your payment. Please go back and try again.";
+    function setupConfirmPaymentButton() {
+      if (platform === "app") {
+        window.location.href = redirectUrls.deeplink;
+        setTimeout(() => {
+          window.location.href = redirectUrls.webview;
+        }, 1500);
+      } else {
+        window.open(redirectUrls.webview, '_blank');
       }
-    });
+    }
+
+    setupConfirmPaymentButton();
   });
 </script>

data/app/views/spree/vpago_payments/success.html.erb

@@ -1,3 +1,5 @@
 <h1>
   Success
 </h1>
+
+<%= render_success_script %>

data/config/routes.rb

@@ -24,7 +24,6 @@ Spree::Core::Engine.add_routes do
       get :success
 
       match :check_transaction, via: %i[get]
-      match :create_transaction, via: %i[post]
       match :process_payment, via: %i[get post]
       match :true_money_process_payment, via: %i[get post]
     end

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.3.13-pre1'.freeze
+  VERSION = '2.3.13'.freeze
 
   def version
     Gem::Version.new VERSION

data/spree_vpago.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |s|
   s.add_dependency 'spree_api', spree_version
   s.add_dependency 'spree_backend', spree_version
   s.add_dependency 'spree_core', spree_version
-  s.add_dependency 'spree_extension', '< 1.0'
+  s.add_dependency 'spree_extension'
   s.add_dependency 'spree_multi_vendor', '>= 2.4.1'
 
   s.metadata['rubygems_mfa_required'] = 'true'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.3.13.pre.pre1
+  version: 2.3.13
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-17 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -84,16 +84,16 @@ dependencies:
   name: spree_extension
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: spree_multi_vendor
   requirement: !ruby/object:Gem::Requirement
@@ -147,7 +147,6 @@ files:
 - app/assets/images/vpago/payway/abapay.png
 - app/assets/images/vpago/payway/cards.png
 - app/assets/javascripts/vpago/vpago_payments/check_transaction_periodically.js
-- app/assets/javascripts/vpago/vpago_payments/create_transaction.js
 - app/assets/javascripts/vpago/vpago_payments/request_process_payment.js
 - app/assets/javascripts/vpago/vpago_payments/user_informers/firebase.js
 - app/controllers/.gitkeep
@@ -345,6 +344,7 @@ files:
 - app/views/spree/payway_results/success.html.erb
 - app/views/spree/payway_v2_card_popups/_form.html.erb
 - app/views/spree/payway_v2_card_popups/show.html.erb
+- app/views/spree/vpago_payments/_success_script.html.erb
 - app/views/spree/vpago_payments/_transaction_checker.html.erb
 - app/views/spree/vpago_payments/checkout.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb
@@ -425,7 +425,6 @@ files:
 - lib/vpago/payway_v2/payouts_params_constructor.rb
 - lib/vpago/payway_v2/pre_auth_canceler.rb
 - lib/vpago/payway_v2/pre_auth_completer.rb
-- lib/vpago/payway_v2/transaction_creator.rb
 - lib/vpago/payway_v2/transaction_status.rb
 - lib/vpago/payway_v2/transaction_status_v2.rb
 - lib/vpago/true_money/base.rb
@@ -467,9 +466,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements:
 - none
 rubygems_version: 3.4.1

data/app/assets/javascripts/vpago/vpago_payments/create_transaction.js

@@ -1,35 +0,0 @@
-/**
- * Calls our own server, which creates the bank transaction on the browser's
- * behalf and returns the bank's response as JSON.
- *
- * @param {Object} options
- * @param {string} options.url
- * @param {Function} options.onSuccess
- * @param {Function} options.onError
- */
-async function createTransaction({ url, onSuccess, onError }) {
-  try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        "X-CSRF-Token": document
-          .querySelector('meta[name="csrf-token"]')
-          .getAttribute("content"),
-      },
-    });
-    const data = await response.json();
-
-    if (!response.ok || data.error) {
-      console.error("[Vpago] createTransaction failed:", JSON.stringify(data));
-      onError(data);
-      return;
-    }
-
-    onSuccess(data);
-  } catch (error) {
-    console.error("[Vpago] createTransaction request failed:", error);
-    onError(error);
-  }
-}
-
-window.createTransaction = createTransaction;

data/lib/vpago/payway_v2/transaction_creator.rb

@@ -1,29 +0,0 @@
-require 'faraday'
-
-module Vpago
-  module PaywayV2
-    class TransactionCreator < Checkout
-      def call
-        @response = submit_transaction
-      end
-
-      def json_response
-        @json_response ||= JSON.parse(@response.body)
-      rescue JSON::ParserError
-        {}
-      end
-
-      private
-
-      def submit_transaction
-        conn = Faraday::Connection.new do |faraday|
-          faraday.request :url_encoded
-          faraday.options.open_timeout = Vpago::HttpTimeouts::OPEN_TIMEOUT
-          faraday.options.timeout = Vpago::HttpTimeouts::TIMEOUT
-        end
-
-        conn.post(checkout_url, gateway_params)
-      end
-    end
-  end
-end