spree_vpago 2.4.0 → 2.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7aa825362489c4aa80a262b6ffc92526b22edaf1d6668e12515ca5c182a397b6
-  data.tar.gz: 56a3a03b73b2b6c3f623f2a1ca237531f69238841f971bc60923e0d978f05213
+  metadata.gz: ece936406834ee468fa22709a7ddb241fc472d2d6729b73e731a3e9868ee78f0
+  data.tar.gz: f7d47a531890cb5354a2c007cb52690e0ce6f61902c228b33b5ecb45a3753336
 SHA512:
-  metadata.gz: 1ad194e645b0b2d45f526701dface2d2a128fc9c846c92827eafc0115d7bfff248c808ec38c708eaf8a56570aeaa573b18230f1129b8d603a04ae4e43fdf932b
-  data.tar.gz: 5ed8651c5033497bde0b3307daf4c048172f334462a3f29acce1fcfb76bf8382c91f3ee63193905c38dbcd9e12f4dca669e7760a6dec599530de155f98d22c4d
+  metadata.gz: 9e211536c98efcec86053b88dcaa146ea50f3767ba41e3ddf5cd39eb9200f9fc5236f09ac6813a8c3fc478a34739c8366724f2e5643a45ec1c42c09b6f3c41f4
+  data.tar.gz: 0d4045c9c3f0587df01a81f65a930165f4d12bb35dddca7cddc5e1357d311af35308afc02a42b6a39d718bb5af40d604ea60b56bdffbc8bf853a3f7dc277ecaa

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    spree_vpago (2.4.0)
+    spree_vpago (2.4.1)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/spree/vpago_orders_controller.rb

@@ -0,0 +1,113 @@
+# Order-based counterpart to Spree::VpagoPaymentsController, for orders where
+# order_total_after_store_credit is zero -- store credit covering the order in full, cash-on with
+# nothing left to pay after store credit, or a free event. Deliberately client-agnostic to whether
+# a Spree::Payment exists underneath (store credit's checkout-state payment is real; a free event
+# has none at all -- see Vpago::OrderDecorator#processing_url and
+# Vpago::OrderProcessor). No checkout-form step is ever needed here either way -- clients land
+# straight on `processing`.
+#
+# processing/success render spree/vpago_shared/{processing,success} (made @payment-optional there)
+# rather than maintaining a near-duplicate pair under spree/vpago_orders/ -- the two flows share
+# the same card layout, Stimulus controller, and booking-details partial; only the payment info
+# section and a few dataset attributes differ, and those are already guarded on @payment being
+# present.
+module Spree
+  class VpagoOrdersController < ApplicationController
+    layout 'vpago_payments'
+    helper 'vpago/vpago_payments'
+
+    skip_before_action :verify_authenticity_token, only: %i[process_order]
+
+    rescue_from ActiveRecord::RecordNotFound, with: :render_not_found
+    rescue_from CanCan::AccessDenied, with: :access_denied
+
+    before_action :find_order, only: %i[processing success]
+    after_action :allow_iframe_embedding, only: %i[processing success]
+
+    # GET
+    def processing
+      return redirect_to @order.success_url, allow_other_host: true if @order.completed?
+
+      VpagoLogger.log(label: 'Spree::VpagoOrdersController#processing', data: vpago_log_context)
+      render 'spree/vpago_shared/processing'
+    end
+
+    # GET
+    def success
+      raise CanCan::AccessDenied unless @order.completed?
+
+      VpagoLogger.log(label: 'Spree::VpagoOrdersController#success', data: vpago_log_context)
+      render 'spree/vpago_shared/success'
+    end
+
+    # POST
+    def process_order
+      return render json: { status: :ok }, status: :ok if request.method != 'POST'
+
+      @order = Vpago::OrderFinder.new(params.permit!.to_h).find_and_verify
+
+      if @order.nil?
+        VpagoLogger.error(
+          label: 'Spree::VpagoOrdersController#process_order order_not_found',
+          data: vpago_log_context(params: params.permit!.to_h)
+        )
+        return render_not_found
+      end
+
+      VpagoLogger.log(label: 'Spree::VpagoOrdersController#process_order order_found', data: vpago_log_context)
+
+      unless @order.completed?
+        VpagoLogger.log(
+          label: 'Spree::VpagoOrdersController#process_order enqueue_order_processor_job',
+          data: vpago_log_context
+        ) { Vpago::OrderProcessorJob.perform_later(order_number: @order.number) }
+      end
+
+      render json: { status: :ok }, status: :ok
+    rescue StandardError => e
+      VpagoLogger.error(
+        label: 'Spree::VpagoOrdersController#process_order failed',
+        data: vpago_log_context(error_class: e.class.name, error_message: e.message, backtrace: e.backtrace&.first(5))
+      )
+      render json: { status: :internal_server_error, message: 'Failed to enqueue order processor job' }, status: :internal_server_error
+    end
+
+    private
+
+    def find_order
+      @order = Vpago::OrderFinder.new(params.permit!.to_h).find_and_verify
+      @payment = @order.payments.first if @order.present? # optional, for shared partials
+      raise ActiveRecord::RecordNotFound unless @order.present?
+    end
+
+    # frame-ancestors (set above) supersedes X-Frame-Options in modern
+    # browsers, but the default SAMEORIGIN header would still block legacy
+    # browsers from embedding these pages, so drop it for the iframe actions.
+    def allow_iframe_embedding
+      response.headers.delete('X-Frame-Options')
+    end
+
+    def render_not_found
+      respond_to do |format|
+        format.html { render file: Rails.public_path.join('404.html'), status: :not_found, layout: false }
+        format.json { render json: { status: :not_found }, status: :not_found }
+      end
+    end
+
+    def access_denied
+      respond_to do |format|
+        format.html { render file: Rails.public_path.join('422.html'), status: :not_found, layout: false }
+        format.json { render json: { status: :unauthorized }, status: :unauthorized }
+      end
+    end
+
+    def vpago_log_context(extra = {})
+      {
+        timestamp: Time.current.utc.iso8601(3),
+        remote_ip: request.remote_ip,
+        order_number: @order&.number,
+        request_id: request.request_id
+      }.merge(extra)
+    end
+  end
+end

data/app/controllers/spree/vpago_payments_controller.rb

@@ -1,4 +1,8 @@
 module Spree
+  # processing/success render spree/vpago_shared/{processing,success} -- shared with
+  # Spree::VpagoOrdersController, since the two flows share the same card layout, Stimulus
+  # controller, and booking-details partial (see spree/vpago_shared/processing.html.erb for how
+  # @payment-vs-@order is resolved there).
   class VpagoPaymentsController < ApplicationController
     layout 'vpago_payments'
     helper 'vpago/vpago_payments'
@@ -31,6 +35,7 @@ module Spree
       return redirect_to @payment.success_url, allow_other_host: true if @order.completed?
 
       VpagoLogger.log(label: 'Spree::VpagoPaymentsController#processing', data: vpago_log_context)
+      render 'spree/vpago_shared/processing'
     end
 
     # GET
@@ -39,6 +44,7 @@ module Spree
       raise CanCan::AccessDenied unless @order.completed?
 
       VpagoLogger.log(label: 'Spree::VpagoPaymentsController#success', data: vpago_log_context)
+      render 'spree/vpago_shared/success'
     end
 
     # GET

data/app/jobs/vpago/order_processor_job.rb

@@ -0,0 +1,21 @@
+# Put :payment_processing at a higher priority in your project: config/sidekiq.yml
+module Vpago
+  class OrderProcessorJob < ::ApplicationUniqueJob
+    queue_as :payment_processing
+
+    def perform(options)
+      order = Spree::Order.find_by!(number: options[:order_number])
+
+      VpagoLogger.log(
+        label: 'Vpago::OrderProcessorJob#perform',
+        data: { order_number: order.number }
+      ) { Vpago::OrderProcessor.new(order: order).call }
+    rescue StandardError => e
+      VpagoLogger.error(
+        label: 'Vpago::OrderProcessorJob#perform failed',
+        data: { order_number: options[:order_number], error_class: e.class.name, error_message: e.message, backtrace: e.backtrace&.first(5) }
+      )
+      raise
+    end
+  end
+end

data/app/models/vpago/order_decorator.rb

@@ -12,6 +12,19 @@ module Vpago
 
       base.state_machine.before_transition from: :cart, do: :ensure_valid_vendor_payment_methods
       base.state_machine.after_transition to: :complete, do: :generate_line_items_total_metadata
+
+      base.delegate :processing_url, :success_url, :process_order_url, to: :order_url_constructor
+    end
+
+    # For orders where order_total_after_store_credit is zero (see Vpago::OrderProcessor) --
+    # no Spree::Payment is involved, so this mirrors Vpago::PaymentDecorator#user_informer /
+    # #url_constructor but keyed on the order directly instead of a payment.
+    def user_informer
+      @user_informer ||= ::Vpago::UserInformers::Firebase.new(self)
+    end
+
+    def order_url_constructor
+      @order_url_constructor ||= Vpago::OrderUrlConstructor.new(self)
     end
 
     # override

data/app/serializers/spree/v2/storefront/cart_serializer_decorator.rb

@@ -0,0 +1,18 @@
+module Spree
+  module V2
+    module Storefront
+      module CartSerializerDecorator
+        def self.prepended(base)
+          base.attribute :processing_url
+        end
+      end
+    end
+  end
+end
+
+# Both CartSerializer and OrderSerializer (which inherits from CartSerializer) need the decorator
+# applied directly -- see SpreeCmCommissioner::V2::Storefront::CartSerializerDecorator for why
+# (prepending to CartSerializer alone doesn't retroactively reach OrderSerializer).
+Spree::V2::Storefront::OrderSerializer.prepend(Spree::V2::Storefront::CartSerializerDecorator) unless Spree::V2::Storefront::OrderSerializer.include?(Spree::V2::Storefront::CartSerializerDecorator)
+
+Spree::V2::Storefront::CartSerializer.prepend(Spree::V2::Storefront::CartSerializerDecorator) unless Spree::V2::Storefront::CartSerializer.include?(Spree::V2::Storefront::CartSerializerDecorator)

data/app/services/vpago/order_finder.rb

@@ -0,0 +1,29 @@
+module Vpago
+  # Order-based counterpart to Vpago::PaymentFinder, for flows that have no Spree::Payment to key
+  # off of (order_total_after_store_credit == 0: store credit covering the order in full, cash-on
+  # with nothing left to pay after store credit, or a free event -- see Vpago::OrderProcessor).
+  class OrderFinder
+    attr_reader :params_hash
+
+    def initialize(params_hash)
+      @params_hash = params_hash
+    end
+
+    def find_and_verify
+      find_and_verify!
+    rescue StandardError, ActiveRecord::RecordNotFound => e
+      Rails.logger.error("Vpago::OrderFinder#find_and_verify error: #{e.class} - #{e.message}")
+      nil
+    end
+
+    def find_and_verify!
+      order = Spree::Order.find_by!(number: params_hash[:order_number])
+      verify_jwt!(order)
+      order
+    end
+
+    def verify_jwt!(order)
+      JWT.decode(params_hash[:order_jwt_token], order.token, 'HS256')
+    end
+  end
+end

data/app/services/vpago/order_processor.rb

@@ -0,0 +1,91 @@
+# Order-based counterpart to Vpago::PaymentProcessor, for orders where order_total_after_store_credit
+# is zero -- store credit covering the order in full, cash-on with nothing left to pay after store
+# credit, or a free event. None of these need a Spree::Payment processed (there may be no payment
+# record at all, e.g. free events), only the order completed -- so this only runs the process_order!
+# half of PaymentProcessor#call!, reusing the same completer + Firebase user-informer flow so the
+# vpago_orders webview (processing -> success) behaves like vpago_payments for the client.
+#
+# Error reason code:
+# - :some_line_items_are_out_of_stock
+# - :some_variants_are_discontinued
+# - :unable_to_complete_order
+# - :invalid_state_machine_transition
+module Vpago
+  class OrderProcessor
+    def initialize(order:)
+      @order = order
+      @error = nil
+    end
+
+    def call
+      log_process('call!') { call! }
+    end
+
+    def call!
+      process_order!
+    rescue StateMachines::InvalidTransition => e
+      handle_order_process_failure(:invalid_state_machine_transition, e.message)
+    end
+
+    def success?
+      @error.nil?
+    end
+
+    private
+
+    def process_order!
+      log_process('process_order!') do
+        user_informer.order_is_processing(processing: true)
+        completer = Spree::Checkout::Complete.new.call(order: @order)
+
+        if completer.success?
+          handle_order_process_completed
+        else
+          reason_code = extract_completer_failure_reason_code(completer.error)
+          handle_order_process_failure(reason_code, completer.error.to_s)
+        end
+      end
+    end
+
+    def handle_order_process_completed
+      log_process('handle_order_process_completed') do
+        user_informer.order_is_completed(processing: false)
+      end
+    end
+
+    def handle_order_process_failure(reason_code, reason_message = nil)
+      log_process('handle_order_process_failure', reason_code, reason_message) do
+        user_informer.order_process_failed(
+          processing: false,
+          reason_code: reason_code,
+          reason_message: reason_message
+        )
+
+        failure(reason_message)
+      end
+    end
+
+    def extract_completer_failure_reason_code(error)
+      return :some_line_items_are_out_of_stock if error.respond_to?(:to_h) && error.to_h[:base]&.include?(Spree.t(:insufficient_stock_lines_present))
+      return :some_variants_are_discontinued if error.respond_to?(:to_h) && error.to_h[:base]&.include?(Spree.t(:discontinued_variants_present))
+
+      :unable_to_complete_order
+    end
+
+    def log_process(method, *args, &)
+      VpagoLogger.log(
+        label: "#{self.class.name}##{method}",
+        data: { order_number: @order.number, args: args },
+        &
+      )
+    end
+
+    def user_informer
+      @user_informer ||= ::Vpago::UserInformers::Firebase.new(@order)
+    end
+
+    def failure(error)
+      @error = error
+    end
+  end
+end

data/app/services/vpago/order_url_constructor.rb

@@ -0,0 +1,29 @@
+module Vpago
+  class OrderUrlConstructor
+    attr_accessor :order
+
+    def initialize(order)
+      @order = order
+    end
+
+    def processing_url = "#{base_url}/vpago_orders/processing?#{query}"
+    def success_url = "#{base_url}/vpago_orders/success?#{query}"
+
+    def process_order_url = "#{base_url}/vpago_orders/process_order?#{query}"
+
+    def query
+      { order_number: order.number, order_jwt_token: order_jwt_token }.to_query
+    end
+
+    private
+
+    def base_url
+      order.payment_host
+    end
+
+    def order_jwt_token
+      payload = { order_number: order.number, order_id: order.id }
+      JWT.encode(payload, order.token, 'HS256')
+    end
+  end
+end

data/app/services/vpago/payments/find_or_create.rb

@@ -19,6 +19,13 @@ module Vpago
       end
 
       def find_or_create_payment(order:, params:, payment_method:)
+        # Store credit is applied via the storefront's own POST .../checkout/add_store_credit,
+        # never through create_payment. Its source_class (Spree::StoreCredit) has neither a
+        # payment_method_id column nor the other fields a blank .new(...) below would need to
+        # save, so falling through would raise ActiveModel::UnknownAttributeError instead of
+        # producing a broken payment -- fail clearly instead.
+        return failure(nil, :store_credit_must_be_applied_via_add_store_credit) if payment_method.is_a?(Spree::PaymentMethod::StoreCredit)
+
         payment = order.payments.find_or_initialize_by(
           state: :checkout,
           amount: order.order_total_after_store_credit,

data/app/views/spree/{vpago_payments → vpago_shared}/processing.html.erb

@@ -1,16 +1,26 @@
+<%
+  # Shared by both Spree::VpagoPaymentsController and Spree::VpagoOrdersController. The flow is
+  # decided by which controller the client was sent to -- @payment can't tell them apart, since
+  # VpagoOrdersController also sets it for shared partials when the order has a payment.
+  vpago_use_order_flow = controller_name == 'vpago_orders'
+  # Falls back to the order-level URL when there is no @payment (e.g. a free event).
+  vpago_process_url = vpago_use_order_flow ? @order.process_order_url : (@payment&.process_payment_url || @order.process_order_url)
+  vpago_user_informer = vpago_use_order_flow ? @order.user_informer : (@payment&.user_informer || @order.user_informer)
+  vpago_success_url = vpago_use_order_flow ? @order.success_url : (@payment&.success_url || @order.success_url)
+%>
 <h1 id="status">THIS IS CURRENT STATE</h1>
 <p id="reason_code"></p>
 <p id="processing"></p>
 <p id="reason_message"></p>
 
-<%= render_additional_processing_script(@payment) %>
+<%= render_additional_processing_script(@payment) if @payment && !vpago_use_order_flow %>
 
 <script>
   document.addEventListener("DOMContentLoaded", function() {
     let firebaseConfigs = <%= Rails.application.credentials.firebase_web_config.to_json.html_safe %>;
 
     window.requestProcessPayment({
-      url: "<%= @payment.process_payment_url %>",
+      url: "<%= vpago_process_url %>",
       params: <%= params.except(:action, :controller, :amp).to_json.html_safe %>,
       maxRetries: 5,
       retryDelayMs: 1000,
@@ -18,7 +28,7 @@
 
     window.listenToProcessingState({
       firebaseConfigs: firebaseConfigs,
-      documentReferencePath: "<%= @payment.user_informer.document_reference_path %>",
+      documentReferencePath: "<%= vpago_user_informer.document_reference_path %>",
       onPaymentIsProcessing: function (orderState, paymentState, processing, reasonCode, reasonMessage) {
         document.getElementById("status").innerText = "Payment is processing";
         document.getElementById("reason_code").innerText = reasonCode;
@@ -56,7 +66,7 @@
         document.getElementById("reason_message").innerText = reasonMessage;
       },
       onCompleted: function (orderState, paymentState, processing, reasonCode, reasonMessage) {
-        let successPath = "<%= @payment.success_url %>";
+        let successPath = "<%= vpago_success_url %>";
         window.location.href = successPath;
       },
     });

data/config/routes.rb

@@ -43,6 +43,15 @@ Spree::Core::Engine.add_routes do
     end
   end
 
+  resource :vpago_orders do
+    collection do
+      get :processing
+      get :success
+
+      match :process_order, via: %i[get post]
+    end
+  end
+
   namespace :webhook do
     resource :payways, only: [] do
       match 'return', to: 'payways#return', via: %i[get post]

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.4.0'.freeze
+  VERSION = '2.4.1'.freeze
 
   def version
     Gem::Version.new VERSION

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.4.1
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-07 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -181,6 +181,7 @@ files:
 - app/controllers/spree/payway_card_popups_controller.rb
 - app/controllers/spree/payway_results_controller.rb
 - app/controllers/spree/payway_v2_card_popups_controller.rb
+- app/controllers/spree/vpago_orders_controller.rb
 - app/controllers/spree/vpago_payments_controller.rb
 - app/controllers/spree/webhook/acleda_mobiles_controller.rb
 - app/controllers/spree/webhook/acledas_controller.rb
@@ -196,6 +197,7 @@ files:
 - app/javascripts/queue_processor.test.js
 - app/javascripts/vpago/vpago_payments/user_informers/firebase.js
 - app/jobs/application_unique_job.rb
+- app/jobs/vpago/order_processor_job.rb
 - app/jobs/vpago/payment_canceler_job.rb
 - app/jobs/vpago/payment_capturer_job.rb
 - app/jobs/vpago/payment_processor_job.rb
@@ -264,6 +266,7 @@ files:
 - app/overrides/spree/admin/tax_categories/index/collect_by_table_body.html.erb.deface
 - app/overrides/spree/admin/tax_categories/index/collect_by_table_header.html.erb.deface
 - app/serializers/spree/api/v2/platform/vpago_payment_source_serializer.rb
+- app/serializers/spree/v2/storefront/cart_serializer_decorator.rb
 - app/serializers/spree/v2/storefront/payment_method_serializer_decorator.rb
 - app/serializers/spree/v2/storefront/payment_redirect_serializer.rb
 - app/serializers/spree/v2/storefront/payment_serializer_decorator.rb
@@ -271,6 +274,9 @@ files:
 - app/services/.gitkeep
 - app/services/vpago/acleda_mini_app/session/create.rb
 - app/services/vpago/aes_encrypter.rb
+- app/services/vpago/order_finder.rb
+- app/services/vpago/order_processor.rb
+- app/services/vpago/order_url_constructor.rb
 - app/services/vpago/payment_finder.rb
 - app/services/vpago/payment_processable.rb
 - app/services/vpago/payment_processor.rb
@@ -367,10 +373,10 @@ files:
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac_mini_app.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_wing_mini_app.html.erb
-- app/views/spree/vpago_payments/processing.html.erb
 - app/views/spree/vpago_payments/processing_scripts/spree/gateway/_payway_v2.html.erb
 - app/views/spree/vpago_payments/processing_scripts/spree/gateway/_wing_mini_app.html.erb
-- app/views/spree/vpago_payments/success.html.erb
+- app/views/spree/vpago_shared/processing.html.erb
+- app/views/spree/vpago_shared/success.html.erb
 - app/views/spree/wing_redirects/show.html.erb
 - bin/rails
 - build.js