spree_vpago 2.3.13 → 2.3.14.pre.pre1

data/app/views/spree/vpago_payments/forms/spree/gateway/_wing_mini_app.html.erb

@@ -0,0 +1,88 @@
+<% content_for :head do %>
+  <%= javascript_include_tag 'vpago/wing_mini_app/web_jsbridge.bundle', 'data-turbo-track': 'reload' %>
+<% end %>
+
+<% checkout = ::Vpago::WingMiniApp::Checkout.new(@payment) %>
+
+<p id="wing-message"
+   style="margin-top: 10px; font-weight: bold; color: red; display: none;">
+</p>
+
+<script>
+  function showRedirectContainer(buttonLabel, onClick) {
+    const loadingContainer = document.getElementById('vpago_loading_container');
+    const redirectContainer = document.getElementById('vpago_redirect_container');
+    const redirectButton = document.getElementById('vpago_redirect_button');
+
+    redirectButton.textContent = buttonLabel;
+    redirectButton.addEventListener('click', onClick);
+
+    loadingContainer.style.display = 'none';
+    redirectContainer.style.removeProperty('display');
+  }
+
+  function showError(detail) {
+    console.error('[Wing] ' + detail);
+
+    const message = document.getElementById('wing-message');
+    message.innerText = "We couldn't start your Wing payment.";
+    message.style.display = 'block';
+  }
+
+  document.addEventListener('DOMContentLoaded', () => {
+    const processingUrl = "<%= raw @payment.processing_url %>";
+    const bridge = window.WebJSBridge && window.WebJSBridge.$bridge;
+
+    if (!bridge || !bridge.isAvailable()) {
+      showError('This page only works inside the Wing app.');
+      return;
+    }
+
+    // Whichever signal lands first wins; the rest are then noise from the same
+    // payment. Also keeps the fallback button from replacing a page already leaving.
+    let handedOff = false;
+
+    const goToProcessing = () => {
+      if (handedOff) return;
+      handedOff = true;
+
+      window.location.replace(processingUrl);
+    };
+
+    const startPayment = () => {
+      // Screen only, both here and in the relay below. Settlement stays server to
+      // server, where WebhookVerifier checks Wing's webhook before anything is
+      // captured, and the processing page keeps polling until that lands — so it is
+      // the safe destination even for a payment that failed.
+      bridge
+        .callHandler('doPayment', <%= raw checkout.signed_payload.to_json %>)
+        .then(() => goToProcessing())
+        .catch((error) => showError('doPayment call failed: ' + error.message));
+    };
+
+    // Wing delivers native -> web calls by evaluating JS against the main frame,
+    // which is our web app embedding this page, not this document — so in a framed
+    // checkout it is mini_app/wing_bridge.js over there that hears getStatus and
+    // posts the bare code on. Sender identity, not origin: this page and the web app
+    // are deliberately on different hosts.
+    window.addEventListener('message', (event) => {
+      if (event.source !== window.parent) return;
+      if (!event.data || event.data.code !== 'wing_payment_status') return;
+
+      goToProcessing();
+    });
+
+    // The same signal for an unframed checkout, where this document *is* the main
+    // frame and Wing reaches it directly.
+    bridge.registerHandler('getStatus', () => goToProcessing());
+
+    startPayment();
+
+    setTimeout(() => {
+      if (document.visibilityState === 'hidden') return;
+      if (handedOff) return;
+
+      showRedirectContainer('Pay with Wing', startPayment);
+    }, 1000);
+  });
+</script>

data/app/views/spree/vpago_payments/processing_scripts/spree/gateway/_wing_mini_app.html.erb

@@ -0,0 +1,15 @@
+<script>
+  // Wing settles only on its webhook — #purchase reads nothing but the
+  // transaction_response PaymentFinder stores on callback, and there is no status
+  // API to ask instead. Processing before it lands paints "Payment process failed"
+  // over a payment already debited, so skip it; the webhook enqueues
+  // PaymentProcessorJob itself.
+  //
+  // The replacement holds because the real definition is a classic script in the
+  // layout's head while vpago_payment_controller only connects at domReady, leaving
+  // this inline script in between. Load either of those differently and it stops —
+  // the log is how you would notice.
+  window.requestProcessPayment = function () {
+    return Promise.resolve();
+  };
+</script>

data/config/routes.rb

@@ -17,6 +17,20 @@ Spree::Core::Engine.add_routes do
     resources :transactions, only: [:show]
   end
 
+  namespace :mini_app do
+    # ACLEDA calls POST /mini_app/acleda with { phone, first_name, last_name }
+    # and receives a session-based miniAppUrl.
+    resources :acleda, only: [:create], controller: 'acledas'
+
+    # Wing Mini App WebView entry. Wing opens GET /mini_app/wing cold and the page
+    # itself authenticates via getProfile.
+    resource :wing, only: %i[show create], controller: 'wings' do
+      # Wing's settlement webhook: #callback verifies the payment via PaymentFinder and
+      # queues PaymentProcessorJob to complete the order unless it is already paid.
+      post :callback, on: :collection
+    end
+  end
+
   resource :vpago_payments do
     collection do
       get :checkout

data/lib/spree_vpago/engine.rb

@@ -23,8 +23,10 @@ module SpreeVpago
         Spree::Gateway::Acleda,
         Spree::Gateway::AcledaV2,
         Spree::Gateway::AcledaMobile,
+        Spree::Gateway::AcledaMiniApp,
         Spree::Gateway::Vattanac,
         Spree::Gateway::VattanacMiniApp,
+        Spree::Gateway::WingMiniApp,
         Spree::Gateway::TrueMoney,
         Spree::PaymentMethod::CashOn
       )

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.3.13'.freeze
+  VERSION = '2.3.14-pre1'.freeze
 
   def version
     Gem::Version.new VERSION

data/lib/vpago/acleda_mini_app/checkout.rb

@@ -0,0 +1,19 @@
+module Vpago
+  module AcledaMiniApp
+    # ACLEDA Mini App checkout. Reuses ACLEDA V2's openSessionV2 flow to obtain the deeplink
+    # the payment page opens, instead of redirecting the page to ACLEDA.
+    class Checkout < Vpago::AcledaV2::Checkout
+      # The mini app always pays by deeplink, regardless of the gateway's configured mode.
+      def deeplink?
+        true
+      end
+
+      # The deeplink _acleda_mini_app.html.erb opens. Ensures openSessionV2 has run
+      # (persisting paymentTokenid for the later getTxnStatus check) before returning it.
+      def acleda_deeplink
+        call if @response.nil?
+        deeplink_url
+      end
+    end
+  end
+end

data/lib/vpago/acleda_mini_app/session_hash_validator.rb

@@ -0,0 +1,35 @@
+module Vpago
+  module AcledaMiniApp
+    # Verifies the HMAC-SHA256 signature ACLEDA sends via the X-Acleda-Signature
+    # header on the Session Initialization request (POST /mini_app/acleda), before
+    # we look up or create the user. Mirrors AcledaMobile::CallbackValidator's
+    # keyed-HMAC pattern, but out-of-band in a header instead of the JSON body.
+    class SessionHashValidator
+      def initialize(options)
+        @options = options
+      end
+
+      def call
+        valid?
+      end
+
+      # The key ACLEDA signs with lives only on their Spree::OauthApplication
+      # (MiniAppProvider::AcledaBank#secret_key), so it can be rotated from the admin
+      def secret_key
+        @options[:secret_key].presence
+      end
+
+      def valid?
+        return false if secret_key.blank? || @options[:hash].blank?
+
+        ActiveSupport::SecurityUtils.secure_compare(computed_hash, @options[:hash].to_s)
+      end
+
+      def computed_hash
+        message = "#{@options[:phone]}#{@options[:first_name]}#{@options[:last_name]}"
+
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), secret_key, message)
+      end
+    end
+  end
+end

data/lib/vpago/wing_mini_app/checkout.rb

@@ -0,0 +1,60 @@
+module Vpago
+  module WingMiniApp
+    # Builds the doPayment() payload (Wing Web JS Bridge SDK spec, Native API #2).
+    #
+    # useDefault is hardcoded true for this first cut — no "let the user pick
+    # another account" UI yet, same scope cut as shipping login before payment.
+    class Checkout
+      def initialize(payment)
+        @payment = payment
+      end
+
+      # Pure fields only — no payment_method preference lookup involved, safe to
+      # render/log/test directly. appId is left out here: it needs the gateway's
+      # own app_id, so it's added in #signed_payload alongside additionalKey instead.
+      def payload
+        {
+          account: account,
+          amount: amount,
+          currency: currency,
+          useDefault: true
+        }
+      end
+
+      # The full payload doPayment() actually needs, with appId and the
+      # server-side-only additionalKey.hash merged in. Never render
+      # `secret_api_key` itself into the page — only this derived hash.
+      def signed_payload
+        payload.merge(appId: app_id, additionalKey: { hash: hash, remark: '' })
+      end
+
+      def account
+        @payment.number
+      end
+
+      def amount
+        format('%.2f', @payment.amount)
+      end
+
+      def currency
+        @payment.currency
+      end
+
+      private
+
+      def app_id
+        payment_method.app_id
+      end
+
+      # uppercase(account+amount+currency+secretApiKey), per the spec.
+      def hash
+        plaintext = "#{account}#{amount}#{currency}#{payment_method.secret_api_key}"
+        Digest::SHA256.hexdigest(plaintext.upcase).upcase
+      end
+
+      def payment_method
+        @payment.payment_method
+      end
+    end
+  end
+end

data/lib/vpago/wing_mini_app/webhook_verifier.rb

@@ -0,0 +1,78 @@
+module Vpago
+  module WingMiniApp
+    # Verifies a Wing getStatus/webhook payload (Wing Web JS Bridge SDK spec,
+    # Native-App Invoke #1 getStatus) is both authentic and correct for the
+    # payment it claims to settle. Both checks live here, in one place:
+    #
+    # - the secretKey signature (proves Wing sent this, for this orderRef —
+    #   unlike getProfile, appId is our own configured value here, not a payload
+    #   field, since the spec's getStatus response never includes one)
+    # - the doc-mandated amount/currency match (catches a validly-signed webhook
+    #   that reports the wrong amount, since Wing holds the keys and could sign
+    #   any amount for a real orderRef if something on their end got it wrong —
+    #   not a forgery guard, since orderRef is itself part of what secretKey
+    #   signs, so a valid signature is already bound to exactly this payment)
+    class WebhookVerifier
+      FIELDS = %w[orderRef debitAmount debitCcy transactionId transactionDate].freeze
+
+      # payment is the specific one this settlement claims to be for — both what
+      # verifies the signature (via its own payment_method's app_id/secret_api_key)
+      # and what the amount/currency check runs against.
+      def initialize(payload, payment)
+        @payload = payload.with_indifferent_access
+        @payment = payment
+      end
+
+      def valid?
+        valid_signature? && amount_matches?
+      end
+
+      private
+
+      attr_reader :payload, :payment
+
+      def payment_method
+        payment.payment_method
+      end
+
+      def valid_signature?
+        received = payload['secretKey']
+        received.present? && candidates.value?(received.to_s.upcase)
+      end
+
+      # Numeric comparison, not string: Wing's own spec says debitAmount is always
+      # 2-decimal ("1.00"), but real payloads have sent "1" (no decimals) — same
+      # kind of spec-vs-reality gap as getProfile's `sex` field.
+      def amount_matches?
+        payment.amount == BigDecimal(payload['debitAmount'].to_s) &&
+          payment.currency.to_s.casecmp(payload['debitCcy'].to_s).zero?
+      rescue ArgumentError, TypeError
+        false
+      end
+
+      # Same spec-vs-reality gap, applied to the signature itself: Wing's own
+      # secretKey may have been computed against the canonical 2-decimal
+      # debitAmount even though what actually reached us isn't. Try both so a
+      # formatting-only mismatch between what Wing hashed and what Wing sent
+      # still verifies.
+      def candidates
+        {
+          raw: hash_for(payload['debitAmount'].to_s),
+          normalized: hash_for(normalized_debit_amount)
+        }
+      end
+
+      def normalized_debit_amount
+        format('%.2f', BigDecimal(payload['debitAmount'].to_s))
+      rescue ArgumentError, TypeError
+        payload['debitAmount'].to_s
+      end
+
+      def hash_for(debit_amount)
+        fields = FIELDS.map { |field| field == 'debitAmount' ? debit_amount : payload[field].to_s }.join
+        plaintext = "#{payment_method.app_id}#{fields}#{payment_method.secret_api_key}"
+        Digest::SHA256.hexdigest(plaintext.upcase).upcase
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.3.13
+  version: 2.3.14.pre.pre1
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-30 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -149,7 +149,10 @@ files:
 - app/assets/javascripts/vpago/vpago_payments/check_transaction_periodically.js
 - app/assets/javascripts/vpago/vpago_payments/request_process_payment.js
 - app/assets/javascripts/vpago/vpago_payments/user_informers/firebase.js
+- app/assets/javascripts/vpago/wing_mini_app/login.js
+- app/assets/javascripts/vpago/wing_mini_app/web_jsbridge.bundle.js
 - app/controllers/.gitkeep
+- app/controllers/concerns/spree/mini_app_concern.rb
 - app/controllers/spree/acleda_redirects_controller.rb
 - app/controllers/spree/admin/payment_acleda_v2_base_controller.rb
 - app/controllers/spree/admin/payment_acleda_v2_checkers_controller.rb
@@ -173,6 +176,8 @@ files:
 - app/controllers/spree/admin/payouts_controller.rb
 - app/controllers/spree/admin/suspicious_orders_controller.rb
 - app/controllers/spree/api/v2/storefront/checkout_controller_decorator.rb
+- app/controllers/spree/mini_app/acledas_controller.rb
+- app/controllers/spree/mini_app/wings_controller.rb
 - app/controllers/spree/payway_card_popups_controller.rb
 - app/controllers/spree/payway_results_controller.rb
 - app/controllers/spree/payway_v2_card_popups_controller.rb
@@ -198,6 +203,7 @@ files:
 - app/models/.gitkeep
 - app/models/concerns/vpago/payoutable.rb
 - app/models/spree/gateway/acleda.rb
+- app/models/spree/gateway/acleda_mini_app.rb
 - app/models/spree/gateway/acleda_mobile.rb
 - app/models/spree/gateway/acleda_v2.rb
 - app/models/spree/gateway/payway.rb
@@ -205,6 +211,7 @@ files:
 - app/models/spree/gateway/true_money.rb
 - app/models/spree/gateway/vattanac.rb
 - app/models/spree/gateway/vattanac_mini_app.rb
+- app/models/spree/gateway/wing_mini_app.rb
 - app/models/spree/gateway/wing_sdk.rb
 - app/models/spree/payment_method/cash_on.rb
 - app/models/spree/payout.rb
@@ -262,6 +269,7 @@ files:
 - app/serializers/spree/v2/storefront/payment_serializer_decorator.rb
 - app/serializers/spree/v2/storefront/vpago_payment_source_serializer.rb
 - app/services/.gitkeep
+- app/services/vpago/acleda_mini_app/session/create.rb
 - app/services/vpago/aes_encrypter.rb
 - app/services/vpago/payment_finder.rb
 - app/services/vpago/payment_processable.rb
@@ -278,17 +286,20 @@ files:
 - app/services/vpago/rsa_handler.rb
 - app/services/vpago/user_informers/firebase.rb
 - app/services/vpago/vattanac_mini_app_data_handler.rb
+- app/services/vpago/wing_mini_app/session/create.rb
 - app/views/.gitkeep
 - app/views/layouts/acleda.html.erb
 - app/views/layouts/payway.html.erb
 - app/views/layouts/payway_v2.html.erb
 - app/views/layouts/vpago_payments.html.erb
 - app/views/layouts/wing.html.erb
+- app/views/layouts/wing_mini_app.html.erb
 - app/views/spree/_payment_icon.html.erb
 - app/views/spree/acleda_redirects/show.html.erb
 - app/views/spree/admin/payments/source_forms/_payment_payway.html.erb
 - app/views/spree/admin/payments/source_forms/_payway_v2.html.erb
 - app/views/spree/admin/payments/source_views/_acleda.html.erb
+- app/views/spree/admin/payments/source_views/_acleda_mini_app.html.erb
 - app/views/spree/admin/payments/source_views/_acleda_mobile.html.erb
 - app/views/spree/admin/payments/source_views/_acleda_v2.html.erb
 - app/views/spree/admin/payments/source_views/_payment_payway.html.erb
@@ -297,6 +308,7 @@ files:
 - app/views/spree/admin/payments/source_views/_vattanac.html.erb
 - app/views/spree/admin/payments/source_views/_vattanac_mini_app.html.erb
 - app/views/spree/admin/payments/source_views/_vpago_payment_tmpl.html.erb
+- app/views/spree/admin/payments/source_views/_wing_mini_app.html.erb
 - app/views/spree/admin/payments/source_views/_wingsdk.html.erb
 - app/views/spree/admin/payout_profile_products/_form.html.erb
 - app/views/spree/admin/payout_profile_products/edit.html.erb
@@ -338,6 +350,7 @@ files:
 - app/views/spree/checkout/payment/payway_form.html.erb
 - app/views/spree/checkout/payment/payway_v2_form.html.erb
 - app/views/spree/checkout/payment/wingsdk_form.html.erb
+- app/views/spree/mini_app/wings/show.html.erb
 - app/views/spree/payway_card_popups/_form.html.erb
 - app/views/spree/payway_card_popups/show.html.erb
 - app/views/spree/payway_results/failed.html.erb
@@ -347,13 +360,16 @@ files:
 - app/views/spree/vpago_payments/_success_script.html.erb
 - app/views/spree/vpago_payments/_transaction_checker.html.erb
 - app/views/spree/vpago_payments/checkout.html.erb
+- app/views/spree/vpago_payments/forms/spree/gateway/_acleda_mini_app.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_payway_v2.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_true_money.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac_mini_app.html.erb
+- app/views/spree/vpago_payments/forms/spree/gateway/_wing_mini_app.html.erb
 - app/views/spree/vpago_payments/processing.html.erb
 - app/views/spree/vpago_payments/processing_scripts/spree/gateway/_payway_v2.html.erb
+- app/views/spree/vpago_payments/processing_scripts/spree/gateway/_wing_mini_app.html.erb
 - app/views/spree/vpago_payments/success.html.erb
 - app/views/spree/wing_redirects/show.html.erb
 - bin/rails
@@ -398,6 +414,8 @@ files:
 - lib/vpago/acleda/deeplink_checkout.rb
 - lib/vpago/acleda/payment_request_updater.rb
 - lib/vpago/acleda/transaction_status.rb
+- lib/vpago/acleda_mini_app/checkout.rb
+- lib/vpago/acleda_mini_app/session_hash_validator.rb
 - lib/vpago/acleda_mobile/base.rb
 - lib/vpago/acleda_mobile/callback_validator.php
 - lib/vpago/acleda_mobile/callback_validator.rb
@@ -438,6 +456,8 @@ files:
 - lib/vpago/vattanac_mini_app/base.rb
 - lib/vpago/vattanac_mini_app/checkout.rb
 - lib/vpago/vattanac_mini_app/refund_issuer.rb
+- lib/vpago/wing_mini_app/checkout.rb
+- lib/vpago/wing_mini_app/webhook_verifier.rb
 - lib/vpago/wing_sdk/base.rb
 - lib/vpago/wing_sdk/checkout.rb
 - lib/vpago/wing_sdk/payment_request_updater.rb
@@ -466,9 +486,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements:
 - none
 rubygems_version: 3.4.1