spree_vpago 2.4.0.pre.pre3 → 2.4.0

data/app/controllers/concerns/spree/mini_app_concern.rb

@@ -0,0 +1,25 @@
+module Spree
+  # Shared by every mini app controller. What lives here is whatever a mini app needs from the
+  # request or gives back in the response, rather than anything one partner does on its own —
+  # today the gate its session service runs the caller through, built from the two things only
+  # the request knows, and the status a refusal answers with.
+  module MiniAppConcern
+    extend ActiveSupport::Concern
+
+    private
+
+    def session_gate(provider)
+      SpreeCmCommissioner::MiniAppProvider::SessionGate.new(
+        provider: provider,
+        api_key: request.headers['X-Api-Key'],
+        ip: request.remote_ip
+      )
+    end
+
+    # A cap or a blocked address is not the payload being wrong, so each answers with its
+    # own status and the partner can tell them apart.
+    def failure_status(result)
+      (result.value.is_a?(Hash) && result.value[:status]) || :unprocessable_entity
+    end
+  end
+end

data/app/controllers/spree/mini_app/acledas_controller.rb

@@ -0,0 +1,35 @@
+module Spree
+  module MiniApp
+    # Partner Session Initialization API (ACLEDA Mini App Integration Spec, Step 01).
+    # ACLEDA POSTs { phone, first_name, last_name } signed with X-Acleda-Signature, and
+    # gets back a session-based miniAppUrl to open in the WebView.
+    class AcledasController < Spree::Api::V2::BaseController
+      include Spree::MiniAppConcern
+
+      PROVIDER = 'acleda_bank'.freeze
+
+      # POST /mini_app/acleda
+      def create
+        result = ::Vpago::AcledaMiniApp::Session::Create.call(
+          phone: session_params[:phone],
+          first_name: session_params[:first_name],
+          last_name: session_params[:last_name],
+          signature: request.headers['X-Acleda-Signature'],
+          gate: session_gate(PROVIDER)
+        )
+
+        if result.success?
+          render json: { message: 'SUCCESS', miniAppUrl: result.value[:mini_app_url] }
+        else
+          render json: { message: 'FAILED', error: result.error.to_s }, status: failure_status(result)
+        end
+      end
+
+      private
+
+      def session_params
+        params.permit(:phone, :first_name, :last_name)
+      end
+    end
+  end
+end

data/app/controllers/spree/mini_app/wings_controller.rb

@@ -0,0 +1,58 @@
+module Spree
+  module MiniApp
+    # Wing Mini App WebView entry. Wing opens this page cold — no server-to-server
+    # pre-step like ACLEDA/Vattanac — so the page itself calls getProfile and posts
+    # the signed result to #create.
+    class WingsController < ApplicationController
+      include Spree::MiniAppConcern
+
+      layout 'wing_mini_app'
+
+      PROVIDER = 'wing_bank'.freeze
+
+      # Both actions carry their own HMAC (ProfileVerifier / WebhookVerifier), and
+      # neither has an authenticated session for a CSRF token to protect.
+      skip_before_action :verify_authenticity_token, only: %i[create callback]
+
+      def show; end
+
+      def create
+        result = ::Vpago::WingMiniApp::Session::Create.call(
+          profile: profile_params.to_h,
+          gate: session_gate(PROVIDER)
+        )
+
+        if result.success?
+          render json: { message: 'SUCCESS', miniAppUrl: result.value[:mini_app_url] }
+        else
+          render json: { message: 'FAILED', error: result.error.to_s }, status: failure_status(result)
+        end
+      end
+
+      # Wing POSTs its settlement here. Its own action rather than
+      # VpagoPaymentsController#process_payment, which is shaped around browser
+      # returns from other gateways — return_params merging, the ABA reviewing-mode
+      # branch, the internal_client flag — none of which a server-to-server webhook
+      # sends.
+      def callback
+        payment = ::Vpago::PaymentFinder.new(params.permit!.to_h).find_and_verify
+
+        return render json: { status: 'not_found' }, status: :not_found if payment.nil?
+
+        ::Vpago::PaymentProcessorJob.perform_later(payment_number: payment.number) unless payment.order.paid?
+
+        render json: { status: 'ok' }, status: :ok
+      end
+
+      private
+
+      def profile_params
+        params.require(:profile).permit(
+          :id, :appId, :firstName, :lastName, :middleName, :fullName, :sex, :age, :nationality,
+          :phone, :email, :city, :country, :address, :occupation, :addrCode, :dobFull, :nidNumber,
+          :nidType, :nidExpirationDate, :lang, :appVersion, :osVersion, :secret_key
+        )
+      end
+    end
+  end
+end

data/app/models/spree/gateway/acleda_mini_app.rb

@@ -0,0 +1,18 @@
+module Spree
+  # ACLEDA Mini App payment method.
+  #
+  # Reuses the ACLEDA V2 integration in deeplink mode: openSessionV2 returns a deeplink the
+  # payment page opens as a top-frame navigation, which ACLEDA's own WebView turns into an app
+  # launch. Server-side verification reuses AcledaV2's #check_transaction (getTxnStatus).
+  class Gateway::AcledaMiniApp < Gateway::AcledaV2
+    # override: partial to render in admin / checkout form lookup
+    def method_type
+      'acleda_mini_app'
+    end
+
+    # The mini app always pays by deeplink, so admins don't need to set the ACLEDA V2 mode.
+    def deeplink?
+      true
+    end
+  end
+end

data/app/models/spree/gateway/wing_mini_app.rb

@@ -0,0 +1,58 @@
+module Spree
+  # Wing Mini App payment method (doPayment). Wing pushes settlement to our webhook,
+  # where Vpago::PaymentFinder checks the secretKey and the amount/currency match
+  # before storing transaction_response — the only place that is verified.
+  class Gateway::WingMiniApp < PaymentMethod
+    def method_type
+      'wing_mini_app'
+    end
+
+    # Read from Wing's mini app row (WingMiniApp::Config), not a payment method preference:
+    # login verifies against the same pair, and a second source could sign payments as a
+    # different partner — a mismatch that first surfaces at the webhook, after the debit.
+    def app_id
+      SpreeCmCommissioner::WingMiniApp::Config.app_id
+    end
+
+    def secret_api_key
+      SpreeCmCommissioner::WingMiniApp::Config.secret_api_key
+    end
+
+    def payment_source_class
+      Spree::VpagoPaymentSource
+    end
+
+    def auto_capture?
+      true
+    end
+
+    # override
+    def purchase(_amount, _source, gateway_options = {})
+      _, payment_number = gateway_options[:order_id].split('-')
+      payment = Spree::Payment.find_by(number: payment_number)
+      response = payment&.transaction_response || {}
+
+      params = { payment_response: response }
+
+      # A present transaction_response is PaymentFinder having already verified this
+      # settlement, so there is nothing left to check.
+      if response.present?
+        ActiveMerchant::Billing::Response.new(true, 'Wing Mini App: Purchased', params)
+      else
+        ActiveMerchant::Billing::Response.new(false, 'Wing Mini App: Purchasing Failed', params)
+      end
+    end
+
+    # override
+    def void(_response_code, _gateway_options)
+      ActiveMerchant::Billing::Response.new(true, 'Wing Mini App order has been voided.')
+    end
+
+    # override
+    # Wing documents no refund API, so this fails rather than returning a no-op success:
+    # refunds stay manual with Wing until they publish one.
+    def cancel(_response_code, _payment)
+      ActiveMerchant::Billing::Response.new(false, 'Wing Mini App: cancel is not supported — no Wing refund API is documented yet.')
+    end
+  end
+end

data/app/models/vpago/payment_decorator.rb

@@ -109,6 +109,14 @@ module Vpago
       payment_method.type_vattanac_mini_app?
     end
 
+    def acleda_mini_app_payment?
+      payment_method.type_acleda_mini_app?
+    end
+
+    def wing_mini_app_payment?
+      payment_method.type_wing_mini_app?
+    end
+
     def check_payment?
       payment_method.type_check?
     end

data/app/models/vpago/payment_method_decorator.rb

@@ -6,9 +6,11 @@ module Vpago
     TYPE_ACLEDA = 'Spree::Gateway::Acleda'.freeze
     TYPE_ACLEDA_V2 = 'Spree::Gateway::AcledaV2'.freeze
     TYPE_ACLEDA_MOBILE = 'Spree::Gateway::AcledaMobile'.freeze
+    TYPE_ACLEDA_MINI_APP = 'Spree::Gateway::AcledaMiniApp'.freeze
     TYPE_TRUE_MONEY = 'Spree::Gateway::TrueMoney'.freeze
     TYPE_VATTANAC = 'Spree::Gateway::Vattanac'.freeze
     TYPE_VATTANAC_MINI_APP = 'Spree::Gateway::VattanacMiniApp'.freeze
+    TYPE_WING_MINI_APP = 'Spree::Gateway::WingMiniApp'.freeze
     TYPE_CASH_ON = 'Spree::PaymentMethod::CashOn'.freeze
 
     def self.prepended(base)
@@ -24,8 +26,10 @@ module Vpago
           Spree::PaymentMethod::TYPE_ACLEDA,
           Spree::PaymentMethod::TYPE_ACLEDA_V2,
           Spree::PaymentMethod::TYPE_ACLEDA_MOBILE,
+          Spree::PaymentMethod::TYPE_ACLEDA_MINI_APP,
           Spree::PaymentMethod::TYPE_VATTANAC,
           Spree::PaymentMethod::TYPE_VATTANAC_MINI_APP,
+          Spree::PaymentMethod::TYPE_WING_MINI_APP,
           Spree::PaymentMethod::TYPE_TRUE_MONEY,
           Spree::PaymentMethod::TYPE_CASH_ON
         ]
@@ -99,6 +103,10 @@ module Vpago
       type == Spree::PaymentMethod::TYPE_ACLEDA_V2
     end
 
+    def type_acleda_mini_app?
+      type == Spree::PaymentMethod::TYPE_ACLEDA_MINI_APP
+    end
+
     def type_payway?
       type == Spree::PaymentMethod::TYPE_PAYWAY
     end
@@ -119,6 +127,10 @@ module Vpago
       type == Spree::PaymentMethod::TYPE_VATTANAC_MINI_APP
     end
 
+    def type_wing_mini_app?
+      type == Spree::PaymentMethod::TYPE_WING_MINI_APP
+    end
+
     def type_true_money?
       type == Spree::PaymentMethod::TYPE_TRUE_MONEY
     end

data/app/services/vpago/acleda_mini_app/session/create.rb

@@ -0,0 +1,121 @@
+module Vpago
+  module AcledaMiniApp
+    module Session
+      # Partner Session Initialization (ACLEDA Mini App Integration Spec, Step 01).
+      #
+      # ACLEDA POSTs { phone, first_name, last_name } with an X-Acleda-Signature HMAC
+      # (see SessionHashValidator), checked before we touch the user so nobody can mint
+      # a session for an arbitrary phone. We then find or create the customer, tag them
+      # with the acleda_bank identity, and hand back a miniAppUrl carrying a session JWT.
+      class Create
+        prepend Spree::ServiceModule::Base
+
+        # `signature`, not `hash`: an attr_reader named `hash` overrides Object#hash and
+        # silently breaks this object as a Hash key.
+        #
+        # `gate` answers who is calling, from where and how often. The controller builds it:
+        # the key header and the address exist only on the request.
+        def call(gate:, phone: nil, first_name: nil, last_name: nil, signature: nil)
+          return failure(nil, 'phone is required') if phone.blank?
+
+          @phone = phone
+          @first_name = first_name
+          @last_name = last_name
+          @signature = signature
+          @gate = gate
+
+          return failure({ status: :unauthorized }, 'missing or unknown api key') unless gate.api_key_accepted?
+          return failure({ status: :forbidden }, 'address not allowed') unless gate.address_allowed?
+          return failure(nil, 'invalid signature') unless valid_signature?
+          return failure(nil, 'phone is invalid') if intel_phone.blank?
+          return failure({ status: :too_many_requests }, 'too many requests') if gate.session_exceeded?(phone: intel_phone)
+
+          user = find_or_create_user
+          return failure(user, 'user creation failed') if user.nil? || !user.persisted?
+
+          success(mini_app_url: mini_app_url(user))
+        end
+
+        private
+
+        attr_reader :phone, :first_name, :last_name, :signature, :gate
+
+        # Only asked where this call would mint an account — the damage a leaked key does.
+        # Returning customers never spend that quota.
+        def new_user_throttled?
+          !acleda_identity.persisted? && find_existing_user.nil? && gate.new_user_exceeded?(phone: intel_phone)
+        end
+
+        def valid_signature?
+          ::Vpago::AcledaMiniApp::SessionHashValidator.new(
+            phone: phone, first_name: first_name, last_name: last_name, hash: signature,
+            secret_key: gate.mini_app&.preferred_secret_key
+          ).call
+        end
+
+        def find_or_create_user
+          identity = acleda_identity
+
+          # Returning customer: the ACLEDA identity already points at a user.
+          return identity.user if identity.persisted?
+
+          return nil if new_user_throttled?
+
+          # New to ACLEDA: reuse a customer matched by phone, otherwise build one, then
+          # tag them so the lookup above hits next time.
+          user = find_existing_user || build_user
+          identity.name = full_name
+          user.user_identity_providers << identity
+          user.save
+
+          user
+        end
+
+        # Memoized: #new_user_throttled? asks the same questions, and this row is the one
+        # that gets tagged onto the user.
+        def acleda_identity
+          @acleda_identity ||= SpreeCmCommissioner::UserIdentityProvider.acleda_bank.find_or_initialize_by(sub: phone)
+        end
+
+        def find_existing_user
+          return @find_existing_user if defined?(@find_existing_user)
+          return @find_existing_user = nil if intel_phone.blank?
+
+          @find_existing_user = Spree::User.by_non_tenant.find_by(intel_phone_number: intel_phone)
+        end
+
+        def build_user
+          Spree::User.new(
+            first_name: first_name,
+            last_name: last_name,
+            phone_number: phone,
+            intel_phone_number: intel_phone,
+            password: SecureRandom.base64(16),
+            confirmed_at: Time.zone.now
+          )
+        end
+
+        def mini_app_url(user)
+          # A JWT signed with the user's secure_token. `session_key`, not `session_id`, so
+          # the OAuth grant routes it to the ACLEDA authenticator.
+          session_key = SpreeCmCommissioner::UserSessionJwtToken.encode(
+            { user_id: user.id },
+            user.reload.secure_token
+          )
+
+          "#{Spree::Store.default.formatted_url}/mini_app/acleda?session_key=#{session_key}"
+        end
+
+        def full_name
+          [first_name, last_name].compact.join(' ').presence
+        end
+
+        def intel_phone
+          return @intel_phone if defined?(@intel_phone)
+
+          @intel_phone = SpreeCmCommissioner::PhoneNumberParser.call(phone_number: phone).intel_phone_number
+        end
+      end
+    end
+  end
+end

data/app/services/vpago/payment_finder.rb

@@ -19,6 +19,13 @@ module Vpago
         payment = Spree::Payment.find_by!(number: payload['paymentId'])
         payment.update(transaction_response: payload)
         payment
+      elsif wing_mini_app_callback?
+        payment = Spree::Payment.find_by!(number: params_hash[:orderRef])
+        verifier = Vpago::WingMiniApp::WebhookVerifier.new(params_hash, payment)
+        raise "Wing Mini App webhook: verification failed for payment #{payment.number}" unless verifier.valid?
+
+        payment.update(transaction_response: params_hash)
+        payment
       elsif acleda_v2_callback?
         # ACLEDA V2's static portal callback echoes back _transactionid, which is
         # the payment number we sent as transactionID/txid at openSessionV2.
@@ -42,5 +49,9 @@ module Vpago
     def acleda_v2_callback?
       params_hash[:_paymenttokenid].present?
     end
+
+    def wing_mini_app_callback?
+      params_hash[:orderRef].present? && params_hash[:secretKey].present?
+    end
   end
 end

data/app/services/vpago/wing_mini_app/session/create.rb

@@ -0,0 +1,55 @@
+module Vpago
+  module WingMiniApp
+    module Session
+      # Wing Mini App session init (getProfile). Same gates as ACLEDA, but the trust comes
+      # from a profile Wing signed and handed to the browser, not from a server-to-server
+      # call — so there is no key to name the caller with, only the signature to check.
+      class Create
+        prepend Spree::ServiceModule::Base
+
+        def call(profile:, gate:)
+          @gate = gate
+
+          return failure({ status: :unauthorized }, 'missing or unknown api key') unless gate.api_key_accepted?
+          return failure({ status: :forbidden }, 'address not allowed') unless gate.address_allowed?
+
+          verification = SpreeCmCommissioner::WingMiniApp::ProfileVerifier.call(profile: profile)
+          return failure(nil, verification.error) unless verification.success?
+
+          # After the signature, never before: a trip here is correctly signed traffic flooding us.
+          return failure({ status: :too_many_requests }, 'too many requests') if throttled?(profile)
+
+          user_result = SpreeCmCommissioner::WingMiniApp::FindOrCreateUser.call(profile: profile, gate: gate)
+          return failure(user_result.value, user_result.error) unless user_result.success?
+
+          success(mini_app_url: mini_app_url(user_result.value[:user]))
+        end
+
+        private
+
+        attr_reader :gate
+
+        def throttled?(profile)
+          gate.session_exceeded?(phone: intel_phone(profile[:phone] || profile['phone']))
+        end
+
+        def intel_phone(phone)
+          return nil if phone.blank?
+
+          SpreeCmCommissioner::PhoneNumberParser.call(phone_number: phone).intel_phone_number
+        end
+
+        def mini_app_url(user)
+          # A JWT signed with the user's secure_token. Passed as `wing_session_key`
+          # so the OAuth grant routes it to the Wing authenticator.
+          session_key = SpreeCmCommissioner::UserSessionJwtToken.encode(
+            { user_id: user.id },
+            user.reload.secure_token
+          )
+
+          "#{Spree::Store.default.formatted_url}/mini_app/wing?wing_session_key=#{session_key}"
+        end
+      end
+    end
+  end
+end

data/app/views/layouts/wing_mini_app.html.erb

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Wing</title>
+
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= yield :head %>
+
+  <%= javascript_include_tag "vpago/wing_mini_app/web_jsbridge.bundle" %>
+  <%= javascript_include_tag "vpago/wing_mini_app/login" %>
+</head>
+
+<body>
+  <%= yield %>
+</body>
+</html>

data/app/views/spree/admin/payments/source_views/_acleda_mini_app.html.erb

@@ -0,0 +1,6 @@
+<%= render 'spree/admin/payments/source_views/vpago_payment_tmpl',
+    payment: payment,
+    check_status_url: '',
+    heal_payment_url: '',
+    manual_update_payment_url: ''
+%>

data/app/views/spree/admin/payments/source_views/_wing_mini_app.html.erb

@@ -0,0 +1,6 @@
+<%= render 'spree/admin/payments/source_views/vpago_payment_tmpl',
+    payment: payment,
+    check_status_url: '',
+    heal_payment_url: '',
+    manual_update_payment_url: ''
+%>

data/app/views/spree/mini_app/wings/show.html.erb

@@ -0,0 +1,44 @@
+<style>
+  body {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100vh;
+    margin: 0;
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+  }
+
+  #wing-mini-app-loading {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 16px;
+  }
+
+  #wing-mini-app-spinner {
+    width: 32px;
+    height: 32px;
+    border: 3px solid #e0e0e0;
+    border-top-color: #6b46c1;
+    border-radius: 50%;
+    animation: wing-mini-app-spin 0.8s linear infinite;
+  }
+
+  @keyframes wing-mini-app-spin {
+    to { transform: rotate(360deg); }
+  }
+
+  #wing-mini-app-status {
+    color: #666;
+    font-size: 14px;
+  }
+
+  #wing-mini-app-status.wing-mini-app-error {
+    color: #c0392b;
+  }
+</style>
+
+<div id="wing-mini-app-loading">
+  <div id="wing-mini-app-spinner"></div>
+  <div id="wing-mini-app-status">Signing you in&hellip;</div>
+</div>

data/app/views/spree/vpago_payments/forms/spree/gateway/_acleda_mini_app.html.erb

@@ -0,0 +1,94 @@
+<%
+  opr_device = request.user_agent.to_s.downcase.match?(/iphone|ipad|ipod/) ? 'ios' : 'android'
+  checkout = ::Vpago::AcledaMiniApp::Checkout.new(@payment, { platform: 'app', opr_device: opr_device })
+
+  # openSessionV2 runs here and persists paymentTokenid for the later getTxnStatus check.
+  # Rejected session or transport error both end with no deeplink — the one failure to render.
+  acleda_deeplink =
+    begin
+      checkout.acleda_deeplink
+    rescue StandardError => e
+      Rails.logger.error("[Acleda] openSessionV2 raised: #{e.message}")
+      nil
+    end
+
+  Rails.logger.error("[Acleda] openSessionV2 failed: #{checkout.error_message}") if checkout.failed?
+%>
+
+<p id="acleda-message"
+   style="margin-top: 10px; font-weight: bold; color: red; display: none;">
+</p>
+
+<script>
+  function showRedirectContainer(buttonLabel, onClick) {
+    const loadingContainer = document.getElementById('vpago_loading_container');
+    const redirectContainer = document.getElementById('vpago_redirect_container');
+    const redirectButton = document.getElementById('vpago_redirect_button');
+
+    redirectButton.textContent = buttonLabel;
+    redirectButton.addEventListener('click', onClick);
+
+    loadingContainer.style.display = 'none';
+    redirectContainer.style.removeProperty('display');
+  }
+
+  function showError(detail) {
+    console.error('[Acleda] ' + detail);
+
+    const message = document.getElementById('acleda-message');
+    message.innerText = "We couldn't start your ACLEDA payment.";
+    message.style.display = 'block';
+  }
+
+  document.addEventListener('DOMContentLoaded', () => {
+    const acledaDeeplink = "<%= raw acleda_deeplink %>";
+
+    if (!acledaDeeplink) {
+      showError('openSessionV2 returned no deeplinkUrl');
+      return;
+    }
+
+    const framed = window.top !== window.self;
+    const android = <%= (opr_device == 'android').to_json %>;
+
+    // The spec's `acledaJSBridge` does not exist in ACLEDA's Mini App (`window.webkit` is
+    // undefined), so they proposed this deeplink instead. getTxnStatus still confirms the
+    // payment, already polled by check_transaction_periodically.js.
+
+    // The three below open the wallet for the customer, so they tap Pay once and not twice.
+    // Two rules shape them: ACLEDA's WebView only launches the app for a navigation on the
+    // *top* frame, and a cross-origin iframe may navigate the top only while a tap's
+    // activation lasts — which the button has and the automatic run does not.
+    const openWallet = () => {
+      window.top.location.href = acledaDeeplink;
+    };
+
+    // So ask our web app, the page embedding this one, which *is* the top frame. It obeys
+    // only inside a bank mini app: anywhere else nothing intercepts the link and the checkout
+    // would really travel to ACLEDA's Play Store listing. Silence is fine — the button still works.
+    const askWebAppToOpen = () => {
+      window.parent.postMessage({ code: 'open_deeplink', url: acledaDeeplink }, '*');
+    };
+
+    // iOS resolves the universal link before the request is made, so a throwaway frame opens
+    // it. Android cannot: ACLEDA serves `frame-ancestors` on the link, so Chromium refuses to
+    // frame it at all.
+    const openThroughHiddenFrame = () => {
+      const frame = document.createElement('iframe');
+
+      frame.style.display = 'none';
+      frame.src = acledaDeeplink;
+
+      document.body.appendChild(frame);
+      setTimeout(() => frame.remove(), 1000);
+    };
+
+    if (!framed) openWallet();
+    else if (android) askWebAppToOpen();
+    else openThroughHiddenFrame();
+
+    // Straight away, not on re-show: opening the bank app only backgrounds this page, and
+    // waiting for it to come back left the customer stuck on "Loading..." with no way out.
+    showRedirectContainer('Pay with ACLEDA', openWallet);
+  });
+</script>