spree_vpago 2.3.2 → 2.3.5.pre.pre.pre.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40b1b2417da2209fc3545dc75fb99354e9fd009adc565d3c4d920b59f18c4655
-  data.tar.gz: dbb1754379d9378dcbfb9fb1d225b7c73628475ae1155e1ad5b198df1e323535
+  metadata.gz: c0262a0bad21d6ed9d53d73ba6805f307e6b9f82db837ac96fe4f3c4725ae49b
+  data.tar.gz: 71f83ae18d1c306419bbef87f291185e1835a653fde1d1f0a09e1c783cf6f54c
 SHA512:
-  metadata.gz: 007761d54598f02ee411f16962eec6ad167eb5eb4623f11f27c8e278e05b2fbc023f71ef4ed3e8eb723870692d83d25155f3fffd85d9fd7880057a9fa1ba2791
-  data.tar.gz: a5ddf6866c3905d6b12224388e9a1b91ad3b19dbdd7fa6dfd936b23227081d8910820795678fac206a7384066e479ae851a23f75dd035abd62abcf47d9e25446
+  metadata.gz: ffc03cf77c82129ee5cf13ca1d3abb1646a9d39878ea647e1fd2451c30c027a885d8e8cb99fe45fabef2d7308c73f70c11b654ef9043b59814ef4737a983392c
+  data.tar.gz: cde29375e88d3428cd5854b47bb597fac4697eaf60550dfb74573dd0d5edff55624ea0df78659328ba40343548c39b60d4284fe7c6bfcd495a24ba405b82fcea

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    spree_vpago (2.3.2)
+    spree_vpago (2.3.5.pre.pre.pre.1)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/spree/vpago_payments_controller.rb

@@ -17,7 +17,7 @@ module Spree
 
       @order = @payment.order
 
-      Rails.logger.info("[Vpago][#{@payment.number}] Showing checkout page for order #{@order.number}")
+      VpagoLogger.log(label: 'Spree::VpagoPaymentsController#checkout', data: vpago_log_context)
     end
 
     # GET
@@ -27,7 +27,7 @@ module Spree
 
       @order = @payment.order
 
-      Rails.logger.info("[Vpago][#{@payment.number}] Showing processing page for order #{@order.number}")
+      VpagoLogger.log(label: 'Spree::VpagoPaymentsController#processing', data: vpago_log_context)
     end
 
     # GET
@@ -38,7 +38,7 @@ module Spree
       @order = @payment.order
       raise CanCan::AccessDenied unless @order.completed?
 
-      Rails.logger.info("[Vpago][#{@payment.number}] Showing success page for order #{@order.number}")
+      VpagoLogger.log(label: 'Spree::VpagoPaymentsController#success', data: vpago_log_context)
     end
 
     # GET
@@ -49,20 +49,21 @@ module Spree
       return render json: { status: :success }, status: :ok if @payment.completed?
       return render json: { status: :failed }, status: :ok if @payment.failed?
 
-      if @payment.payment_method.support_check_transaction_api?
-        Rails.logger.info("[Vpago][#{@payment.number}] Checking transaction for payment #{@payment.number}")
-        checker = @payment.payment_method.check_transaction(@payment)
-        Rails.logger.info("[Vpago][#{@payment.number}] Check transaction result for payment #{@payment.number} with success: #{checker.success?}, failed: #{checker.try(:failed?)}")
-
-        if checker.success?
-          render json: { status: :success }, status: :ok
-        elsif checker.try(:failed?) == true
-          render json: { status: :failed }, status: :ok
-        else
-          render json: { status: :pending }, status: :ok
-        end
+      unless @payment.payment_method.support_check_transaction_api?
+        VpagoLogger.log(label: 'Spree::VpagoPaymentsController#check_transaction unsupported', data: vpago_log_context)
+        return render json: { status: :pending }, status: :ok
+      end
+
+      checker = VpagoLogger.log(
+        label: 'Spree::VpagoPaymentsController#check_transaction',
+        data: vpago_log_context
+      ) { @payment.payment_method.check_transaction(@payment) }
+
+      if checker.success?
+        render json: { status: :success }, status: :ok
+      elsif checker.try(:failed?) == true
+        render json: { status: :failed }, status: :ok
       else
-        Rails.logger.info("[Vpago][#{@payment.number}] Payment method does not support check transaction API")
         render json: { status: :pending }, status: :ok
       end
     end
@@ -75,30 +76,35 @@ module Spree
       @payment = Vpago::PaymentFinder.new(return_params).find_and_verify
 
       if @payment.nil?
-        Rails.logger.error("[Vpago] Payment not found for params: #{return_params}")
+        VpagoLogger.error(
+          label: 'Spree::VpagoPaymentsController#process_payment payment_not_found',
+          data: vpago_log_context(params: return_params)
+        )
         return render_not_found
       end
 
-      Rails.logger.info("[Vpago][#{@payment.number}] Payment found: #{@payment&.number}, order: #{@payment&.order&.number}")
+      VpagoLogger.log(label: 'Spree::VpagoPaymentsController#process_payment payment_found', data: vpago_log_context)
 
       # for ABA reviewing mode, we can disable pushback from bank, and only process it from our app UI instead.
       # This will give ABA team to know that we don't rely on just pushback and have fallback to process payment.
       if @payment.payment_method.type_payway_v2? && @payment.payment_method.reviewing_mode? && request_from_external_server?
-        Rails.logger.info("[Vpago][#{@payment.number}] Received payment notification from bank in reviewing mode, skipping processing")
+        VpagoLogger.log(label: 'Spree::VpagoPaymentsController#process_payment skipped_reviewing_mode', data: vpago_log_context)
         return render json: { status: :ok }, status: :ok
       end
 
       unless @payment.order.paid?
-        Rails.logger.info("[Vpago][#{@payment.number}] Enqueuing payment processor job for payment #{@payment.number}")
-        Vpago::PaymentProcessorJob.perform_later(
-          payment_number: @payment.number
-        )
+        VpagoLogger.log(
+          label: 'Spree::VpagoPaymentsController#process_payment enqueue_payment_processor_job',
+          data: vpago_log_context
+        ) { Vpago::PaymentProcessorJob.perform_later(payment_number: @payment.number) }
       end
 
-      Rails.logger.info("[Vpago][#{@payment.number}] Successfully enqueued payment processor job for payment #{@payment.number}")
       render json: { status: :ok }, status: :ok
     rescue StandardError => e
-      Rails.logger.error("[Vpago][#{@payment&.number}] Failed to enqueue payment processor job: #{e.message}")
+      VpagoLogger.error(
+        label: 'Spree::VpagoPaymentsController#process_payment failed',
+        data: vpago_log_context(error_class: e.class.name, error_message: e.message, backtrace: e.backtrace&.first(5))
+      )
       render json: { status: :internal_server_error, message: 'Failed to enqueue payment processor job' }, status: :internal_server_error
     end
 
@@ -107,14 +113,28 @@ module Spree
       return render json: { status: { code: '000001', message: 'success' }, data: nil }, status: :ok if request.method != 'POST'
 
       @payment = Spree::Payment.find_by(number: params.dig(:data, :external_ref_id))
-      return render_not_found unless @payment
 
-      Vpago::PaymentProcessorJob.perform_later(payment_number: @payment.number) unless @payment.order.paid?
-      Rails.logger.info("[Vpago][#{@payment.number}] Successfully enqueued payment processor job for payment #{@payment.number}")
+      if @payment.nil?
+        VpagoLogger.error(
+          label: 'Spree::VpagoPaymentsController#true_money_process_payment payment_not_found',
+          data: vpago_log_context(external_ref_id: params.dig(:data, :external_ref_id))
+        )
+        return render_not_found
+      end
+
+      unless @payment.order.paid?
+        VpagoLogger.log(
+          label: 'Spree::VpagoPaymentsController#true_money_process_payment enqueue_payment_processor_job',
+          data: vpago_log_context
+        ) { Vpago::PaymentProcessorJob.perform_later(payment_number: @payment.number) }
+      end
 
       render json: { status: { code: '000001', message: 'success' }, data: nil }, status: :ok
     rescue StandardError => e
-      Rails.logger.error("[Vpago][#{@payment&.number}] Failed to enqueue payment processor job: #{e.message}")
+      VpagoLogger.error(
+        label: 'Spree::VpagoPaymentsController#true_money_process_payment failed',
+        data: vpago_log_context(error_class: e.class.name, error_message: e.message, backtrace: e.backtrace&.first(5))
+      )
       render json: { status: :internal_server_error, message: 'Failed to enqueue payment processor job' }, status: :internal_server_error
     end
 
@@ -144,5 +164,17 @@ module Spree
     def request_from_external_server?
       params[:internal_client].blank? || params[:internal_client] == 'false'
     end
+
+    def vpago_log_context(extra = {})
+      {
+        timestamp: Time.current.utc.iso8601(3),
+        remote_ip: request.remote_ip,
+        payment_number: @payment&.number,
+        order_number: @payment&.order&.number,
+        payment_method_type: @payment&.payment_method&.type,
+        payment_method_name: @payment&.payment_method&.name,
+        request_id: request.request_id
+      }.merge(extra)
+    end
   end
 end

data/app/helpers/vpago/admin/base_helper_decorator.rb

@@ -12,6 +12,7 @@ module Vpago
           payway_abapay
           payway_alipay
           payway_wechat
+          acleda_v2
           acleda
           acleda_khqr
           acleda_cards
@@ -28,6 +29,10 @@ module Vpago
         %w[khqr deeplink all]
       end
 
+      def available_acleda_v2_modes
+        Spree::Gateway::AcledaV2::MODES
+      end
+
       def preference_field_for(form, field, options)
         case field
         when 'preferred_acleda_type'
@@ -45,6 +50,8 @@ module Vpago
           return form.select(:preferred_abapay_khqr_deeplink_option, Spree::Gateway::PaywayV2::ABAPAY_KHQR_DEEPLINK_OPTIONS, {}, class: 'fullwidth select2')
         when 'preferred_vattanac_payment_option'
           return form.select(:preferred_vattanac_payment_option, available_vattanac_payment_options, {}, class: 'fullwidth select2')
+        when 'preferred_acleda_v2_mode'
+          return form.select(:preferred_acleda_v2_mode, available_acleda_v2_modes, {}, class: 'fullwidth select2')
         end
         super
       end

data/app/jobs/vpago/payment_processor_job.rb

@@ -5,7 +5,22 @@ module Vpago
 
     def perform(options)
       payment = Spree::Payment.find_by!(number: options[:payment_number])
-      Vpago::PaymentProcessor.new(payment: payment).call
+
+      VpagoLogger.log(
+        label: 'Vpago::PaymentProcessorJob#perform',
+        data: {
+          payment_number: payment.number,
+          order_number: payment.order.number,
+          payment_method_type: payment.payment_method.type,
+          payment_method_name: payment.payment_method.name
+        }
+      ) { Vpago::PaymentProcessor.new(payment: payment).call }
+    rescue StandardError => e
+      VpagoLogger.error(
+        label: 'Vpago::PaymentProcessorJob#perform failed',
+        data: { payment_number: options[:payment_number], error_class: e.class.name, error_message: e.message, backtrace: e.backtrace&.first(5) }
+      )
+      raise
     end
   end
 end

data/app/models/spree/gateway/acleda_v2.rb

@@ -0,0 +1,93 @@
+module Spree
+  class Gateway::AcledaV2 < PaymentMethod
+    MODES = %w[khqr card deeplink].freeze
+
+    # BOOKMEPLUS — sent as the "merchantName" field in getTxnStatus requests
+    preference :merchant_name, :string
+    # e.g. https://epaymentuat.acledabank.com.kh/BOOKMEPLUS/XPAYConnectorServiceInterfaceImplV2/XPAYConnectorServiceInterfaceImplV2RS
+    preference :xpay_service_base_url, :string
+    # e.g. https://epaymentuat.acledabank.com.kh/BOOKMEPLUS/paymentPage.jsp
+    preference :payment_page_url, :string
+    preference :merchant_id, :string
+    preference :login_id, :string
+    preference :password, :string
+    preference :secret, :string # HMAC-SHA512 key
+    preference :payment_expiry_time_in_mn, :integer, default: 5
+    preference :acleda_v2_mode, :string, default: 'khqr'
+
+    validates :preferred_acleda_v2_mode, inclusion: { in: MODES }
+
+    def khqr?
+      preferred_acleda_v2_mode == 'khqr'
+    end
+
+    def card?
+      preferred_acleda_v2_mode == 'card'
+    end
+
+    def deeplink?
+      preferred_acleda_v2_mode == 'deeplink'
+    end
+
+    # KHQR (Scan with Bank under Bakong) = "0"; Credit/debit card = "1"
+    def payment_card_value
+      card? ? '1' : '0'
+    end
+
+    # override: partial to render in admin
+    def method_type
+      'acleda_v2'
+    end
+
+    # override
+    def payment_source_class
+      Spree::VpagoPaymentSource
+    end
+
+    # override
+    def payment_profiles_supported?
+      false
+    end
+
+    # override
+    def available_for_order?(_order)
+      true
+    end
+
+    # override: process! -> purchase! immediately (no pre-auth for ACLEDA V2)
+    def auto_capture?
+      true
+    end
+
+    # override
+    # mirror PayWay V2: gateway_options[:order_id] == "<order_number>-<payment_number>"
+    def purchase(_amount, _source, gateway_options = {})
+      _, payment_number = gateway_options[:order_id].split('-')
+      payment = Spree::Payment.find_by(number: payment_number)
+
+      checker = check_transaction(payment)
+      payment.update(transaction_response: checker.json_response)
+
+      params = { check: { response: checker.json_response } }
+
+      if checker.success?
+        ActiveMerchant::Billing::Response.new(true, 'Acleda V2: Purchased', params)
+      else
+        ActiveMerchant::Billing::Response.new(false, 'Acleda V2: Purchasing Failed', params)
+      end
+    end
+
+    # Defining check_transaction makes support_check_transaction_api? true,
+    # enabling the /vpago_payments/check_transaction poller.
+    def check_transaction(payment)
+      checker = Vpago::AcledaV2::TransactionStatus.new(payment)
+      checker.call
+      checker
+    end
+
+    # override
+    def cancel(_response_code, _payment = nil)
+      ActiveMerchant::Billing::Response.new(true, 'Acleda V2: Payment has been canceled.')
+    end
+  end
+end

data/app/models/vpago/payment_method_decorator.rb

@@ -4,6 +4,7 @@ module Vpago
     TYPE_PAYWAY_V2 = 'Spree::Gateway::PaywayV2'.freeze
     TYPE_WINGSDK = 'Spree::Gateway::WingSdk'.freeze
     TYPE_ACLEDA = 'Spree::Gateway::Acleda'.freeze
+    TYPE_ACLEDA_V2 = 'Spree::Gateway::AcledaV2'.freeze
     TYPE_ACLEDA_MOBILE = 'Spree::Gateway::AcledaMobile'.freeze
     TYPE_TRUE_MONEY = 'Spree::Gateway::TrueMoney'.freeze
     TYPE_VATTANAC = 'Spree::Gateway::Vattanac'.freeze
@@ -21,6 +22,7 @@ module Vpago
           Spree::PaymentMethod::TYPE_PAYWAY,
           Spree::PaymentMethod::TYPE_WINGSDK,
           Spree::PaymentMethod::TYPE_ACLEDA,
+          Spree::PaymentMethod::TYPE_ACLEDA_V2,
           Spree::PaymentMethod::TYPE_ACLEDA_MOBILE,
           Spree::PaymentMethod::TYPE_VATTANAC,
           Spree::PaymentMethod::TYPE_VATTANAC_MINI_APP,
@@ -89,6 +91,10 @@ module Vpago
       type == Spree::PaymentMethod::TYPE_ACLEDA
     end
 
+    def type_acleda_v2?
+      type == Spree::PaymentMethod::TYPE_ACLEDA_V2
+    end
+
     def type_payway?
       type == Spree::PaymentMethod::TYPE_PAYWAY
     end

data/app/services/vpago/payment_finder.rb

@@ -14,11 +14,15 @@ module Vpago
     end
 
     def find_and_verify!
-      if vattanac_mini_app_payload?
+      if vattanac_mini_app_callback?
         payload = Vpago::VattanacMiniAppDataHandler.new.decrypt_data(@params_hash[:data])
         payment = Spree::Payment.find_by!(number: payload['paymentId'])
         payment.update(transaction_response: payload)
         payment
+      elsif acleda_v2_callback?
+        # ACLEDA V2's static portal callback carries only _paymenttokenid, which we
+        # stored on the payment source at openSessionV2. Resolve the payment by it.
+        Spree::VpagoPaymentSource.find_by!(transaction_id: params_hash[:_paymenttokenid]).payment
       else
         order = Spree::Order.find_by!(number: params_hash[:order_number])
         verify_jwt!(order)
@@ -31,8 +35,12 @@ module Vpago
       JWT.decode(params_hash[:order_jwt_token], order.token, 'HS256')
     end
 
-    def vattanac_mini_app_payload?
+    def vattanac_mini_app_callback?
       params_hash[:data].present?
     end
+
+    def acleda_v2_callback?
+      params_hash[:_paymenttokenid].present?
+    end
   end
 end

data/app/services/vpago/payment_processable.rb

@@ -24,17 +24,18 @@ module Vpago
       :unable_to_complete_order
     end
 
-    # example.
-    # Started Vpago::PaymentProcessor#process_payment! for payment_number: PX81YZX with args: {}
-    # Completed Vpago::PaymentProcessor#process_payment! for payment_number: PX81YZX in 2000ms
-    def log_process(method, *args)
-      start_time = Time.now
-      Rails.logger.error("Started #{self.class}##{method} for payment_number: #{@payment.number} with args: #{args}")
-
-      yield
-
-      duration_ms = (Time.now - start_time) * 1000
-      Rails.logger.error("Completed #{self.class}##{method} for payment_number: #{@payment.number} in #{duration_ms}ms")
+    def log_process(method, *args, &)
+      VpagoLogger.log(
+        label: "#{self.class.name}##{method}",
+        data: {
+          payment_number: @payment.number,
+          order_number: @payment.order.number,
+          payment_method_type: @payment.payment_method.type,
+          payment_method_name: @payment.payment_method.name,
+          args: args
+        },
+        &
+      )
     end
 
     def user_informer

data/app/views/spree/admin/payments/source_views/_acleda_v2.html.erb

@@ -0,0 +1 @@
+<%= render 'spree/admin/payments/source_views/vpago_payment_tmpl', payment: payment %>

data/app/views/spree/checkout/payment/_acleda_v2_checkout_form.html.erb

@@ -0,0 +1,12 @@
+<form method="post" action="<%= action_url %>" id="acleda_v2_checkout_form" style="display:none;">
+  <% gateway_params.each do |name, value| %>
+    <input type="hidden" name="<%= name %>" value="<%= value %>">
+  <% end %>
+</form>
+
+<script>
+  (function () {
+    var form = document.getElementById("acleda_v2_checkout_form");
+    if (form) form.submit();
+  })();
+</script>

data/app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb

@@ -0,0 +1,47 @@
+<%
+  opr_device = request.user_agent.to_s.downcase.match?(/iphone|ipad|ipod/) ? 'ios' : 'android'
+  checkout = ::Vpago::AcledaV2::Checkout.new(@payment, { platform: params[:platform], opr_device: opr_device })
+
+  begin
+    checkout.call
+  rescue => e
+    Rails.logger.error("Acleda V2 checkout.call failed: #{e.message}")
+  end
+%>
+
+<% if checkout.failed? %>
+  <script>
+    console.error("[Vpago] Acleda V2 checkout error: <%= j checkout.error_message.to_s %>");
+    document.addEventListener("DOMContentLoaded", () => {
+      const loadingContainer = document.getElementById('vpago_loading_container');
+      if (loadingContainer) {
+        loadingContainer.textContent = "We couldn't start your payment. Please go back and try again.";
+      }
+    });
+  </script>
+<% elsif @payment.payment_method.deeplink? %>
+  <script>
+    function showRedirectContainer(buttonLabel, onClick) {
+      const loadingContainer = document.getElementById('vpago_loading_container');
+      const redirectContainer = document.getElementById('vpago_redirect_container');
+      const redirectButton = document.getElementById('vpago_redirect_button');
+
+      redirectButton.textContent = buttonLabel;
+      redirectButton.addEventListener('click', onClick);
+
+      loadingContainer.style.display = 'none';
+      redirectContainer.style.removeProperty('display');
+    }
+
+    const deeplinkUrl = "<%= raw checkout.deeplink_url %>";
+    const redirectTo = (url) => { if (url) window.location.href = url; };
+
+
+    redirectTo(deeplinkUrl);
+    showRedirectContainer("Open ACLEDA", () => redirectTo(deeplinkUrl));
+  </script>
+<% else %>
+  <%= render 'spree/checkout/payment/acleda_v2_checkout_form',
+             gateway_params: checkout.gateway_params,
+             action_url: checkout.action_url %>
+<% end %>

data/lib/spree_vpago/engine.rb

@@ -21,6 +21,7 @@ module SpreeVpago
         Spree::Gateway::PaywayV2,
         Spree::Gateway::WingSdk,
         Spree::Gateway::Acleda,
+        Spree::Gateway::AcledaV2,
         Spree::Gateway::AcledaMobile,
         Spree::Gateway::Vattanac,
         Spree::Gateway::VattanacMiniApp,

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.3.2'.freeze
+  VERSION = '2.3.5-pre-1'.freeze
 
   def version
     Gem::Version.new VERSION

data/lib/vpago/acleda_v2/base.rb

@@ -0,0 +1,149 @@
+module Vpago
+  module AcledaV2
+    class Base
+      CONTENT_TYPE_JSON = 'application/json'.freeze
+      # ACLEDA requires purchaseDesc to be <= 16 chars, English only.
+      PURCHASE_DESC = 'Purchase goods'.freeze
+
+      def initialize(payment, options = {})
+        @options = options
+        @payment = payment
+      end
+
+      def payment_method
+        @payment.payment_method
+      end
+
+      def payment_number
+        @payment.number
+      end
+
+      # PDF samples quote every xpayTransaction field as a JSON string.
+      def amount
+        format('%.2f', @payment.amount)
+      end
+
+      # txid <= 16 chars; payment.number fits.
+      alias transaction_id payment_number
+
+      def order_number
+        @payment.order.number
+      end
+
+      def merchant_name
+        payment_method.preferences[:merchant_name]
+      end
+
+      def merchant_id
+        payment_method.preferences[:merchant_id]
+      end
+
+      def login_id
+        payment_method.preferences[:login_id]
+      end
+
+      def password
+        payment_method.preferences[:password]
+      end
+
+      def secret
+        payment_method.preferences[:secret]
+      end
+
+      # PDF samples quote every xpayTransaction field as a JSON string, even ones
+      # labeled "Numeric" in the field tables (paymentCard, quantity, expiryTime).
+      def expiry_time
+        payment_method.preferences[:payment_expiry_time_in_mn].to_s
+      end
+
+      # PDF: "Date of Transaction in UTC Time", sent as a YYYY-MM-DD string in the
+      # samples. Explicit .utc so this stays correct even if config.time_zone is
+      # ever changed away from UTC.
+      def purchase_date
+        @payment.created_at.utc.strftime('%Y-%m-%d')
+      end
+
+      def purchase_currency
+        @payment.order.currency
+      end
+
+      # --- Endpoints (each stored as a full URL preference) ---
+      # Strip embedded whitespace: these URLs are long and wrap across lines in
+      # the bank's PDFs, so a copy-paste into the admin preference easily carries
+      # over a stray space/line-break where the PDF wrapped.
+
+      def xpay_service_base_url
+        strip_whitespace(payment_method.preferences[:xpay_service_base_url])
+      end
+
+      def open_session_url
+        "#{xpay_service_base_url}/openSessionV2"
+      end
+
+      def get_txn_status_url # rubocop:disable Naming/AccessorMethodName
+        "#{xpay_service_base_url}/getTxnStatus"
+      end
+
+      # KHQR/Card secure web redirect target
+      def action_url
+        strip_whitespace(payment_method.preferences[:payment_page_url])
+      end
+
+      # successUrlToReturn / errorUrl. The bank appends its own query string
+      # (_paymenttokenid, _resultCode, ...) when it redirects back.
+      def continue_success_url
+        @payment.processing_url
+      end
+
+      def callback_url
+        if platform == 'app' && app_scheme.present?
+          uri = URI.parse(@payment.processing_url)
+          uri.scheme = app_scheme
+          uri.to_s
+        else
+          @payment.processing_url
+        end
+      end
+
+      def app_scheme
+        payment_method.preferences[:app_scheme]
+      end
+
+      # android | ios (defaults to android when not supplied by the caller)
+      def opr_device
+        @options[:opr_device].presence || 'android'
+      end
+
+      def platform
+        @options[:platform]
+      end
+
+      # --- HMAC-SHA512 (uppercase hex) signing ---
+      # openSessionV2 message: merchantID + loginId + password + txid
+      def open_session_hash
+        hmac512("#{merchant_id}#{login_id}#{password}#{payment_number}")
+      end
+
+      # getTxnStatus message: merchantId + loginId + password + paymentTokenid
+      def txn_status_hash(token)
+        hmac512("#{merchant_id}#{login_id}#{password}#{token}")
+      end
+
+      def hmac512(message)
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha512'), secret, message).upcase
+      end
+
+      def parse_json(body)
+        JSON.parse(body)
+      rescue JSON::ParserError
+        {}
+      end
+
+      private
+
+      def strip_whitespace(value)
+        value.to_s.gsub(/\s+/, '')
+      end
+    end
+  end
+end

data/lib/vpago/acleda_v2/checkout.rb

@@ -0,0 +1,124 @@
+require 'faraday'
+
+module Vpago
+  module AcledaV2
+    # Single class handling all three modes (khqr, card, deeplink).
+    # Two-step ACLEDA flow: openSessionV2 (JSON, here) yields paymentTokenid +
+    # sessionid, then either an auto-POST form to paymentPage.jsp (KHQR/Card) or
+    # a JS deeplink redirect (Deep Link).
+    class Checkout < Base
+      attr_reader :error_message
+
+      def call
+        @error_message = nil
+        @response = open_session
+
+        if @response.status != 500 && @response.status != 200
+          @error_message = 'Server Error'
+        elsif @response.status == 500 # mostly when passing a wrong parameter name
+          @error_message = @response.body
+        elsif json_response.dig('result', 'code') != 0 # invalid payload, wrong loginId, etc.
+          @error_message = json_response.dig('result', 'errorDetails') || 'Unknown Error'
+        end
+
+        update_payment_source
+
+        self
+      end
+
+      def failed?
+        @error_message.present?
+      end
+
+      def json_response
+        @json_response ||= parse_json(@response.body)
+      end
+
+      # KHQR/Card secure web redirect form fields (auto-POSTed to paymentPage.jsp).
+      def gateway_params
+        return {} if failed?
+
+        {
+          merchantID: merchant_id,
+          sessionid: json_response.dig('result', 'sessionid'),
+          paymenttokenid: payment_token_id,
+          description: Base::PURCHASE_DESC,
+          expirytime: expiry_time,
+          amount: amount,
+          quantity: '1',
+          item: '1',
+          invoiceid: order_number,
+          currencytype: purchase_currency,
+          transactionID: payment_number,
+          successUrlToReturn: continue_success_url,
+          errorUrl: continue_success_url
+        }
+      end
+
+      # Deep Link redirect target.
+      def deeplink_url
+        return nil if failed?
+
+        json_response.dig('result', 'deeplinkUrl')
+      end
+
+      private
+
+      def open_session
+        conn = Faraday::Connection.new
+
+        conn.post(open_session_url) do |request|
+          request.headers['Content-Type'] = Base::CONTENT_TYPE_JSON
+          request.body = open_session_payload.to_json
+        end
+      end
+
+      def open_session_payload
+        base = {
+          password: password,
+          loginId: login_id,
+          merchantID: merchant_id,
+          hash: open_session_hash,
+          xpayTransaction: xpay_transaction_base
+        }
+
+        if payment_method.deeplink?
+          base[:xpayTransaction].merge!(oprDevice: opr_device, callBackUrl: callback_url)
+        else
+          base[:xpayTransaction][:paymentCard] = payment_method.payment_card_value
+        end
+
+        base
+      end
+
+      def xpay_transaction_base
+        {
+          txid: payment_number,
+          invoiceid: order_number,
+          purchaseAmount: amount,
+          purchaseCurrency: purchase_currency,
+          purchaseDate: purchase_date,
+          purchaseDesc: Base::PURCHASE_DESC,
+          item: '1',
+          quantity: '1',
+          expiryTime: expiry_time
+        }
+      end
+
+      def payment_token_id
+        json_response.dig('result', 'xTran', 'paymentTokenid')
+      end
+
+      # Persist the paymentTokenid so check_transaction / the bank callback can
+      # resolve the payment later. Wrap only the write in the writing role, since
+      # the checkout form partial runs on a GET request (replica connection).
+      def update_payment_source
+        return if failed?
+
+        ActiveRecord::Base.connected_to(role: :writing) do
+          @payment.source.update_column(:transaction_id, payment_token_id)
+        end
+      end
+    end
+  end
+end

data/lib/vpago/acleda_v2/transaction_status.rb

@@ -0,0 +1,80 @@
+require 'faraday'
+
+module Vpago
+  module AcledaV2
+    class TransactionStatus < Base
+      # Terminal failure indicators in result.errorDetails. The PDFs only document
+      # code 0 / "SUCCESS"; decline/expiry wording is conservative and should be
+      # confirmed against real responses during UAT. Anything not success and not
+      # terminal is treated as pending so the poller keeps trying.
+      FAILED_ERROR_DETAILS = %w[EXPIRED DECLINED CANCELLED FAILED REJECTED].freeze
+
+      def call
+        @response = check_remote_status
+        self
+      end
+
+      def json_response
+        @json_response ||= parse_json(@response.body)
+      end
+
+      def result
+        json_response['result'] || {}
+      end
+
+      def result_code
+        result['code']
+      end
+
+      def error_message
+        result['errorDetails']
+      end
+
+      def success?
+        http_success? && result_code == 0 && error_message == 'SUCCESS'
+      end
+
+      def failed?
+        return false unless http_success?
+
+        FAILED_ERROR_DETAILS.include?(error_message.to_s.upcase)
+      end
+
+      def pending?
+        !success? && !failed?
+      end
+
+      private
+
+      def http_success?
+        @response&.status == 200
+      end
+
+      def token
+        @payment.source&.transaction_id
+      end
+
+      def check_remote_status
+        conn = Faraday::Connection.new
+
+        conn.post(get_txn_status_url) do |request|
+          request.headers['Content-Type'] = Base::CONTENT_TYPE_JSON
+          request.body = payload.to_json
+        end
+      end
+
+      # NOTE: getTxnStatus uses merchantId (lowercase d) and an extra merchantName
+      # field. merchantName is NOT part of the HMAC message.
+      def payload
+        {
+          loginId: login_id,
+          password: password,
+          merchantId: merchant_id,
+          merchantName: merchant_name,
+          hash: txn_status_hash(token),
+          paymentTokenid: token
+        }
+      end
+    end
+  end
+end

data/lib/vpago_logger.rb

@@ -0,0 +1,59 @@
+# lib/vpago_logger.rb
+module VpagoLogger
+  def self.log(label:, data: nil)
+    message = { label: label, data: safe_serialize(data) }
+    start_time = Time.current
+    Rails.logger.info(message.to_json)
+
+    return unless block_given?
+
+    # Capture the block's return value and return it to preserve existing behavior for callers expecting that value.
+    block_result = yield
+
+    message[:start_time] = start_time.iso8601(3)
+    message[:duration_ms] = (Time.current - start_time) * 1000
+    message[:result] = safe_serialize(block_result)
+    Rails.logger.info(message.to_json)
+    block_result
+  end
+
+  def self.error(label:, data: nil)
+    message = {
+      label: label,
+      data: safe_serialize(data)
+    }
+
+    Rails.logger.error(message.to_json)
+  end
+
+  # Safely serializes objects for JSON logging.
+  #
+  # @param obj [Object] The object to serialize
+  # @param depth [Integer] Internal parameter tracking recursion depth (max: 50)
+  # @return [Object] A JSON-safe representation of the input object
+  def self.safe_serialize(obj, depth: 0)
+    return '[Max Depth Exceeded]' if depth > 50
+
+    if obj.is_a?(Hash)
+      obj.each_with_object({}) do |(k, v), memo|
+        memo[safe_serialize(k, depth: depth + 1)] = safe_serialize(v, depth: depth + 1)
+      end
+    elsif obj.is_a?(Array)
+      obj.map { |item| safe_serialize(item, depth: depth + 1) }
+    elsif obj.is_a?(Date)
+      obj.iso8601
+    elsif obj.is_a?(Time) || obj.is_a?(DateTime) || obj.is_a?(ActiveSupport::TimeWithZone)
+      obj.iso8601(3)
+    elsif obj.is_a?(ActiveJob::Base)
+      {
+        job_class: obj.class.name,
+        job_id: obj.job_id,
+        arguments: safe_serialize(obj.arguments, depth: depth + 1)
+      }
+    elsif obj.respond_to?(:id)
+      { class: obj.class.name, id: obj.id }
+    else
+      obj.to_s
+    end
+  end
+end

data/node_modules/.yarn-integrity

@@ -1,5 +1,5 @@
 {
-  "systemParams": "linux-x64-115",
+  "systemParams": "linux-x64-127",
   "modulesFolders": [
     "node_modules"
   ],

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.3.2
+  version: 2.3.5.pre.pre.pre.1
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-07 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -192,6 +192,7 @@ files:
 - app/models/concerns/vpago/payoutable.rb
 - app/models/spree/gateway/acleda.rb
 - app/models/spree/gateway/acleda_mobile.rb
+- app/models/spree/gateway/acleda_v2.rb
 - app/models/spree/gateway/payway.rb
 - app/models/spree/gateway/payway_v2.rb
 - app/models/spree/gateway/true_money.rb
@@ -280,6 +281,7 @@ files:
 - app/views/spree/admin/payments/source_forms/_payway_v2.html.erb
 - app/views/spree/admin/payments/source_views/_acleda.html.erb
 - app/views/spree/admin/payments/source_views/_acleda_mobile.html.erb
+- app/views/spree/admin/payments/source_views/_acleda_v2.html.erb
 - app/views/spree/admin/payments/source_views/_payment_payway.html.erb
 - app/views/spree/admin/payments/source_views/_payway_v2.html.erb
 - app/views/spree/admin/payments/source_views/_true_money.html.erb
@@ -309,6 +311,7 @@ files:
 - app/views/spree/checkout/payment/_acleda.html.erb
 - app/views/spree/checkout/payment/_acleda_checkout_form.html.erb
 - app/views/spree/checkout/payment/_acleda_mobile.html.erb
+- app/views/spree/checkout/payment/_acleda_v2_checkout_form.html.erb
 - app/views/spree/checkout/payment/_payment_payway.html.erb
 - app/views/spree/checkout/payment/_payway_loader.html.erb
 - app/views/spree/checkout/payment/_payway_root.html.erb
@@ -331,6 +334,7 @@ files:
 - app/views/spree/payway_v2_card_popups/show.html.erb
 - app/views/spree/vpago_payments/_transaction_checker.html.erb
 - app/views/spree/vpago_payments/checkout.html.erb
+- app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_payway_v2.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_true_money.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac.html.erb
@@ -388,6 +392,9 @@ files:
 - lib/vpago/acleda_mobile/payment_request_updater.rb
 - lib/vpago/acleda_mobile/payment_retriever.rb
 - lib/vpago/acleda_mobile/transaction_status.rb
+- lib/vpago/acleda_v2/base.rb
+- lib/vpago/acleda_v2/checkout.rb
+- lib/vpago/acleda_v2/transaction_status.rb
 - lib/vpago/payment_amount_calculator.rb
 - lib/vpago/payment_request_updater.rb
 - lib/vpago/payment_status_marker.rb
@@ -421,6 +428,7 @@ files:
 - lib/vpago/wing_sdk/payment_retriever.rb
 - lib/vpago/wing_sdk/transaction_status_checker.rb
 - lib/vpago/wing_sdk/transaction_status_response.rb
+- lib/vpago_logger.rb
 - node_modules/.yarn-integrity
 - package-lock.json
 - package.json
@@ -442,9 +450,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements:
 - none
 rubygems_version: 3.4.1