spree_vpago 2.3.5.pre.pre.pre.8 → 2.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 650e7e403578ee0af32eee90b24798adb845e31d47b819346a42cc5f45db8099
-  data.tar.gz: b052270ee1d51e4bf7c0e01886d23dbf80f97689ae6a27b4a209c3acd241dd94
+  metadata.gz: 92861b027f31b9c4239298967116f3cb34106575da30b650c7220a7981341a23
+  data.tar.gz: 9a43d50434fb8e0eea79e9413219d62bdd10f32b7599534f2702b0143da61c67
 SHA512:
-  metadata.gz: 50547d821d6925afe9ec72dee708200547beef069c8012dbccccf9d3f9910852f5f43c06fa3adb558cac68e84fa56a85aedffdfe2313eac4989ee69614dee577
-  data.tar.gz: 4b71835adc06d52f88ce1243a50f5409c5605ff9711cf0edf7b25ce4cc4ed9c71650cd1da9631a1a7c1a7a8d7fcf637e4f4056a43df0a7301853e095781bcd44
+  metadata.gz: 791e046282f93cb5bbaf1683e788a9e440c394e5101f88fdb48431a517cbcf0367c1b5c49536577f438a31dc30fa37040bcad464b2ec617b30e3c4e2dcbbe6f9
+  data.tar.gz: e31a474f731d18f6a65628bf8f901ed4fd73407a289fc354687ececedb3e0a4f45ab13933d70fba344085e03161b74d139155185db6826a5794f66fab62a0566

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    spree_vpago (2.3.5.pre.pre.pre.8)
+    spree_vpago (2.3.6)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/spree/admin/payments_controller_decorator.rb

@@ -9,9 +9,55 @@ module Spree
         payment_method ||= Spree::PaymentMethod.find(params[:payment][:payment_method_id])
         return unless payment_method.vpago_payment?
 
-        source_params = { payment_option: payment_method.preferred_payment_option }
+        source_params = { payment_option: payment_method.try(:preferred_payment_option) }
         params[:payment][:source_attributes] = source_params
       end
+
+      # override
+      # For vpago gateways created from the admin backend, we skip immediate processing
+      # and keep the payment in `checkout` state so the admin can open the QR checkout
+      # URL and pay on behalf of the customer. The bank webhook
+      # (process_payment -> Vpago::PaymentProcessorJob) completes the order once paid.
+      def create
+        return super unless @payment_method&.vpago_payment?
+
+        invoke_callbacks(:create, :before)
+
+        @payment = @order.payments.build(object_params)
+
+        if @payment.save
+          invoke_callbacks(:create, :after)
+          flash[:success] = flash_message_for(@payment, :successfully_created)
+          redirect_to spree.admin_order_payments_path(@order)
+        else
+          invoke_callbacks(:create, :fails)
+          flash[:error] = Spree.t(:payment_could_not_be_created)
+          render :new, status: :unprocessable_entity
+        end
+      rescue Spree::Core::GatewayError => e
+        invoke_callbacks(:create, :fails)
+        flash[:error] = e.message.to_s
+        redirect_to spree.new_admin_order_payment_path(@order)
+      end
+
+      # override
+      # Before the normal `process!` re-runs the gateway, reset a stuck vpago
+      # payment back to `checkout`. Admin reprocess only — the automatic webhook
+      # path is untouched (it auto-resets `failed` alone).
+      def fire
+        reset_stuck_payment_for_reprocess!
+        super
+      end
+
+      private
+
+      def reset_stuck_payment_for_reprocess!
+        return unless params[:e] == 'process'
+        return unless @payment&.payment_method&.vpago_payment?
+        return unless @payment.can_reset_for_retry?
+
+        @payment.reset_for_retry!
+      end
     end
   end
 end

data/app/controllers/spree/admin/suspicious_orders_controller.rb

@@ -0,0 +1,64 @@
+module Spree
+  module Admin
+    class SuspiciousOrdersController < Spree::Admin::BaseController
+      around_action :set_writing_role, only: %i[check_transaction]
+
+      def index
+        params[:q] = { completed_at_not_null: 1, payment_state_eq: 'balance_due', s: 'completed_at desc' }.dup if params[:q].blank?
+
+        @search = scope.ransack(params[:q])
+        @orders = @search.result(distinct: true)
+                         .preload(:payments, :reimbursements)
+                         .page(params[:page])
+                         .per(params[:per_page] || Spree::Backend::Config[:admin_orders_per_page])
+      end
+
+      def payments
+        @order = scope.find_by!(number: params[:id])
+        @payments = @order.payments.includes(:payment_method)
+
+        render layout: false
+      end
+
+      # Renders the result inline into this order's payments frame instead of
+      # redirecting, so the admin never leaves this list.
+      def check_transaction
+        @order = scope.find_by!(number: params[:id])
+        payment = @order.payments.find_by!(number: params[:payment_number])
+
+        @check_result = query_payment_transaction(payment)
+        @payments = @order.payments.includes(:payment_method)
+
+        render 'payments', layout: false
+      end
+
+      private
+
+      # Delegates to the gateway's own check_transaction (same method
+      # PaywayV2/Vattanac/TrueMoney already implement) - no per-gateway
+      # branching needed here.
+      def query_payment_transaction(payment)
+        method = payment.payment_method
+        return nil unless method.support_check_transaction_api?
+
+        result = method.check_transaction(payment)
+
+        # Not every gateway's checker implements error_message (e.g. Vattanac,
+        # TrueMoney) - fall back to the raw response so this doesn't blow up
+        # for gateways that only implement the minimal success?/json_response duck type.
+        message =
+          if result.success?
+            Spree.t('vpago.payments.payment_found_with_result', result: result.try(:json_response))
+          else
+            Spree.t('vpago.payments.payment_not_found_with_error', error: result.try(:error_message) || result.try(:json_response))
+          end
+
+        { success: result.success?, message: message }
+      end
+
+      def scope
+        current_store.orders.accessible_by(current_ability, :index)
+      end
+    end
+  end
+end

data/app/helpers/vpago/admin/base_helper_decorator.rb

@@ -12,7 +12,6 @@ module Vpago
           payway_abapay
           payway_alipay
           payway_wechat
-          acleda_v2
           acleda
           acleda_khqr
           acleda_cards
@@ -29,10 +28,6 @@ module Vpago
         %w[khqr deeplink all]
       end
 
-      def available_acleda_v2_modes
-        Spree::Gateway::AcledaV2::MODES
-      end
-
       def preference_field_for(form, field, options)
         case field
         when 'preferred_acleda_type'
@@ -50,8 +45,6 @@ module Vpago
           return form.select(:preferred_abapay_khqr_deeplink_option, Spree::Gateway::PaywayV2::ABAPAY_KHQR_DEEPLINK_OPTIONS, {}, class: 'fullwidth select2')
         when 'preferred_vattanac_payment_option'
           return form.select(:preferred_vattanac_payment_option, available_vattanac_payment_options, {}, class: 'fullwidth select2')
-        when 'preferred_acleda_v2_mode'
-          return form.select(:preferred_acleda_v2_mode, available_acleda_v2_modes, {}, class: 'fullwidth select2')
         end
         super
       end

data/app/models/vpago/order_decorator.rb

@@ -64,6 +64,8 @@ module Vpago
 
         payment_methods = if early_adopter?
                             payment_methods.available_on_frontend_for_early_adopter.select { |pm| pm.available_for_order?(self) }
+                          elsif ticket_seller?
+                            payment_methods.available_on_back_end.select { |pm| pm.available_for_order?(self) }
                           else
                             payment_methods.available_on_front_end.select { |pm| pm.available_for_order?(self) }
                           end
@@ -73,23 +75,14 @@ module Vpago
       end
     end
 
-    # override
-    def collect_backend_payment_methods
-      payment_methods = if respond_to?(:tenant) && tenant.present?
-                          tenant_payment_methods
-                        elsif vendor_payment_methods.any?
-                          vendor_payment_methods
-                        else
-                          store.payment_methods
-                        end
-
-      payment_methods.available_on_back_end.select { |pm| pm.available_for_order?(self) }
-    end
-
     def early_adopter?
       user.present? && user.respond_to?(:early_adopter?) && user.early_adopter?
     end
 
+    def ticket_seller?
+      user.present? && user.respond_to?(:has_spree_role?) && user.has_spree_role?('ticket_seller')
+    end
+
     def tenant_payment_methods
       tenant.tenant_payment_methods
     end

data/app/models/vpago/payment_decorator.rb

@@ -27,9 +27,11 @@ module Vpago
                     :process_payment_url,
                     to: :url_constructor
 
-      # Add state machine event for payment retry
+      # State machine event for payment retry / admin reprocess.
+      # `failed` is auto-reset by process!/capture! below (Sidekiq retry);
+      # void/invalid/processing are reset only by the admin reprocess action.
       base.state_machine.event :reset_for_retry do
-        transition from: %i[failed], to: :checkout
+        transition from: %i[failed void invalid processing], to: :checkout
       end
     end
 

data/app/models/vpago/payment_method_decorator.rb

@@ -1,10 +1,9 @@
 module Vpago
-  module PaymentMethodDecorator # rubocop:disable Metrics/ModuleLength
+  module PaymentMethodDecorator
     TYPE_PAYWAY = 'Spree::Gateway::Payway'.freeze
     TYPE_PAYWAY_V2 = 'Spree::Gateway::PaywayV2'.freeze
     TYPE_WINGSDK = 'Spree::Gateway::WingSdk'.freeze
     TYPE_ACLEDA = 'Spree::Gateway::Acleda'.freeze
-    TYPE_ACLEDA_V2 = 'Spree::Gateway::AcledaV2'.freeze
     TYPE_ACLEDA_MOBILE = 'Spree::Gateway::AcledaMobile'.freeze
     TYPE_TRUE_MONEY = 'Spree::Gateway::TrueMoney'.freeze
     TYPE_VATTANAC = 'Spree::Gateway::Vattanac'.freeze
@@ -22,7 +21,6 @@ module Vpago
           Spree::PaymentMethod::TYPE_PAYWAY,
           Spree::PaymentMethod::TYPE_WINGSDK,
           Spree::PaymentMethod::TYPE_ACLEDA,
-          Spree::PaymentMethod::TYPE_ACLEDA_V2,
           Spree::PaymentMethod::TYPE_ACLEDA_MOBILE,
           Spree::PaymentMethod::TYPE_VATTANAC,
           Spree::PaymentMethod::TYPE_VATTANAC_MINI_APP,
@@ -91,10 +89,6 @@ module Vpago
       type == Spree::PaymentMethod::TYPE_ACLEDA
     end
 
-    def type_acleda_v2?
-      type == Spree::PaymentMethod::TYPE_ACLEDA_V2
-    end
-
     def type_payway?
       type == Spree::PaymentMethod::TYPE_PAYWAY
     end

data/app/overrides/spree/admin/payments/_form/admin_payment_form_fields.html.erb.deface

@@ -0,0 +1,36 @@
+<!-- replace "[data-hook='admin_payment_form_fields']" -->
+
+<div data-hook="admin_payment_form_fields">
+  <div class="form-group">
+    <%= f.label :amount, Spree.t(:amount) %>
+    <%= f.text_field :amount, value: @order.display_outstanding_balance.money, class: 'form-control' %>
+  </div>
+  <div class="form-group">
+    <strong><%= Spree.t(:payment_method) %></strong>
+    <% @payment_methods.each do |method| %>
+      <div class="radio" data-id="<%= Spree.t(method.name, scope: :payment_methods, default: method.name).parameterize %>">
+        <label data-hook="payment_method_field">
+          <%= radio_button_tag 'payment[payment_method_id]', method.id, method == @payment_method, { class: "payment_methods_radios" } %>
+          <%= Spree.t(method.name, scope: :payment_methods, default: method.name) %>
+        </label>
+      </div>
+    <% end %>
+
+    <div class="payment-method-settings">
+      <% @payment_methods.each do |method| %>
+        <div class="payment-methods my-3" id="payment_method_<%= method.id %>">
+          <% if method.source_required? %>
+            <% partial_path = "spree/admin/payments/source_forms/#{method.method_type}" %>
+            <% if lookup_context.exists?(partial_path, [], true) %>
+              <%= render partial: partial_path,
+                         locals: {
+                           payment_method: method,
+                           previous_cards: method.reusable_sources(@order)
+                         } %>
+            <% end %>
+          <% end %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+</div>

data/app/overrides/spree/admin/payments/_list/actions.html.erb.deface

@@ -7,7 +7,9 @@
         <% elsif action == 'open_checkout' %>
             <%= link_to_with_icon('qr-code.svg', Spree.t(action), payment.checkout_url, target: '_blank', no_text: true, class: "btn btn-light btn-sm") %>
         <% else %>
-            <%= link_to_with_icon(action + '.svg', Spree.t(action), fire_admin_order_payment_path(@order, payment, e: action), method: :put, no_text: true, data: { action: action }, class: "btn btn-light btn-sm") if can?(action.to_sym, payment) %>
+            <% action_data = { action: action } %>
+            <% action_data[:confirm] = Spree.t(:reprocess_payment_confirmation, default: 'Reprocess this payment? This will re-run the gateway transaction.') if action == 'process' %>
+            <%= link_to_with_icon(action + '.svg', Spree.t(action), fire_admin_order_payment_path(@order, payment, e: action), method: :put, no_text: true, data: action_data, class: "btn btn-light btn-sm") if can?(action.to_sym, payment) %>
         <% end %>
     <% end %>
 </span>

data/app/overrides/spree/admin/shared/sub_menu/_orders/suspicious_orders.html.erb.deface

@@ -0,0 +1,3 @@
+<!-- insert_bottom "[data-hook='admin_orders']" -->
+
+<%= tab :suspicious_orders, url: spree.admin_suspicious_orders_path, label: Spree.t('admin.orders.suspicious_orders') %>

data/app/services/vpago/payment_finder.rb

@@ -14,15 +14,11 @@ module Vpago
     end
 
     def find_and_verify!
-      if vattanac_mini_app_callback?
+      if vattanac_mini_app_payload?
         payload = Vpago::VattanacMiniAppDataHandler.new.decrypt_data(@params_hash[:data])
         payment = Spree::Payment.find_by!(number: payload['paymentId'])
         payment.update(transaction_response: payload)
         payment
-      elsif acleda_v2_callback?
-        # ACLEDA V2's static portal callback echoes back _transactionid, which is
-        # the payment number we sent as transactionID/txid at openSessionV2.
-        Spree::Payment.find_by!(number: params_hash[:_transactionid])
       else
         order = Spree::Order.find_by!(number: params_hash[:order_number])
         verify_jwt!(order)
@@ -35,12 +31,8 @@ module Vpago
       JWT.decode(params_hash[:order_jwt_token], order.token, 'HS256')
     end
 
-    def vattanac_mini_app_callback?
+    def vattanac_mini_app_payload?
       params_hash[:data].present?
     end
-
-    def acleda_v2_callback?
-      params_hash[:_paymenttokenid].present?
-    end
   end
 end

data/app/views/spree/admin/suspicious_orders/_payments_table.html.erb

@@ -0,0 +1,71 @@
+<% if check_result.present? %>
+  <script>
+    show_flash('<%= check_result[:success] ? "success" : "error" %>', '<%= j check_result[:message] %>')
+  </script>
+<% end %>
+
+<table class="table mb-0">
+  <thead class="text-muted">
+    <tr>
+      <th><%= Spree::Payment.human_attribute_name(:id) %></th>
+      <th><%= Spree::Payment.human_attribute_name(:number) %></th>
+      <th><%= "#{Spree.t('date')}/#{Spree.t('time')}" %></th>
+      <th class="text-center"><%= Spree.t(:amount) %></th>
+      <th class="text-center"><%= Spree.t(:payment_method) %></th>
+      <th class="text-center"><%= Spree.t(:payment_state) %></th>
+      <th class="actions text-center"></th>
+    </tr>
+  </thead>
+  <tbody>
+    <% payments.each do |payment| %>
+      <tr>
+        <td><%= payment.id %></td>
+        <td><%= link_to payment.number, spree.admin_order_payment_path(order, payment), data: { turbo_frame: '_top' } %></td>
+        <td><%= pretty_time(payment.created_at) %></td>
+        <td class="text-center"><%= payment.display_amount %></td>
+        <td class="text-center">
+          <% payment_method = payment.payment_method %>
+          <% if can?(:update, payment_method) %>
+            <%= link_to payment_method.name, spree.edit_admin_payment_method_path(payment_method),
+                  target: '_blank', rel: 'noopener noreferrer' %>
+          <% else %>
+            <%= payment_method.name %>
+          <% end %>
+        </td>
+        <td class="text-center">
+          <span class="badge badge-pill badge-<%= payment.state %>">
+            <%= Spree.t(payment.state, scope: :payment_states, default: payment.state.capitalize) %>
+          </span>
+        </td>
+        <td class="actions">
+          <span class="d-flex justify-content-center payment-action-buttons">
+            <% if payment.payment_method.support_check_transaction_api? %>
+
+              <%= button_to spree.check_transaction_admin_suspicious_order_path(order, payment_number: payment.number),
+                    form: { data: { turbo_frame: "suspicious_order_#{order.id}_payments" }, class: 'd-inline' },
+                    class: 'btn btn-light btn-sm icon-link with-tip', title: Spree.t('vpago.payments.query_status') do %>
+                <%= svg_icon(name: 'search.svg', classes: 'icon icon-search', width: 14, height: 14) %>
+              <% end %>
+            <% end %>
+
+            <% payment.actions.each do |action| %>
+              <% if action == 'credit' %>
+                <%= link_to_with_icon('exit.svg', Spree.t(:refund), spree.new_admin_order_payment_refund_path(order, payment),
+                      no_text: true, data: { turbo_frame: '_top' }, class: 'btn btn-light btn-sm') if can?(:create, Spree::Refund) %>
+              <% elsif action == 'open_checkout' %>
+                <%= link_to_with_icon('qr-code.svg', Spree.t(action), payment.checkout_url,
+                      target: '_blank', rel: 'noopener noreferrer', no_text: true, class: 'btn btn-light btn-sm') %>
+              <% else %>
+                <% action_data = { action: action, turbo_frame: '_top' } %>
+                <% action_data[:confirm] = Spree.t(:reprocess_payment_confirmation, default: 'Reprocess this payment? This will re-run the gateway transaction.') if action == 'process' %>
+                <%= link_to_with_icon(action + '.svg', Spree.t(action), spree.fire_admin_order_payment_path(order, payment, e: action),
+                      method: :put, no_text: true, data: action_data,
+                      class: 'btn btn-light btn-sm') if can?(action.to_sym, payment) %>
+              <% end %>
+            <% end %>
+          </span>
+        </td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>

data/app/views/spree/admin/suspicious_orders/index.html.erb

@@ -0,0 +1,112 @@
+<% content_for :page_title do %>
+  <%= Spree.t('admin.orders.suspicious_orders') %>
+<% end %>
+
+<%# Simple, always-visible filters kept intentionally small. %>
+<div class="card mb-3">
+  <div class="card-body">
+    <%= search_form_for [:admin, @search], url: spree.admin_suspicious_orders_path, html: { method: :get } do |f| %>
+      <div class="form-row align-items-end">
+        <div class="col-12 col-sm-6 col-lg mb-2 mb-lg-0">
+          <div class="form-group mb-0">
+            <%= f.label :number_cont, Spree.t(:search_order_number) %>
+            <%= f.search_field :number_cont, class: 'form-control' %>
+          </div>
+        </div>
+        <div class="col-12 col-sm-6 col-lg mb-2 mb-lg-0">
+          <div class="form-group mb-0">
+            <%= f.label :payments_number_cont, Spree.t('admin.orders.payment_number') %>
+            <%= f.search_field :payments_number_cont, class: 'form-control' %>
+          </div>
+        </div>
+        <div class="col-12 col-sm-6 col-lg mb-2 mb-lg-0">
+          <div class="form-group mb-0">
+            <%= f.label :email_or_phone_number_cont, Spree.t('admin.orders.email_or_phone') %>
+            <%= f.search_field :email_or_phone_number_cont, class: 'form-control' %>
+          </div>
+        </div>
+        <div class="col-12 col-sm-6 col-lg mb-2 mb-lg-0">
+          <div class="form-group mb-0">
+            <%= f.label :payment_state_eq, Spree.t(:payment_state) %>
+
+            <%= f.select :payment_state_eq,
+                  ::Spree::Order::PAYMENT_STATES.map { |s| [Spree.t("payment_states.#{s}"), s] },
+                  { include_blank: true }, class: 'select2-clear' %>
+          </div>
+        </div>
+        <div class="col-12 col-sm-6 col-lg mb-2 mb-lg-0">
+          <div class="form-group mb-0">
+            <%= f.label :payments_payment_method_id_eq, Spree.t(:payment_method) %>
+            <%= f.select :payments_payment_method_id_eq,
+                  ::Spree::PaymentMethod.pluck(:name, :id),
+                  { include_blank: true }, class: 'select2-clear' %>
+          </div>
+        </div>
+        <div class="col-12 col-lg-auto mb-2 mb-lg-0">
+          <%= button Spree.t(:search), 'search.svg', 'submit', class: 'btn-primary btn-block' %>
+        </div>
+      </div>
+    <% end %>
+  </div>
+</div>
+
+<table class="table" id="listing_suspicious_orders">
+  <thead>
+    <tr>
+      <th><%= Spree.t(:order) %></th>
+      <th><%= Spree.t(:date) %></th>
+      <th><%= Spree.t(:status) %></th>
+      <th><%= Spree.t(:payment_state) %></th>
+      <th class="text-right"><%= Spree.t(:total) %></th>
+      <th class="text-right"><%= Spree.t('admin.orders.outstanding_balance') %></th>
+      <th class="text-right"><%= Spree.t('admin.orders.payments') %></th>
+    </tr>
+  </thead>
+  <tbody>
+    <% @orders.each do |order| %>
+      <% payments_frame_id = "payments-collapse-#{order.id}" %>
+      <tr>
+        <td><%= link_to order.number, spree.edit_admin_order_path(order) %></td>
+        <td><%= pretty_time(order.completed_at) %></td>
+        <td>
+          <span class="badge badge-pill badge-<%= order.state %>">
+            <%= Spree.t("order_state.#{order.state}") %>
+          </span>
+        </td>
+        <td>
+          <span class="badge badge-pill badge-<%= order.payment_state %>">
+            <%= Spree.t("payment_states.#{order.payment_state}") %>
+          </span>
+        </td>
+        <td class="text-right"><%= order.display_total %></td>
+        <td class="text-right"><%= order.display_outstanding_balance %></td>
+        <td class="text-right">
+          <button type="button" data-toggle="collapse" data-target="#<%= payments_frame_id %>"
+                  aria-expanded="false" aria-controls="<%= payments_frame_id %>"
+                  class="btn btn-sm btn-light">
+            <%= Spree.t('admin.orders.payments_count', count: order.payments.size) %>
+            <%= svg_icon(name: 'chevron-down.svg', classes: 'icon ml-1', width: 12, height: 12) %>
+          </button>
+        </td>
+      </tr>
+      <tr>
+        <td colspan="7" class="p-0 border-top-0">
+          <div class="collapse" id="<%= payments_frame_id %>">
+            <div class="mb-3 border border-primary rounded-lg overflow-hidden bg-white">
+              <div class="bg-light px-3 py-2 small font-weight-bold text-uppercase text-muted">
+                <%= svg_icon(name: 'receipt.svg', classes: 'icon mr-2', width: 14, height: 14) %>
+                <%= Spree.t('admin.orders.payments_for_order', number: order.number) %>
+              </div>
+              <%= turbo_frame_tag "suspicious_order_#{order.id}_payments",
+                    src: spree.payments_admin_suspicious_order_path(order), loading: 'lazy' do %>
+                <div class="p-3 text-center text-muted"><%= Spree.t(:loading) %>…</div>
+              <% end %>
+            </div>
+          </div>
+        </td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>
+
+<%= render 'spree/admin/shared/index_table_options', collection: @orders %>

data/app/views/spree/admin/suspicious_orders/payments.html.erb

@@ -0,0 +1,3 @@
+<%= turbo_frame_tag "suspicious_order_#{@order.id}_payments" do %>
+  <%= render 'payments_table', order: @order, payments: @payments, check_result: @check_result %>
+<% end %>

data/config/locales/en.yml

@@ -10,6 +10,17 @@ en:
     insufficient_payment_amount_to_cover_the_total: "Payment amount is insufficient to cover the total"
     qr_code: "QR code"
     open_checkout: "Open Checkout"
+    admin:
+      orders:
+        suspicious_orders: "Suspicious Orders"
+        outstanding_balance: "Outstanding Balance"
+        payments: "Payments"
+        payment_number: "Payment Number"
+        email_or_phone: "Email / Phone Number"
+        payments_count:
+          one: "1 Payment"
+          other: "%{count} Payments"
+        payments_for_order: "Payments for %{number}"
     vpago:
       payments:
         check_and_heal: "Auto correct"

data/config/locales/km.yml

@@ -6,6 +6,17 @@ spree:
   insufficient_payment_amount_to_cover_the_total: "ចំនួនទឹកប្រាក់នៃការទូទាត់គឺមិនគ្រប់គ្រាន់"
   qr_code: "QR code"
   open_checkout: "Open Checkout"
+  admin:
+    orders:
+      suspicious_orders: "ការបង់ប្រាក់គួរឱ្យសង្ស័យ"
+      outstanding_balance: "សមតុល្យនៅសល់"
+      payments: "ការបង់ប្រាក់"
+      payment_number: "លេខការបង់ប្រាក់"
+      email_or_phone: "អ៊ីមែល / លេខទូរស័ព្ទ"
+      payments_count:
+        one: "ការបង់ប្រាក់ %{count}"
+        other: "ការបង់ប្រាក់ %{count}"
+      payments_for_order: "ការបង់ប្រាក់សម្រាប់ %{number}"
   vpago:
     payments:
       check_and_heal: "កែស្វ័យប្រវត្តិ"

data/config/routes.rb

@@ -90,5 +90,12 @@ Spree::Core::Engine.add_routes do
         post :verify_with_bank
       end
     end
+
+    resources :suspicious_orders, only: [:index] do
+      member do
+        get :payments
+        post 'payments/:payment_number/check_transaction', action: :check_transaction, as: :check_transaction
+      end
+    end
   end
 end

data/lib/spree_vpago/engine.rb

@@ -21,7 +21,6 @@ module SpreeVpago
         Spree::Gateway::PaywayV2,
         Spree::Gateway::WingSdk,
         Spree::Gateway::Acleda,
-        Spree::Gateway::AcledaV2,
         Spree::Gateway::AcledaMobile,
         Spree::Gateway::Vattanac,
         Spree::Gateway::VattanacMiniApp,

data/lib/spree_vpago/version.rb

@@ -1,7 +1,7 @@
 module SpreeVpago
   module_function
 
-  VERSION = '2.3.5-pre-8'.freeze
+  VERSION = '2.3.6'.freeze
 
   def version
     Gem::Version.new VERSION

data/lib/vpago/acleda/checkout.rb

@@ -60,7 +60,7 @@ module Vpago
             purchaseDate: purchase_date,
             purchaseDesc: 'items',
             item: '1',
-            quantity: '1', # always 1: one payment = one transaction
+            quantity: '1',
             expiryTime: expiry_time,
             otherUrl: other_url
           }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_vpago
 version: !ruby/object:Gem::Version
-  version: 2.3.5.pre.pre.pre.8
+  version: 2.3.6
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-14 00:00:00.000000000 Z
+date: 2026-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -165,6 +165,7 @@ files:
 - app/controllers/spree/admin/payout_profile_shipping_methods_controller.rb
 - app/controllers/spree/admin/payout_profiles_controller.rb
 - app/controllers/spree/admin/payouts_controller.rb
+- app/controllers/spree/admin/suspicious_orders_controller.rb
 - app/controllers/spree/api/v2/storefront/checkout_controller_decorator.rb
 - app/controllers/spree/payway_card_popups_controller.rb
 - app/controllers/spree/payway_results_controller.rb
@@ -192,7 +193,6 @@ files:
 - app/models/concerns/vpago/payoutable.rb
 - app/models/spree/gateway/acleda.rb
 - app/models/spree/gateway/acleda_mobile.rb
-- app/models/spree/gateway/acleda_v2.rb
 - app/models/spree/gateway/payway.rb
 - app/models/spree/gateway/payway_v2.rb
 - app/models/spree/gateway/true_money.rb
@@ -237,11 +237,13 @@ files:
 - app/overrides/spree/admin/payment_methods/index/tenant_header.html.erb.deface
 - app/overrides/spree/admin/payment_methods/index/vendor_body.html.erb.deface
 - app/overrides/spree/admin/payment_methods/index/vendor_header.html.erb.deface
+- app/overrides/spree/admin/payments/_form/admin_payment_form_fields.html.erb.deface
 - app/overrides/spree/admin/payments/_list/actions.html.erb.deface
 - app/overrides/spree/admin/promotions/_promotion_action/run_by_field.html.erb.deface
 - app/overrides/spree/admin/shared/_order_tabs/payouts.html.erb.deface
 - app/overrides/spree/admin/shared/_product_tabs/payout_profile_products.html.erb.deface
 - app/overrides/spree/admin/shared/sub_menu/_integrations/payout_profiles.html.erb.deface
+- app/overrides/spree/admin/shared/sub_menu/_orders/suspicious_orders.html.erb.deface
 - app/overrides/spree/admin/shipping_methods/_form/handle_by.html.erb.deface
 - app/overrides/spree/admin/shipping_methods/edit/shipping_method_tabs.html.erb.deface
 - app/overrides/spree/admin/tax_categories/_form/collect_by_field.html.erb.deface
@@ -281,7 +283,6 @@ files:
 - app/views/spree/admin/payments/source_forms/_payway_v2.html.erb
 - app/views/spree/admin/payments/source_views/_acleda.html.erb
 - app/views/spree/admin/payments/source_views/_acleda_mobile.html.erb
-- app/views/spree/admin/payments/source_views/_acleda_v2.html.erb
 - app/views/spree/admin/payments/source_views/_payment_payway.html.erb
 - app/views/spree/admin/payments/source_views/_payway_v2.html.erb
 - app/views/spree/admin/payments/source_views/_true_money.html.erb
@@ -308,10 +309,12 @@ files:
 - app/views/spree/admin/shared/_shipping_method_tabs.html.erb
 - app/views/spree/admin/shared/payout_profile/_info_card.html.erb
 - app/views/spree/admin/shared/payout_profile/_status.html.erb
+- app/views/spree/admin/suspicious_orders/_payments_table.html.erb
+- app/views/spree/admin/suspicious_orders/index.html.erb
+- app/views/spree/admin/suspicious_orders/payments.html.erb
 - app/views/spree/checkout/payment/_acleda.html.erb
 - app/views/spree/checkout/payment/_acleda_checkout_form.html.erb
 - app/views/spree/checkout/payment/_acleda_mobile.html.erb
-- app/views/spree/checkout/payment/_acleda_v2_checkout_form.html.erb
 - app/views/spree/checkout/payment/_payment_payway.html.erb
 - app/views/spree/checkout/payment/_payway_loader.html.erb
 - app/views/spree/checkout/payment/_payway_root.html.erb
@@ -334,7 +337,6 @@ files:
 - app/views/spree/payway_v2_card_popups/show.html.erb
 - app/views/spree/vpago_payments/_transaction_checker.html.erb
 - app/views/spree/vpago_payments/checkout.html.erb
-- app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_payway_v2.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_true_money.html.erb
 - app/views/spree/vpago_payments/forms/spree/gateway/_vattanac.html.erb
@@ -392,9 +394,6 @@ files:
 - lib/vpago/acleda_mobile/payment_request_updater.rb
 - lib/vpago/acleda_mobile/payment_retriever.rb
 - lib/vpago/acleda_mobile/transaction_status.rb
-- lib/vpago/acleda_v2/base.rb
-- lib/vpago/acleda_v2/checkout.rb
-- lib/vpago/acleda_v2/transaction_status.rb
 - lib/vpago/payment_amount_calculator.rb
 - lib/vpago/payment_request_updater.rb
 - lib/vpago/payment_status_marker.rb
@@ -450,9 +449,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements:
 - none
 rubygems_version: 3.4.1

data/app/models/spree/gateway/acleda_v2.rb

@@ -1,89 +0,0 @@
-module Spree
-  class Gateway::AcledaV2 < PaymentMethod
-    MODES = %w[khqr card deeplink].freeze
-
-    preference :merchant_name, :string
-    preference :xpay_service_base_url, :string
-    preference :payment_page_url, :string
-    preference :merchant_id, :string
-    preference :login_id, :string
-    preference :password, :string
-    preference :secret, :string # HMAC-SHA512 key
-    preference :payment_expiry_time_in_mn, :integer, default: 5
-    preference :acleda_v2_mode, :string, default: 'khqr'
-
-    validates :preferred_acleda_v2_mode, inclusion: { in: MODES }
-
-    def khqr?
-      preferred_acleda_v2_mode == 'khqr'
-    end
-
-    def card?
-      preferred_acleda_v2_mode == 'card'
-    end
-
-    def deeplink?
-      preferred_acleda_v2_mode == 'deeplink'
-    end
-
-    # KHQR (Scan with Bank under Bakong) = "0"; Credit/debit card = "1"
-    def payment_card_value
-      card? ? '1' : '0'
-    end
-
-    # override: partial to render in admin
-    def method_type
-      'acleda_v2'
-    end
-
-    # override
-    def payment_source_class
-      Spree::VpagoPaymentSource
-    end
-
-    # override
-    def payment_profiles_supported?
-      false
-    end
-
-    # override
-    def available_for_order?(_order)
-      true
-    end
-
-    # override: process! -> purchase! immediately (no pre-auth for ACLEDA V2)
-    def auto_capture?
-      true
-    end
-
-    # override
-    def purchase(_amount, _source, gateway_options = {})
-      _, payment_number = gateway_options[:order_id].split('-')
-      payment = Spree::Payment.find_by(number: payment_number)
-
-      checker = check_transaction(payment)
-      payment.update(transaction_response: checker.json_response)
-
-      params = { check: { response: checker.json_response } }
-
-      if checker.success?
-        ActiveMerchant::Billing::Response.new(true, 'Acleda V2: Purchased', params)
-      else
-        ActiveMerchant::Billing::Response.new(false, 'Acleda V2: Purchasing Failed', params)
-      end
-    end
-
-    # Defining check_transaction makes support_check_transaction_api? true,
-    # enabling the /vpago_payments/check_transaction poller.
-    def check_transaction(payment)
-      checker = Vpago::AcledaV2::TransactionStatus.new(payment)
-      checker.call
-      checker
-    end
-
-    # override
-    def cancel(_response_code, _payment = nil)
-      ActiveMerchant::Billing::Response.new(true, 'Acleda V2: Payment has been canceled.')
-    end
-  end
-end

data/app/views/spree/admin/payments/source_views/_acleda_v2.html.erb

@@ -1,5 +0,0 @@
-<%= render 'spree/admin/payments/source_views/vpago_payment_tmpl',
-    payment: payment,
-    check_status_url: '',
-    heal_payment_url: '',
-    manual_update_payment_url: '' %>

data/app/views/spree/checkout/payment/_acleda_v2_checkout_form.html.erb

@@ -1,12 +0,0 @@
-<form method="post" action="<%= action_url %>" id="acleda_v2_checkout_form" style="display:none;">
-  <% gateway_params.each do |name, value| %>
-    <input type="hidden" name="<%= name %>" value="<%= value %>">
-  <% end %>
-</form>
-
-<script>
-  (function () {
-    var form = document.getElementById("acleda_v2_checkout_form");
-    if (form) form.submit();
-  })();
-</script>

data/app/views/spree/vpago_payments/forms/spree/gateway/_acleda_v2.html.erb

@@ -1,48 +0,0 @@
-<%
-  opr_device = request.user_agent.to_s.downcase.match?(/iphone|ipad|ipod/) ? 'ios' : 'android'
-  checkout = ::Vpago::AcledaV2::Checkout.new(@payment, { platform: params[:platform], opr_device: opr_device })
-
-  begin
-    checkout.call
-  rescue => e
-    Rails.logger.error("Acleda V2 checkout.call failed: #{e.message}")
-  end
-%>
-
-<% if checkout.failed? %>
-  <script>
-    console.error("[Vpago] Acleda V2 checkout error: <%= j checkout.error_message.to_s %>");
-    document.addEventListener("DOMContentLoaded", () => {
-      const loadingContainer = document.getElementById('vpago_loading_container');
-      if (loadingContainer) {
-        loadingContainer.textContent = "We couldn't start your payment. Please go back and try again.";
-      }
-    });
-  </script>
-<% elsif checkout.deeplink? %>
-  <script>
-    function showRedirectContainer(buttonLabel, onClick) {
-      const loadingContainer = document.getElementById('vpago_loading_container');
-      const redirectContainer = document.getElementById('vpago_redirect_container');
-      const redirectButton = document.getElementById('vpago_redirect_button');
-
-      redirectButton.textContent = buttonLabel;
-      redirectButton.addEventListener('click', onClick);
-
-      loadingContainer.style.display = 'none';
-      redirectContainer.style.removeProperty('display');
-    }
-
-    const deeplinkUrl = "<%= raw checkout.deeplink_url %>";
-    const redirectTo = (url) => { if (url) window.location.href = url; };
-
-
-    redirectTo(deeplinkUrl);   
-    showRedirectContainer("Open ACLEDA", () => redirectTo(deeplinkUrl));
-
-  </script>
-<% else %>
-  <%= render 'spree/checkout/payment/acleda_v2_checkout_form',
-             gateway_params: checkout.gateway_params,
-             action_url: checkout.action_url %>
-<% end %>

data/lib/vpago/acleda_v2/base.rb

@@ -1,158 +0,0 @@
-module Vpago
-  module AcledaV2
-    class Base
-      CONTENT_TYPE_JSON = 'application/json'.freeze
-      # ACLEDA requires purchaseDesc to be <= 16 chars, English only.
-      PURCHASE_DESC = 'Purchase goods'.freeze
-
-      def initialize(payment, options = {})
-        @options = options
-        @payment = payment
-      end
-
-      def payment_method
-        @payment.payment_method
-      end
-
-      def payment_number
-        @payment.number
-      end
-
-      def amount
-        format('%.2f', @payment.amount)
-      end
-
-      # txid <= 16 chars; payment.number fits.
-      alias transaction_id payment_number
-
-      def order_number
-        @payment.order.number
-      end
-
-      def merchant_name
-        payment_method.preferences[:merchant_name]
-      end
-
-      def merchant_id
-        payment_method.preferences[:merchant_id]
-      end
-
-      def login_id
-        payment_method.preferences[:login_id]
-      end
-
-      def password
-        payment_method.preferences[:password]
-      end
-
-      def secret
-        payment_method.preferences[:secret]
-      end
-
-      # Dynamically mirrors the shopper's remaining seat/inventory hold time so the bank's
-      # QR/session doesn't outlive the hold. Falls back to the admin-configured preference
-      # when the order has no hold (e.g. non-inventory items) or the hold has already lapsed.
-      def expiry_time
-        @expiry_time ||= (remaining_hold_minutes || payment_method.preferences[:payment_expiry_time_in_mn]).to_s
-      end
-
-      def purchase_date
-        @payment.created_at.utc.strftime('%Y-%m-%d')
-      end
-
-      def purchase_currency
-        @payment.order.currency
-      end
-
-      def xpay_service_base_url
-        strip_whitespace(payment_method.preferences[:xpay_service_base_url])
-      end
-
-      def open_session_url
-        "#{xpay_service_base_url}/openSessionV2"
-      end
-
-      def get_txn_status_url # rubocop:disable Naming/AccessorMethodName
-        "#{xpay_service_base_url}/getTxnStatus"
-      end
-
-      # KHQR/Card secure web redirect target
-      def action_url
-        strip_whitespace(payment_method.preferences[:payment_page_url])
-      end
-
-      # successUrlToReturn / errorUrl. The bank appends its own query string
-      # (_paymenttokenid, _resultCode, ...) when it redirects back.
-      def continue_success_url
-        @payment.processing_url
-      end
-
-      def callback_url
-        # return continue_success_url unless deeplink? && app_scheme.present?
-
-        # uri = URI.parse(continue_success_url)
-        # uri.scheme = app_scheme
-        # uri.to_s
-
-        continue_success_url
-      end
-
-      def app_scheme
-        payment_method.preferences[:app_scheme]
-      end
-
-      # android | ios (defaults to android when not supplied by the caller)
-      def opr_device
-        @options[:opr_device].presence || 'android'
-      end
-
-      def platform
-        @options[:platform]
-      end
-
-      def deeplink?
-        payment_method.deeplink? && platform == 'app'
-      end
-
-      # --- HMAC-SHA512 (uppercase hex) signing ---
-      # openSessionV2 message: merchantID + loginId + password + txid
-      def open_session_hash
-        hmac512("#{merchant_id}#{login_id}#{password}#{payment_number}")
-      end
-
-      # getTxnStatus message: merchantId + loginId + password + paymentTokenid
-      def txn_status_hash(token)
-        hmac512("#{merchant_id}#{login_id}#{password}#{token}")
-      end
-
-      def hmac512(message)
-        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha512'), secret, message).upcase
-      end
-
-      def parse_json(body)
-        JSON.parse(body)
-      rescue JSON::ParserError
-        {}
-      end
-
-      private
-
-      # Minutes left on the order's seat/inventory hold, rounded up so we never quote the
-      # bank less time than is actually left. nil when the order has no hold, the hold has
-      # already lapsed, or hold_expires_at isn't defined (spree_cm_commissioner not loaded).
-      def remaining_hold_minutes
-        return nil unless @payment.order.respond_to?(:hold_expires_at)
-
-        hold_expires_at = @payment.order.hold_expires_at
-        return nil if hold_expires_at.blank?
-
-        minutes = ((hold_expires_at - Time.current) / 60.0).ceil
-        minutes if minutes.positive?
-      end
-
-      def strip_whitespace(value)
-        value.to_s.gsub(/\s+/, '')
-      end
-    end
-  end
-end

data/lib/vpago/acleda_v2/checkout.rb

@@ -1,120 +0,0 @@
-require 'faraday'
-
-module Vpago
-  module AcledaV2
-    class Checkout < Base
-      attr_reader :error_message
-
-      def call
-        @error_message = nil
-        @response = open_session
-
-        if @response.status != 500 && @response.status != 200
-          @error_message = 'Server Error'
-        elsif @response.status == 500 # mostly when passing a wrong parameter name
-          @error_message = @response.body
-        elsif json_response.dig('result', 'code') != 0 # invalid payload, wrong loginId, etc.
-          @error_message = json_response.dig('result', 'errorDetails') || 'Unknown Error'
-        end
-
-        update_payment_source
-
-        self
-      end
-
-      def failed?
-        @error_message.present?
-      end
-
-      def json_response
-        @json_response ||= parse_json(@response.body)
-      end
-
-      # KHQR/Card secure web redirect form fields (auto-POSTed to paymentPage.jsp).
-      def gateway_params
-        return {} if failed?
-
-        {
-          merchantID: merchant_id,
-          sessionid: json_response.dig('result', 'sessionid'),
-          paymenttokenid: payment_token_id,
-          description: Base::PURCHASE_DESC,
-          expirytime: expiry_time,
-          amount: amount,
-          quantity: '1',
-          item: '1',
-          invoiceid: order_number,
-          currencytype: purchase_currency,
-          transactionID: payment_number,
-          successUrlToReturn: continue_success_url,
-          errorUrl: continue_success_url
-        }
-      end
-
-      # Deep Link redirect target.
-      def deeplink_url
-        return nil if failed?
-
-        json_response.dig('result', 'deeplinkUrl')
-      end
-
-      private
-
-      def open_session
-        conn = Faraday::Connection.new
-
-        conn.post(open_session_url) do |request|
-          request.headers['Content-Type'] = Base::CONTENT_TYPE_JSON
-          request.body = open_session_payload.to_json
-        end
-      end
-
-      def open_session_payload
-        base = {
-          password: password,
-          loginId: login_id,
-          merchantID: merchant_id,
-          hash: open_session_hash,
-          xpayTransaction: xpay_transaction_base
-        }
-
-        if deeplink?
-          base[:xpayTransaction].merge!(oprDevice: opr_device, callBackUrl: callback_url)
-        else
-          base[:xpayTransaction][:paymentCard] = payment_method.payment_card_value
-        end
-
-        base
-      end
-
-      def xpay_transaction_base
-        {
-          txid: payment_number,
-          invoiceid: order_number,
-          purchaseAmount: amount,
-          purchaseCurrency: purchase_currency,
-          purchaseDate: purchase_date,
-          purchaseDesc: Base::PURCHASE_DESC,
-          item: '1',
-          quantity: '1',
-          expiryTime: expiry_time
-        }
-      end
-
-      def payment_token_id
-        json_response.dig('result', 'xTran', 'paymentTokenid')
-      end
-
-      # Persist the paymentTokenid so check_transaction / the bank callback can
-      # resolve the payment later. Wrap only the write in the writing role, since
-      # the checkout form partial runs on a GET request (replica connection).
-      def update_payment_source
-        return if failed?
-
-        ActiveRecord::Base.connected_to(role: :writing) do
-          @payment.source.update_column(:transaction_id, payment_token_id)
-        end
-      end
-    end
-  end
-end

data/lib/vpago/acleda_v2/transaction_status.rb

@@ -1,83 +0,0 @@
-require 'faraday'
-
-module Vpago
-  module AcledaV2
-    class TransactionStatus < Base
-      # Terminal failure indicators in result.errorDetails. The PDFs only document
-      # code 0 / "SUCCESS"; decline/expiry wording is conservative and should be
-      # confirmed against real responses during UAT. Anything not success and not
-      # terminal is treated as pending so the poller keeps trying.
-      FAILED_ERROR_DETAILS = %w[EXPIRED DECLINED CANCELLED FAILED REJECTED].freeze
-
-      def call
-        @response = check_remote_status
-        self
-      end
-
-      def json_response
-        @json_response ||= parse_json(@response.body)
-      end
-
-      def result
-        json_response['result'] || {}
-      end
-
-      def result_code
-        result['code']
-      end
-
-      def error_message
-        result['errorDetails']
-      end
-
-      def success?
-        return false if token.blank?
-
-        http_success? && result_code.zero? && error_message == 'SUCCESS'
-      end
-
-      def failed?
-        return false if token.blank?
-        return false unless http_success?
-
-        FAILED_ERROR_DETAILS.include?(error_message.to_s.upcase)
-      end
-
-      def pending?
-        !success? && !failed?
-      end
-
-      private
-
-      def http_success?
-        @response&.status == 200
-      end
-
-      def token
-        @payment.source&.transaction_id
-      end
-
-      def check_remote_status
-        conn = Faraday::Connection.new
-
-        conn.post(get_txn_status_url) do |request|
-          request.headers['Content-Type'] = Base::CONTENT_TYPE_JSON
-          request.body = payload.to_json
-        end
-      end
-
-      # NOTE: getTxnStatus uses merchantId (lowercase d) and an extra merchantName
-      # field. merchantName is NOT part of the HMAC message.
-      def payload
-        {
-          loginId: login_id,
-          password: password,
-          merchantId: merchant_id,
-          merchantName: merchant_name,
-          hash: txn_status_hash(token),
-          paymentTokenid: token
-        }
-      end
-    end
-  end
-end