spree_vpago 2.3.8 → 2.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: feafa3aabbe7fd192e7d70028c28467cb990edda91c4e2180bcc127d445cdc9d
-  data.tar.gz: 0cfc058b9ff6f04a07cbde6c8ca29d3b46a00582c143e5cad6b3b672f635caf2
+  metadata.gz: 83977e379d14f72df6f9812c0053817ead75a9a29d9dbb26efbb505679fd34f1
+  data.tar.gz: d478a6a31649dba472adebefb5890c60a5222107252c71b9a835d7260e95cf97
 SHA512:
-  metadata.gz: 49d235f5604b356f4ba1b555be0ce04e4946901319790d7d97a3ca3262e3445415d5a6980780d8ee27712da8b565ee5af3689726c9acb7bf1d20913c8a5c66df
-  data.tar.gz: b7e51eb7d0d57abb587036189d1d374bd43aee8586c55fc569b19692ff38e8cc9f9bcaa404b92b1e75fe30c87d63e0af77cbafea69ed82a921eeffc1c0b5b327
+  metadata.gz: 9c76fd67f78cacde387d8b817ec6b2ff9707dc39fb31d1419498af347c8aee1bf12d4d533af79c0ad90efb44ae80517096a9578e803e6fd2fe937380eca8478b
+  data.tar.gz: 3d44c01a03c35f692ba70d5091a41ca03d9c7e3e9fdd37e0a87b984196e155c37534462b39d396e970462a2522fa6fdde9d60b525147689ccc1184c28e8cb42f

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    spree_vpago (2.3.8)
+    spree_vpago (2.3.10)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/assets/javascripts/vpago/vpago_payments/user_informers/firebase.js

@@ -13693,10 +13693,10 @@ This typically indicates that your device does not have a healthy Internet conne
     firebaseConfigs,
     documentReferencePath,
     onPaymentIsProcessing,
+    onPaymentIsRetrying,
     onOrderIsProcessing,
     onOrderIsCompleted,
     onOrderProcessFailed,
-    onPaymentIsRefunded,
     onPaymentProcessFailed,
     onCompleted
   }) {
@@ -13713,6 +13713,9 @@ This typically indicates that your device does not have a healthy Internet conne
       let processing = documentData["processing"] === true;
       let reasonCode = documentData["reason_code"];
       let reasonMessage = documentData["reason_message"];
+      if (window.parent !== window) {
+        window.parent.postMessage(messageCode, "*");
+      }
       let orderCompleted = orderState === "complete";
       if (orderCompleted) {
         queueProcessor.queueStateChange({
@@ -13743,11 +13746,11 @@ This typically indicates that your device does not have a healthy Internet conne
             }
           });
           break;
-        case "order_is_processing":
+        case "payment_is_retrying":
           queueProcessor.queueStateChange({
             minDelayInMs: 1500,
             callback: async () => {
-              await onOrderIsProcessing(
+              await onPaymentIsRetrying(
                 orderState,
                 paymentState,
                 processing,
@@ -13757,11 +13760,11 @@ This typically indicates that your device does not have a healthy Internet conne
             }
           });
           break;
-        case "order_is_completed":
+        case "order_is_processing":
           queueProcessor.queueStateChange({
             minDelayInMs: 1500,
             callback: async () => {
-              await onOrderIsCompleted(
+              await onOrderIsProcessing(
                 orderState,
                 paymentState,
                 processing,
@@ -13771,11 +13774,11 @@ This typically indicates that your device does not have a healthy Internet conne
             }
           });
           break;
-        case "order_process_failed":
+        case "order_is_completed":
           queueProcessor.queueStateChange({
             minDelayInMs: 1500,
             callback: async () => {
-              await onOrderProcessFailed(
+              await onOrderIsCompleted(
                 orderState,
                 paymentState,
                 processing,
@@ -13785,11 +13788,11 @@ This typically indicates that your device does not have a healthy Internet conne
             }
           });
           break;
-        case "payment_is_refunded":
+        case "order_process_failed":
           queueProcessor.queueStateChange({
             minDelayInMs: 1500,
             callback: async () => {
-              await onPaymentIsRefunded(
+              await onOrderProcessFailed(
                 orderState,
                 paymentState,
                 processing,

data/app/controllers/spree/admin/payment_payway_queriers_controller.rb

@@ -16,6 +16,13 @@ module Spree
           flash[:error] = Spree.t('vpago.payments.payment_not_found_with_error', error: tran_status.error_message)
         end
 
+        redirect_to admin_order_payment_path(order_id: @payment.order.number, id: @payment.number)
+      rescue Faraday::TimeoutError, Faraday::ConnectionFailed => e
+        VpagoLogger.error(
+          label: 'Spree::Admin::PaymentPaywayQueriersController#show gateway_timeout',
+          data: { payment_number: @payment.number, error_class: e.class.name, error_message: e.message }
+        )
+        flash[:error] = Spree.t('vpago.payments.gateway_timeout')
         redirect_to admin_order_payment_path(order_id: @payment.order.number, id: @payment.number)
       end
 

data/app/controllers/spree/vpago_payments_controller.rb

@@ -8,11 +8,11 @@ module Spree
     rescue_from ActiveRecord::RecordNotFound, with: :render_not_found
     rescue_from CanCan::AccessDenied, with: :access_denied
 
+    before_action :find_payment, only: %i[checkout processing success]
+    after_action :allow_iframe_embedding, only: %i[checkout processing success]
+
     # GET
     def checkout
-      @payment = Vpago::PaymentFinder.new(params.permit!.to_h).find_and_verify
-      raise ActiveRecord::RecordNotFound unless @payment.present?
-
       return redirect_to @payment.processing_url, allow_other_host: true unless @payment.checkout?
 
       @order = @payment.order
@@ -22,9 +22,6 @@ module Spree
 
     # GET
     def processing
-      @payment = Vpago::PaymentFinder.new(params.permit!.to_h).find_and_verify
-      raise ActiveRecord::RecordNotFound unless @payment.present?
-
       @order = @payment.order
 
       VpagoLogger.log(label: 'Spree::VpagoPaymentsController#processing', data: vpago_log_context)
@@ -32,9 +29,6 @@ module Spree
 
     # GET
     def success
-      @payment = Vpago::PaymentFinder.new(params.permit!.to_h).find_and_verify
-      raise ActiveRecord::RecordNotFound unless @payment.present?
-
       @order = @payment.order
       raise CanCan::AccessDenied unless @order.completed?
 
@@ -66,6 +60,12 @@ module Spree
       else
         render json: { status: :pending }, status: :ok
       end
+    rescue Faraday::TimeoutError, Faraday::ConnectionFailed => e
+      VpagoLogger.error(
+        label: 'Spree::VpagoPaymentsController#check_transaction gateway_timeout',
+        data: vpago_log_context(error_class: e.class.name, error_message: e.message)
+      )
+      render json: { status: :pending }, status: :ok
     end
 
     # POST
@@ -147,6 +147,18 @@ module Spree
       sanitized_params
     end
 
+    def find_payment
+      @payment = Vpago::PaymentFinder.new(params.permit!.to_h).find_and_verify
+      raise ActiveRecord::RecordNotFound unless @payment.present?
+    end
+
+    # frame-ancestors (set above) supersedes X-Frame-Options in modern
+    # browsers, but the default SAMEORIGIN header would still block legacy
+    # browsers from embedding these pages, so drop it for the iframe actions.
+    def allow_iframe_embedding
+      response.headers.delete('X-Frame-Options')
+    end
+
     def render_not_found
       respond_to do |format|
         format.html { render file: Rails.public_path.join('404.html'), status: :not_found, layout: false }

data/app/javascripts/vpago/vpago_payments/user_informers/firebase.js

@@ -31,6 +31,10 @@ async function listenToProcessingState({
     let reasonCode = documentData["reason_code"];
     let reasonMessage = documentData["reason_message"];
 
+    if (window.parent !== window) {
+      window.parent.postMessage(messageCode, "*");
+    }
+
     let orderCompleted = orderState === "complete";
     if (orderCompleted) {
       queueProcessor.queueStateChange({
@@ -40,7 +44,7 @@ async function listenToProcessingState({
             orderState,
             paymentState,
             reasonCode,
-            reasonMessage
+            reasonMessage,
           );
         },
       });
@@ -57,7 +61,7 @@ async function listenToProcessingState({
               paymentState,
               processing,
               reasonCode,
-              reasonMessage
+              reasonMessage,
             );
           },
         });
@@ -71,7 +75,7 @@ async function listenToProcessingState({
               paymentState,
               processing,
               reasonCode,
-              reasonMessage
+              reasonMessage,
             );
           },
         });
@@ -85,7 +89,7 @@ async function listenToProcessingState({
               paymentState,
               processing,
               reasonCode,
-              reasonMessage
+              reasonMessage,
             );
           },
         });
@@ -99,7 +103,7 @@ async function listenToProcessingState({
               paymentState,
               processing,
               reasonCode,
-              reasonMessage
+              reasonMessage,
             );
           },
         });
@@ -113,7 +117,7 @@ async function listenToProcessingState({
               paymentState,
               processing,
               reasonCode,
-              reasonMessage
+              reasonMessage,
             );
           },
         });
@@ -127,7 +131,7 @@ async function listenToProcessingState({
               paymentState,
               processing,
               reasonCode,
-              reasonMessage
+              reasonMessage,
             );
           },
         });

data/app/models/spree/payment_method/cash_on.rb

@@ -11,5 +11,12 @@ module Spree
     def auto_capture?
       true
     end
+
+    # override: Spree::Payment#cancel! calls payment_method.cancel(response_code, payment).
+    # Cash has no gateway to void against, so acknowledge success and let the payment
+    # transition to `void`.
+    def cancel(_response_code, _payment = nil)
+      ActiveMerchant::Billing::Response.new(true, 'Cash On: Payment has been canceled.')
+    end
   end
 end

data/app/models/vpago/order_decorator.rb

@@ -102,7 +102,7 @@ module Vpago
     # override this method if you want flexibility
     # for example, host per payment method or tenant
     def payment_host
-      ENV.fetch('DEFAULT_URL_HOST')
+      ENV.fetch('PAYMENT_BASE_URL')
     end
   end
 end

data/app/services/vpago/payment_redirect_handler.rb

@@ -50,7 +50,7 @@ module Vpago
 
     def process_acleda_gateway
       data = {
-        href: "#{ENV.fetch('DEFAULT_URL_HOST', nil)}/acleda_redirects?payment_number=#{@payment.number}"
+        href: "#{ENV.fetch('PAYMENT_BASE_URL', nil)}/acleda_redirects?payment_number=#{@payment.number}"
       }
 
       @redirect_options = data
@@ -81,7 +81,7 @@ module Vpago
     def process_payway_v2_card
       ## TO DO: generate redirect url
       data = {
-        href: "#{ENV.fetch('DEFAULT_URL_HOST', nil)}/payway_v2_card_popups?payment_number=#{@payment.number}"
+        href: "#{ENV.fetch('PAYMENT_BASE_URL', nil)}/payway_v2_card_popups?payment_number=#{@payment.number}"
       }
 
       @redirect_options = data
@@ -115,7 +115,7 @@ module Vpago
       end
 
       conn.post(abapay_payment.checkout_url, gateway_params) do |request|
-        request.headers['Referer'] = ENV.fetch('DEFAULT_URL_HOST', nil)
+        request.headers['Referer'] = ENV.fetch('PAYMENT_BASE_URL', nil)
       end
     end
 
@@ -127,7 +127,7 @@ module Vpago
     def process_payway_card
       ## TO DO: generate redirect url
       data = {
-        href: "#{ENV.fetch('DEFAULT_URL_HOST', nil)}/payway_card_popups?payment_number=#{@payment.number}"
+        href: "#{ENV.fetch('PAYMENT_BASE_URL', nil)}/payway_card_popups?payment_number=#{@payment.number}"
       }
 
       @redirect_options = data
@@ -135,7 +135,7 @@ module Vpago
 
     def process_wing_gateway
       data = {
-        href: "#{ENV.fetch('DEFAULT_URL_HOST', nil)}/wing_redirects?payment_number=#{@payment.number}"
+        href: "#{ENV.fetch('PAYMENT_BASE_URL', nil)}/wing_redirects?payment_number=#{@payment.number}"
       }
 
       @redirect_options = data
@@ -169,7 +169,7 @@ module Vpago
       end
 
       @response = conn.post(abapay_payment.action_url, gateway_params) do |request|
-        request.headers['Referer'] = ENV.fetch('DEFAULT_URL_HOST', nil)
+        request.headers['Referer'] = ENV.fetch('PAYMENT_BASE_URL', nil)
       end
     end
 

data/config/locales/en.yml

@@ -35,5 +35,6 @@ en:
         failed_require_updated_reason: "You must provide update reason"
         payment_found_with_result: "Found payment with result: %{result}"
         payment_not_found_with_error: "Payment not found with error: %{error}"
+        gateway_timeout: "The payment gateway did not respond in time. Please try again shortly."
         query_status: "Query payment status"
         confirm_manual_update: "Are you sure to update this order to complete"

data/config/locales/km.yml

@@ -31,5 +31,6 @@ spree:
       failed_require_updated_reason: "អ្នកត្រូវតែផ្តល់ហេតុផល"
       payment_found_with_result: "រកឃើញការទូទាត់ជាមួយលទ្ធផល %{result}"
       payment_not_found_with_error: "ការទូទាត់មិនត្រូវបានរកឃើញដោយកំហុស: %{error}"
+      gateway_timeout: "ផ្នែកទូទាត់មិនបានឆ្លើយតបទាន់ពេលទេ។ សូមព្យាយាមម្តងទៀតក្នុងពេលឆាប់ៗនេះ។"
       query_status: "សួរស្ថានភាពបង់ប្រាក់"
       confirm_manual_update: "តើអ្នកប្រាកដជាធ្វើបច្ចុប្បន្នភាពការបញ្ជាទិញនេះដើម្បីបញ្ចប់"

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.3.8'.freeze
+  VERSION = '2.3.10'.freeze
 
   def version
     Gem::Version.new VERSION

data/lib/vpago/http_timeouts.rb

@@ -0,0 +1,6 @@
+module Vpago
+  module HttpTimeouts
+    OPEN_TIMEOUT = 5
+    TIMEOUT = 15
+  end
+end

data/lib/vpago/payway_v2/payment_request_updater.rb

@@ -28,6 +28,11 @@ module Vpago
         elsif checker.failed?
           mark_payment_as_failed(checker.error_message)
         end
+      rescue Faraday::TimeoutError, Faraday::ConnectionFailed => e
+        VpagoLogger.error(
+          label: 'Vpago::PaywayV2::PaymentRequestUpdater#process_payment_status gateway_timeout',
+          data: { payment_number: @payment.number, error_class: e.class.name, error_message: e.message }
+        )
       end
 
       def mark_payment_as_success(checker)

data/lib/vpago/payway_v2/transaction_status.rb

@@ -37,6 +37,8 @@ module Vpago
       def check_remote_status
         conn = Faraday::Connection.new do |faraday|
           faraday.request :url_encoded
+          faraday.options.open_timeout = Vpago::HttpTimeouts::OPEN_TIMEOUT
+          faraday.options.timeout = Vpago::HttpTimeouts::TIMEOUT
         end
 
         data = {

data/lib/vpago/payway_v2/transaction_status_v2.rb

@@ -52,6 +52,8 @@ module Vpago
       def check_remote_status
         conn = Faraday::Connection.new do |faraday|
           faraday.request :url_encoded
+          faraday.options.open_timeout = Vpago::HttpTimeouts::OPEN_TIMEOUT
+          faraday.options.timeout = Vpago::HttpTimeouts::TIMEOUT
         end
 
         data = {

data/lib/vpago/true_money/base.rb

@@ -100,7 +100,7 @@ module Vpago
       end
 
       def fetch_access_token
-        response = Faraday.post(
+        response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT }).post(
           access_token_url,
           URI.encode_www_form(
             grant_type: 'client_credentials',

data/lib/vpago/true_money/transaction_status.rb

@@ -2,7 +2,7 @@ module Vpago
   module TrueMoney
     class TransactionStatus < Base
       def call
-        @response = Faraday.get(check_transaction_url, nil, default_headers)
+        @response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT }).get(check_transaction_url, nil, default_headers)
       end
 
       def success?

data/lib/vpago/vattanac/base.rb

@@ -70,7 +70,8 @@ module Vpago
       private
 
       def fetch_access_token
-        response = Faraday.post(access_token_url, { username: username, password: password }.to_json, { 'Content-Type' => CONTENT_TYPE_JSON })
+        response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT })
+                          .post(access_token_url, { username: username, password: password }.to_json, { 'Content-Type' => CONTENT_TYPE_JSON })
 
         raise "Access Token Error: #{response.status} - #{response.body}" unless response.success?
 
@@ -78,7 +79,7 @@ module Vpago
       end
 
       def post(url, body)
-        response = Faraday.post(url, body.to_json, default_headers)
+        response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT }).post(url, body.to_json, default_headers)
         parse_json(response.body)
       end
     end

data/lib/vpago/wing_sdk/base.rb

@@ -33,7 +33,7 @@ module Vpago
       end
 
       def return_url
-        "#{ENV.fetch('DEFAULT_URL_HOST', nil)}/webhook/wings/#{payment_number}/return?app_checkout=#{app_checkout}"
+        "#{ENV.fetch('PAYMENT_BASE_URL', nil)}/webhook/wings/#{payment_number}/return?app_checkout=#{app_checkout}"
       end
 
       def app_checkout

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.3.8
+  version: 2.3.10
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-22 00:00:00.000000000 Z
+date: 2026-08-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -401,6 +401,7 @@ files:
 - lib/vpago/acleda_v2/base.rb
 - lib/vpago/acleda_v2/checkout.rb
 - lib/vpago/acleda_v2/transaction_status.rb
+- lib/vpago/http_timeouts.rb
 - lib/vpago/payment_amount_calculator.rb
 - lib/vpago/payment_request_updater.rb
 - lib/vpago/payment_status_marker.rb