spree_vpago 2.4.0.pre.pre2 → 2.4.0.pre.pre4

data/lib/vpago/http_timeouts.rb

@@ -0,0 +1,6 @@
+module Vpago
+  module HttpTimeouts
+    OPEN_TIMEOUT = 5
+    TIMEOUT = 15
+  end
+end

data/lib/vpago/payway_v2/payment_request_updater.rb

@@ -28,6 +28,11 @@ module Vpago
         elsif checker.failed?
           mark_payment_as_failed(checker.error_message)
         end
+      rescue Faraday::TimeoutError, Faraday::ConnectionFailed => e
+        VpagoLogger.error(
+          label: 'Vpago::PaywayV2::PaymentRequestUpdater#process_payment_status gateway_timeout',
+          data: { payment_number: @payment.number, error_class: e.class.name, error_message: e.message }
+        )
       end
 
       def mark_payment_as_success(checker)

data/lib/vpago/payway_v2/transaction_status.rb

@@ -37,6 +37,8 @@ module Vpago
       def check_remote_status
         conn = Faraday::Connection.new do |faraday|
           faraday.request :url_encoded
+          faraday.options.open_timeout = Vpago::HttpTimeouts::OPEN_TIMEOUT
+          faraday.options.timeout = Vpago::HttpTimeouts::TIMEOUT
         end
 
         data = {

data/lib/vpago/payway_v2/transaction_status_v2.rb

@@ -52,6 +52,8 @@ module Vpago
       def check_remote_status
         conn = Faraday::Connection.new do |faraday|
           faraday.request :url_encoded
+          faraday.options.open_timeout = Vpago::HttpTimeouts::OPEN_TIMEOUT
+          faraday.options.timeout = Vpago::HttpTimeouts::TIMEOUT
         end
 
         data = {

data/lib/vpago/true_money/base.rb

@@ -100,7 +100,7 @@ module Vpago
       end
 
       def fetch_access_token
-        response = Faraday.post(
+        response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT }).post(
           access_token_url,
           URI.encode_www_form(
             grant_type: 'client_credentials',

data/lib/vpago/true_money/transaction_status.rb

@@ -2,7 +2,7 @@ module Vpago
   module TrueMoney
     class TransactionStatus < Base
       def call
-        @response = Faraday.get(check_transaction_url, nil, default_headers)
+        @response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT }).get(check_transaction_url, nil, default_headers)
       end
 
       def success?

data/lib/vpago/vattanac/base.rb

@@ -70,7 +70,8 @@ module Vpago
       private
 
       def fetch_access_token
-        response = Faraday.post(access_token_url, { username: username, password: password }.to_json, { 'Content-Type' => CONTENT_TYPE_JSON })
+        response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT })
+                          .post(access_token_url, { username: username, password: password }.to_json, { 'Content-Type' => CONTENT_TYPE_JSON })
 
         raise "Access Token Error: #{response.status} - #{response.body}" unless response.success?
 
@@ -78,7 +79,7 @@ module Vpago
       end
 
       def post(url, body)
-        response = Faraday.post(url, body.to_json, default_headers)
+        response = Faraday.new(request: { open_timeout: Vpago::HttpTimeouts::OPEN_TIMEOUT, timeout: Vpago::HttpTimeouts::TIMEOUT }).post(url, body.to_json, default_headers)
         parse_json(response.body)
       end
     end

data/lib/vpago/vattanac/payment_request_updater.rb

@@ -0,0 +1,54 @@
+module Vpago
+  module Vattanac
+    class PaymentRequestUpdater < ::Vpago::PaymentRequestUpdater
+      def call
+        return if @payment.order.paid?
+
+        if items_eligible?
+          process_payment_status
+        else
+          mark_items_as_ineligible
+        end
+      end
+
+      private
+
+      def process_payment_status
+        checker = @payment.payment_method.check_transaction(@payment)
+
+        if checker.success?
+          mark_payment_as_success
+        elsif checker.failed? && !ignore_on_failed?
+          mark_payment_as_failed(checker.error_message)
+        end
+      rescue Faraday::TimeoutError, Faraday::ConnectionFailed => e
+        VpagoLogger.error(
+          label: 'Vpago::Vattanac::PaymentRequestUpdater#process_payment_status gateway_timeout',
+          data: { payment_number: @payment.number, error_class: e.class.name, error_message: e.message }
+        )
+      end
+
+      def items_eligible?
+        @payment&.order&.line_items&.all?(&:sufficient_stock?) == true # rubocop:disable Style/SafeNavigationChainLength
+      end
+
+      def mark_items_as_ineligible
+        @error_message = 'Items are not eligible due to insufficient stock'
+        marker_options = @options.merge(status: false, description: @error_message)
+        ::Vpago::PaymentStatusMarker.new(@payment, marker_options).call
+      end
+
+      def mark_payment_as_success
+        @error_message = nil
+        marker_options = @options.merge(status: true, description: nil)
+        ::Vpago::PaymentStatusMarker.new(@payment, marker_options).call
+      end
+
+      def mark_payment_as_failed(error_message)
+        @error_message = error_message
+        marker_options = @options.merge(status: false, description: @error_message)
+        ::Vpago::PaymentStatusMarker.new(@payment, marker_options).call
+      end
+    end
+  end
+end

data/lib/vpago/vattanac/transaction_status.rb

@@ -13,6 +13,22 @@ module Vpago
         @response.dig('data', 'status') == 'SUCCESS'
       end
 
+      def error_message
+        @response.dig('msgEntity', 'message') || @response.dig('data', 'message') || 'Unknown error'
+      end
+
+      # msgEntity.code is the API-envelope result code ("0" = call succeeded; check
+      # data.status for the actual transaction state). Any other code is a gateway-level
+      # error with no transaction data (e.g. "03" / "Transaction not found") and is
+      # treated as terminal failure.
+      def failed?
+        @response.dig('msgEntity', 'code').to_s != '0'
+      end
+
+      def pending?
+        !success? && !failed?
+      end
+
       private
 
       def payload
@@ -20,4 +36,4 @@ module Vpago
       end
     end
   end
-end
+end

data/lib/vpago/wing_mini_app/checkout.rb

@@ -0,0 +1,60 @@
+module Vpago
+  module WingMiniApp
+    # Builds the doPayment() payload (Wing Web JS Bridge SDK spec, Native API #2).
+    #
+    # useDefault is hardcoded true for this first cut — no "let the user pick
+    # another account" UI yet, same scope cut as shipping login before payment.
+    class Checkout
+      def initialize(payment)
+        @payment = payment
+      end
+
+      # Pure fields only — no payment_method preference lookup involved, safe to
+      # render/log/test directly. appId is left out here: it needs the gateway's
+      # own app_id, so it's added in #signed_payload alongside additionalKey instead.
+      def payload
+        {
+          account: account,
+          amount: amount,
+          currency: currency,
+          useDefault: true
+        }
+      end
+
+      # The full payload doPayment() actually needs, with appId and the
+      # server-side-only additionalKey.hash merged in. Never render
+      # `secret_api_key` itself into the page — only this derived hash.
+      def signed_payload
+        payload.merge(appId: app_id, additionalKey: { hash: hash, remark: '' })
+      end
+
+      def account
+        @payment.number
+      end
+
+      def amount
+        format('%.2f', @payment.amount)
+      end
+
+      def currency
+        @payment.currency
+      end
+
+      private
+
+      def app_id
+        payment_method.app_id
+      end
+
+      # uppercase(account+amount+currency+secretApiKey), per the spec.
+      def hash
+        plaintext = "#{account}#{amount}#{currency}#{payment_method.secret_api_key}"
+        Digest::SHA256.hexdigest(plaintext.upcase).upcase
+      end
+
+      def payment_method
+        @payment.payment_method
+      end
+    end
+  end
+end

data/lib/vpago/wing_mini_app/webhook_verifier.rb

@@ -0,0 +1,78 @@
+module Vpago
+  module WingMiniApp
+    # Verifies a Wing getStatus/webhook payload (Wing Web JS Bridge SDK spec,
+    # Native-App Invoke #1 getStatus) is both authentic and correct for the
+    # payment it claims to settle. Both checks live here, in one place:
+    #
+    # - the secretKey signature (proves Wing sent this, for this orderRef —
+    #   unlike getProfile, appId is our own configured value here, not a payload
+    #   field, since the spec's getStatus response never includes one)
+    # - the doc-mandated amount/currency match (catches a validly-signed webhook
+    #   that reports the wrong amount, since Wing holds the keys and could sign
+    #   any amount for a real orderRef if something on their end got it wrong —
+    #   not a forgery guard, since orderRef is itself part of what secretKey
+    #   signs, so a valid signature is already bound to exactly this payment)
+    class WebhookVerifier
+      FIELDS = %w[orderRef debitAmount debitCcy transactionId transactionDate].freeze
+
+      # payment is the specific one this settlement claims to be for — both what
+      # verifies the signature (via its own payment_method's app_id/secret_api_key)
+      # and what the amount/currency check runs against.
+      def initialize(payload, payment)
+        @payload = payload.with_indifferent_access
+        @payment = payment
+      end
+
+      def valid?
+        valid_signature? && amount_matches?
+      end
+
+      private
+
+      attr_reader :payload, :payment
+
+      def payment_method
+        payment.payment_method
+      end
+
+      def valid_signature?
+        received = payload['secretKey']
+        received.present? && candidates.value?(received.to_s.upcase)
+      end
+
+      # Numeric comparison, not string: Wing's own spec says debitAmount is always
+      # 2-decimal ("1.00"), but real payloads have sent "1" (no decimals) — same
+      # kind of spec-vs-reality gap as getProfile's `sex` field.
+      def amount_matches?
+        payment.amount == BigDecimal(payload['debitAmount'].to_s) &&
+          payment.currency.to_s.casecmp(payload['debitCcy'].to_s).zero?
+      rescue ArgumentError, TypeError
+        false
+      end
+
+      # Same spec-vs-reality gap, applied to the signature itself: Wing's own
+      # secretKey may have been computed against the canonical 2-decimal
+      # debitAmount even though what actually reached us isn't. Try both so a
+      # formatting-only mismatch between what Wing hashed and what Wing sent
+      # still verifies.
+      def candidates
+        {
+          raw: hash_for(payload['debitAmount'].to_s),
+          normalized: hash_for(normalized_debit_amount)
+        }
+      end
+
+      def normalized_debit_amount
+        format('%.2f', BigDecimal(payload['debitAmount'].to_s))
+      rescue ArgumentError, TypeError
+        payload['debitAmount'].to_s
+      end
+
+      def hash_for(debit_amount)
+        fields = FIELDS.map { |field| field == 'debitAmount' ? debit_amount : payload[field].to_s }.join
+        plaintext = "#{payment_method.app_id}#{fields}#{payment_method.secret_api_key}"
+        Digest::SHA256.hexdigest(plaintext.upcase).upcase
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.4.0.pre.pre2
+  version: 2.4.0.pre.pre4
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-17 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -149,13 +149,22 @@ files:
 - app/assets/javascripts/vpago/vpago_payments/check_transaction_periodically.js
 - app/assets/javascripts/vpago/vpago_payments/request_process_payment.js
 - app/assets/javascripts/vpago/vpago_payments/user_informers/firebase.js
+- app/assets/javascripts/vpago/wing_mini_app/login.js
+- app/assets/javascripts/vpago/wing_mini_app/web_jsbridge.bundle.js
 - app/controllers/.gitkeep
+- app/controllers/concerns/spree/mini_app_concern.rb
 - app/controllers/spree/acleda_redirects_controller.rb
+- app/controllers/spree/admin/payment_acleda_v2_base_controller.rb
+- app/controllers/spree/admin/payment_acleda_v2_checkers_controller.rb
+- app/controllers/spree/admin/payment_acleda_v2_queriers_controller.rb
 - app/controllers/spree/admin/payment_methods_controller_decorator.rb
 - app/controllers/spree/admin/payment_payway_base_controller.rb
 - app/controllers/spree/admin/payment_payway_checkers_controller.rb
 - app/controllers/spree/admin/payment_payway_markers_controller.rb
 - app/controllers/spree/admin/payment_payway_queriers_controller.rb
+- app/controllers/spree/admin/payment_vattanac_base_controller.rb
+- app/controllers/spree/admin/payment_vattanac_checkers_controller.rb
+- app/controllers/spree/admin/payment_vattanac_queriers_controller.rb
 - app/controllers/spree/admin/payment_wing_sdk_base_controller.rb
 - app/controllers/spree/admin/payment_wing_sdk_checkers_controller.rb
 - app/controllers/spree/admin/payment_wing_sdk_markers_controller.rb
@@ -167,7 +176,8 @@ files:
 - app/controllers/spree/admin/payouts_controller.rb
 - app/controllers/spree/admin/suspicious_orders_controller.rb
 - app/controllers/spree/api/v2/storefront/checkout_controller_decorator.rb
-- app/controllers/spree/miniapp/acledas_controller.rb
+- app/controllers/spree/mini_app/acledas_controller.rb
+- app/controllers/spree/mini_app/wings_controller.rb
 - app/controllers/spree/payway_card_popups_controller.rb
 - app/controllers/spree/payway_results_controller.rb
 - app/controllers/spree/payway_v2_card_popups_controller.rb
@@ -201,6 +211,7 @@ files:
 - app/models/spree/gateway/true_money.rb
 - app/models/spree/gateway/vattanac.rb
 - app/models/spree/gateway/vattanac_mini_app.rb
+- app/models/spree/gateway/wing_mini_app.rb
 - app/models/spree/gateway/wing_sdk.rb
 - app/models/spree/payment_method/cash_on.rb
 - app/models/spree/payout.rb
@@ -275,12 +286,14 @@ files:
 - app/services/vpago/rsa_handler.rb
 - app/services/vpago/user_informers/firebase.rb
 - app/services/vpago/vattanac_mini_app_data_handler.rb
+- app/services/vpago/wing_mini_app/session/create.rb
 - app/views/.gitkeep
 - app/views/layouts/acleda.html.erb
 - app/views/layouts/payway.html.erb
 - app/views/layouts/payway_v2.html.erb
 - app/views/layouts/vpago_payments.html.erb
 - app/views/layouts/wing.html.erb
+- app/views/layouts/wing_mini_app.html.erb
 - app/views/spree/_payment_icon.html.erb
 - app/views/spree/acleda_redirects/show.html.erb
 - app/views/spree/admin/payments/source_forms/_payment_payway.html.erb
@@ -295,6 +308,7 @@ files:
 - app/views/spree/admin/payments/source_views/_vattanac.html.erb
 - app/views/spree/admin/payments/source_views/_vattanac_mini_app.html.erb
 - app/views/spree/admin/payments/source_views/_vpago_payment_tmpl.html.erb
+- app/views/spree/admin/payments/source_views/_wing_mini_app.html.erb
 - app/views/spree/admin/payments/source_views/_wingsdk.html.erb
 - app/views/spree/admin/payout_profile_products/_form.html.erb
 - app/views/spree/admin/payout_profile_products/edit.html.erb
@@ -336,12 +350,14 @@ files:
 - app/views/spree/checkout/payment/payway_form.html.erb
 - app/views/spree/checkout/payment/payway_v2_form.html.erb
 - app/views/spree/checkout/payment/wingsdk_form.html.erb
+- app/views/spree/mini_app/wings/show.html.erb
 - app/views/spree/payway_card_popups/_form.html.erb
 - app/views/spree/payway_card_popups/show.html.erb
 - app/views/spree/payway_results/failed.html.erb
 - app/views/spree/payway_results/success.html.erb
 - app/views/spree/payway_v2_card_popups/_form.html.erb
 - app/views/spree/payway_v2_card_popups/show.html.erb
+- app/views/spree/vpago_payments/_success_script.html.erb
 - app/views/spree/vpago_payments/_transaction_checker.html.erb
 - app/views/spree/vpago_payments/checkout.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_acleda_mini_app.html.erb
@@ -350,8 +366,10 @@ files:
 - app/views/spree/vpago_payments/forms/spree/gateway/_true_money.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac_mini_app.html.erb
+- app/views/spree/vpago_payments/forms/spree/gateway/_wing_mini_app.html.erb
 - app/views/spree/vpago_payments/processing.html.erb
 - app/views/spree/vpago_payments/processing_scripts/spree/gateway/_payway_v2.html.erb
+- app/views/spree/vpago_payments/processing_scripts/spree/gateway/_wing_mini_app.html.erb
 - app/views/spree/vpago_payments/success.html.erb
 - app/views/spree/wing_redirects/show.html.erb
 - bin/rails
@@ -397,6 +415,7 @@ files:
 - lib/vpago/acleda/payment_request_updater.rb
 - lib/vpago/acleda/transaction_status.rb
 - lib/vpago/acleda_mini_app/checkout.rb
+- lib/vpago/acleda_mini_app/session_hash_validator.rb
 - lib/vpago/acleda_mobile/base.rb
 - lib/vpago/acleda_mobile/callback_validator.php
 - lib/vpago/acleda_mobile/callback_validator.rb
@@ -406,7 +425,9 @@ files:
 - lib/vpago/acleda_mobile/transaction_status.rb
 - lib/vpago/acleda_v2/base.rb
 - lib/vpago/acleda_v2/checkout.rb
+- lib/vpago/acleda_v2/payment_request_updater.rb
 - lib/vpago/acleda_v2/transaction_status.rb
+- lib/vpago/http_timeouts.rb
 - lib/vpago/payment_amount_calculator.rb
 - lib/vpago/payment_request_updater.rb
 - lib/vpago/payment_status_marker.rb
@@ -430,10 +451,13 @@ files:
 - lib/vpago/true_money/transaction_status.rb
 - lib/vpago/vattanac/base.rb
 - lib/vpago/vattanac/checkout.rb
+- lib/vpago/vattanac/payment_request_updater.rb
 - lib/vpago/vattanac/transaction_status.rb
 - lib/vpago/vattanac_mini_app/base.rb
 - lib/vpago/vattanac_mini_app/checkout.rb
 - lib/vpago/vattanac_mini_app/refund_issuer.rb
+- lib/vpago/wing_mini_app/checkout.rb
+- lib/vpago/wing_mini_app/webhook_verifier.rb
 - lib/vpago/wing_sdk/base.rb
 - lib/vpago/wing_sdk/checkout.rb
 - lib/vpago/wing_sdk/payment_request_updater.rb