waffo-pancake 0.2.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b498f6ef1ac1fbdec66122b1a9d4758ebd6ea917840563c8f296c9e020c03bdd
-  data.tar.gz: c34ede893f8f1a84c2d6f7e71968dddfed09ce1a20e43140156805cf2bf93e39
+  metadata.gz: 53bc96e6da7f2a84f2ad08a962fe1bb1f7041d630a74446f933c78a475384dfa
+  data.tar.gz: 8ff4d5eabce81147a7bdeafe43d744cb82782ef047116d5d62a38208b2857d87
 SHA512:
-  metadata.gz: bee472c21659562c0a68275d615eb5af3f21d95ec1937f2aed7fab7a5570b1f968e6b27f3ff4bbd7fa82598eef3e30407b35afbf8503759cca44490aa9e3bb85
-  data.tar.gz: f96b92d6942e7a94e298153a02c1f9a5b480afb1c399ba420da5044964bbe7f946ca6d02f09c54086d256f2881485ff250c166536223d7493122fc01b8577926
+  metadata.gz: a567f41bee5bbedd913786a18623285f45303f2b7f45e13c0a60171bead24ab70b65e51f9231043f857128e30e5229688fa553a07a3799b768fc89b799654881
+  data.tar.gz: 53b910c7287fe30d1c2ef9f0796f9e4de5e868a058db982f3e421efb0d2494b03683ed3202d814e5431a1f8902493a3a09d1023d280665cd8fc38b4b18df53d3

data/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.4.0
+
+- Every endpoint in Waffo's API reference now has a method:
+  - Stores: `create_store`, `update_store`, `delete_store`.
+  - Store members: `add_store_merchant`, `remove_store_merchant`, `update_store_merchant_role`.
+  - Webhooks: `update_webhook`.
+  - Notification recipients: `add_notification_recipient`, `update_notification_recipient`,
+    `remove_notification_recipient`.
+  - Products: `update_onetime_product`, `publish_onetime_product`,
+    `update_onetime_product_status`, `update_subscription_product_status`.
+  - Product groups: `create_subscription_product_group`, `update_…`, `delete_…`, `publish_…`.
+  - Promotions: `create_coupon`, `update_coupon`, `deactivate_coupon`, `create_promotion_code`,
+    `generate_promotion_codes`, `deactivate_promotion_code`.
+  - Refund tickets: `create_refund_ticket`, `resubmit_refund_ticket`.
+  - Plan changes: `create_plan_change_session`, `create_authenticated_plan_change`.
+  - Content safety: `scan_prompt`.
+- `Client#customer(token, environment:)` returns a `CustomerSession`, authenticated with a session
+  token, with the customer actions plus `create_onetime_order` and `create_subscription_order`.
+- `StoreCheckout.new(store_slug:, environment:)` for anonymous checkout with only the store slug.
+- GraphQL readers, generated from the schema that introspection reports: lists, `*_count` and
+  single-record methods, `*_aggregate` methods and analytics methods. Filters travel as typed
+  variables.
+- `idempotency_key:` on every action, sent as `X-Idempotency-Key`.
+- `Waffo::Pancake::NULL` sends an explicit JSON null, which clears a field. A nil is still dropped.
+- `Error#retry_after`, from the `Retry-After` header.
+- An action's result has a `"warnings"` key when Waffo sent warnings.
+- `Client.new(environment:)`, defaulting to the configured environment.
+- `TestHelpers::FakeClient` has every API method, generated, so a new endpoint cannot be missing.
+- Changed: `graphql` now raises on a non-2xx status without `errors`. It used to return nil.
+- Known: with an API key, `reactivate_subscription` and `cancel_onetime_order` get a 401 from
+  Waffo's gateway. Call them through `client.customer(token)`.
+- `rake test:live` runs the real API with a test-mode key. It is not part of `rake test`.
+
+## 0.3.0
+
+- Webhook amount fields (Waffo, 2026-09-20 to 2026-09-22):
+  - `Webhook.verify` and `Waffo::Pancake.verify_webhook` return a `Webhook::Event`, a Hash
+    subclass, so code that reads it as a Hash keeps working. `Webhook::Event.wrap` makes one from
+    a stored payload (Hash or JSON).
+  - `event.data` readers for the new fields: `charged_amount`, `refunded_amount`,
+    `original_charged_amount`, `list_price`, `original_payment`, `plan_price`, `price`,
+    `period_number`, `first_period?`, `renewal?`.
+  - Reading a deprecated field (`amount`, `total`, `subtotal`, `taxAmount`, `taxRate`, `taxName`)
+    with `[]`, `fetch` or `dig` reports a deprecation warning naming its replacement for that
+    event type. `config.deprecator` chooses where it goes: a once-per-message `Kernel#warn` by
+    default, `Rails.application.deprecators[:waffo_pancake]` in Rails, nil for none.
+  - `Webhook::DEPRECATED_FIELDS`, `PAYMENT_EVENT_TYPES`, `REFUND_EVENT_TYPES` and
+    `Webhook.family`.
+- Customer portal sign-in without an email code: `Client#create_customer_portal_link`
+  (`issue-session-token` with `purpose: "portal"`), `issue_session_token(purpose:)`, and the
+  `Waffo::Pancake::CustomerPortalController` Rails concern, which answers with a 302 and
+  `Cache-Control: no-store` / `Referrer-Policy: no-referrer`. The Railtie adds `#token=` to
+  `filter_redirect`, so these URLs stay out of the request log.
+- Webhook delivery records: `Client#webhook_deliveries` and `#webhook_deliveries_count`, with
+  `status:`, `event_type:`, `filter:`, `limit:` and `offset:`. Waffo has no redelivery API;
+  run your handler on `Webhook::Event.wrap(delivery["payload"])` instead.
+- `Client.new(store_id:)`, defaulting to the configured store, for the calls above.
+- `TestHelpers::FakeClient#create_customer_portal_link` and `#webhook_deliveries`.
+- The generated `WaffoWebhookEvent#data` and `#waffo_event` wrap the stored payload; the
+  generated job reads the new amount fields.
+
 ## 0.2.1
 
 - `Client#subscription_order` also returns the order's current product as `productId`, read

data/README.md

@@ -68,17 +68,47 @@ client.create_checkout_session(product_id: "PROD_...", currency: "USD")
 Top-level keyword arguments may be snake_case and are sent as camelCase. Nested hashes
 (`metadata`, `prices`, `billing_detail`'s fields) are sent exactly as given.
 
+## Customer portal
+
+A customer who is signed in on your site can enter the store's customer portal without an email
+code. Use the `buyer_identity` you gave at authenticated checkout, taken from your own session.
+
+```ruby
+link = client.create_customer_portal_link(buyer_identity: current_user.id)  # store_id: defaults to WAFFO_STORE_ID
+# => {"portalUrl" => "https://pancake.waffo.ai/consumer/portal/store/STO_...#token=...", "expiresAt" => "..."}
+```
+
+The URL is a bearer credential: make a new one on each click, answer with a 302 and
+`Cache-Control: no-store` / `Referrer-Policy: no-referrer`, and never log, cache or email it.
+The portal opens on the API key's environment. In Rails, the concern does all of that:
+
+```ruby
+class WaffoPortalController < ApplicationController
+  include Waffo::Pancake::CustomerPortalController
+  before_action :authenticate_user!
+
+  def show
+    redirect_to_waffo_customer_portal(buyer_identity: current_user.id)  # 502 if Waffo fails
+  end
+end
+```
+
+Link to that route with a plain `<a>`, so nothing prefetches it. Set a Website in the store
+settings: the portal's return button links only there.
+
 ## Subscriptions
 
 ```ruby
 client.cancel_subscription("ORD_...")      # => {"orderId" => "ORD_...", "status" => "canceling"}
-client.reactivate_subscription("ORD_...")  # while still canceling
 client.subscription_order("ORD_...")       # GraphQL; nil when unknown
 # => {"status" => "active", "currentPeriodEnd" => "2027-10-08T...", "merchantProvidedBuyerIdentity" => "user-42", ...}
 ```
 
 `canceling` keeps access until `currentPeriodEnd`. The terminal `canceled` arrives as a webhook.
 
+Waffo's gateway refuses an API key on `reactivate_subscription` and `cancel_onetime_order` with
+a 401. Call them as the customer; see [Customer sessions](#customer-sessions).
+
 ## Products
 
 ```ruby
@@ -91,11 +121,102 @@ client.publish_subscription_product(id: "PROD_...")  # test → prod, first publ
 
 Amounts are display strings (`"9.99"`), not cents.
 
-## GraphQL and other endpoints
+## Stores, coupons and refunds
+
+```ruby
+client.create_store(name: "My Store")
+client.update_store(id: "STO_...", logo: Waffo::Pancake::NULL)   # NULL clears a field; nil is dropped
+
+client.update_onetime_product_status(id: "PROD_...", status: "inactive")
+client.create_subscription_product_group(store_id: "STO_...", name: "Plans", product_ids: ["PROD_..."])
+
+client.update_webhook(id: webhook["id"], url: "https://example.com/hooks/waffo")
+client.add_notification_recipient(store_id: "STO_...", email: "ops@example.com")
+client.add_store_merchant(store_id: "STO_...", email: "ada@example.com", role: "member")
+
+coupon = client.create_coupon(store_id: "STO_...", name: "Launch", discount: { type: "percentage", percentOff: 20 })
+client.generate_promotion_codes(coupon_id: "CPN_...", count: 100, prefix: "LAUNCH")
+
+client.create_refund_ticket(payment_id: "PAY_...", reason: "Duplicate charge",
+                            requested_amount: { amount: "9.99", currency: "USD" })
+client.scan_prompt(prompt: "...")
+```
+
+Every action takes `idempotency_key:` (1 to 256 characters of `A-Z a-z 0-9 _ -`). It is sent as
+`X-Idempotency-Key`, and Waffo keeps the answer for 24 hours. Nothing is sent unless you pass one:
+
+```ruby
+client.create_refund_ticket(..., idempotency_key: "refund-#{order.id}")
+```
+
+When Waffo sends warnings with a successful answer, the result has a `"warnings"` key.
+
+## Customer sessions
+
+Some routes act as one customer and take a session token instead of an API key. A token does not
+carry an environment, so the session needs one, from `environment:` or the configuration.
+
+```ruby
+token = client.issue_session_token(buyer_identity: "user-42", store_id: "STO_...")["token"]
+customer = client.customer(token, environment: "test")
+
+customer.reactivate_subscription("ORD_...")
+customer.cancel_onetime_order("ORD_...")
+customer.create_onetime_order(checkout_session_id: "cs_...", billing_detail: { country: "US", ... },
+                              language: "en", buyer_email: "ada@example.com")
+# create_subscription_order takes the same arguments. buyer_email: is required unless the checkout
+# session already has one.
+customer.graphql("{ onetimeOrders { id status } }")
+```
+
+`inspect` hides the token. A plan change the customer confirms on Waffo's page:
+
+```ruby
+link = client.create_authenticated_plan_change(origin_order_id: "ORD_...", product_id: "PROD_...",
+                                               currency: "USD", buyer_identity: "user-42")
+redirect_to link["checkoutUrl"], allow_other_host: true   # a bearer credential: never log it
+```
+
+Anonymous checkout with only the public store slug, which needs no secret:
 
 ```ruby
-client.graphql("query ($id: String!) { onetimeOrder(id: $id) { id status } }", id: "ORD_...")
-client.action("/v1/actions/refund-ticket/create-ticket", { payment_id: "PAY_...", reason: "..." })
+storefront = Waffo::Pancake::StoreCheckout.new(store_slug: "my-store", environment: "test")
+storefront.create_checkout_session(product_id: "PROD_...", currency: "USD")
+```
+
+## Reading data
+
+```ruby
+client.onetime_products(limit: 20)                     # store_id: defaults to WAFFO_STORE_ID
+client.onetime_products(store_slug: "my-store")
+client.onetime_products_count
+client.onetime_product("PROD_...")                     # nil when unknown
+client.payments(filter: { status: { eq: "succeeded" } }, order_by: :created_at_desc, offset: 20)
+client.promotion_codes(coupon_id: "CPN_...")
+client.subscription_product_versions("PROD_...")
+client.me
+```
+
+There are readers for stores, merchants, store merchants, products, product groups, orders,
+payments, refunds, refund tickets, chargebacks, customers, coupons, promotion codes, discount
+applications, email deliveries, cancel reasons, webhooks and notification recipients.
+`Waffo::Pancake::API::Queries::LISTS` is the full table. `fields:` replaces the default selection.
+It is written into the query, so it must come from your code and never from a request. Filters
+travel as GraphQL variables, so they are safe for any value.
+
+Analytics return the fields you ask for, and aggregates can group by a dimension:
+
+```ruby
+client.order_statistics(fields: "totalCount buyerMetrics { totalBuyers }",
+                        start_date: 1.month.ago, end_date: Time.now, currency: "USD")
+client.payments_aggregate(group_by: :status, granularity: :month, filter: { currency: { eq: "USD" } })
+```
+
+Anything else goes through the low-level calls:
+
+```ruby
+client.graphql("query ($id: String!) { payoutTicket(id: $id) { id status } }", id: "...")
+client.action("/v1/actions/some-group/some-action", { some_param: "..." })
 ```
 
 ## Webhooks
@@ -112,9 +233,10 @@ class WaffoWebhooksController < ActionController::Base
       request.headers["X-Waffo-Signature"],
       environment: "prod"            # or "test"; omit to try prod, then test
     )
-    # Deduplicate on event["id"]: a retry redelivers the same id.
-    case event["eventType"]
-    when "subscription.activated", "subscription.renewed" then # grant access until data.currentPeriodEnd
+    # Deduplicate on event.id: a retry redelivers the same id.
+    case event.event_type
+    when "order.completed" then                                 # record event.data.charged_amount
+    when "subscription.activated", "subscription.renewed" then # grant access until data["currentPeriodEnd"]
     when "subscription.canceled" then                           # revoke access
     end
     head :ok
@@ -131,12 +253,68 @@ both), or pass `public_key:`. Timestamps may be up to 45 minutes old and 1 minut
 
 `Waffo::Pancake::Webhook::EVENT_TYPES` lists the event types.
 
+### Amount fields
+
+`verify` returns a `Waffo::Pancake::Webhook::Event`, a Hash with readers. Its `data` reads
+the amount fields by what they describe:
+
+| Reader | Field | Events |
+|---|---|---|
+| `charged_amount` | `chargedAmount` | Payment (`order.completed`, `subscription.payment_succeeded`): what the buyer was actually charged, after prorated credits, trials and zero-amount card checks |
+| `list_price` | `listPrice` | Payment: the list price behind the charge (`total`, `subtotal`, `taxAmount`, `taxRate`, `taxName`) |
+| `refunded_amount` | `refundedAmount` | `refund.*`: what this refund returned |
+| `original_charged_amount` | `originalChargedAmount` | `refund.*`: what the refunded payment actually collected, the most a refund can reach |
+| `original_payment` | `originalPayment` | `refund.*`: the refunded payment's list price |
+| `plan_price` | `planPrice` | Other `subscription.*` events: the plan's price for the current period |
+| `period_number`, `first_period?`, `renewal?` | `periodNumber` | Subscription events, `subscription.payment_succeeded` and subscription refunds: 1 for the first period, N for the Nth renewal |
+
+`chargedAmount`, `refundedAmount` and `originalChargedAmount` are absent (nil) when the payment
+channel reported no amount. `periodNumber` counts failed charges too, is `0` before a scheduled
+plan change takes effect, and is not a deduplication key.
+
+`amount`, `total`, `subtotal`, `taxAmount`, `taxRate` and `taxName` are deprecated: one name meant
+a different amount per event family. Waffo sends them until its next major API version, not
+before 2027-09-20. Since 2026-09-21, `amount` on payment events is the charged amount, so a check
+such as `amount == total` fails there. Reading one of them with `[]`, `fetch` or `dig` still
+returns the value, and reports the field to read instead for that event type:
+
+```
+DEPRECATION WARNING: Waffo webhook data["amount"] is deprecated on refund.succeeded; read data["refundedAmount"] instead. ...
+```
+
+Outside Rails each message is printed once per process with `Kernel#warn`. In Rails it goes to
+`Rails.application.deprecators[:waffo_pancake]`, so `config.active_support.deprecation` applies
+(`:raise` in tests finds every place to change). Set `config.deprecator` to any object answering
+`warn(message, callstack)`, or to nil to turn the warnings off. A stored payload (or one that went
+through a job) is a plain Hash again: `Waffo::Pancake::Webhook::Event.wrap(payload)` brings the
+readers and warnings back.
+
+### Delivery records
+
+```ruby
+client.webhook_deliveries(status: :failed, limit: 20)  # store_id: defaults to WAFFO_STORE_ID
+# => [{"id" => ..., "eventType" => ..., "status" => "failed", "httpStatus" => 500, "attemptCount" => 4,
+#      "payload" => ..., "responseBody" => ..., "lastAttemptedAt" => ..., ...}]
+client.webhook_deliveries_count(status: :failed)
+client.webhook_deliveries(event_type: "refund.succeeded", filter: { createdAt: { gte: 1.week.ago } }, offset: 20)
+```
+
+Waffo retries a delivery 3 times and has no manual redelivery. To process a failed one again,
+run your own handler on its payload:
+
+```ruby
+client.webhook_deliveries(status: :failed).each do |delivery|
+  HandleWaffoEventJob.perform_later(Waffo::Pancake::Webhook::Event.wrap(delivery["payload"]))
+end
+```
+
 ## Rails
 
 Inside a Rails app the gem configures itself. Settings are read in this order, the last one
 winning: `WAFFO_*` environment variables, `credentials.waffo`, `config.waffo_pancake`, then
-`Waffo::Pancake.configure` in an initializer. The logger is `Rails.logger`, and `private_key`
-is added to `filter_parameters`.
+`Waffo::Pancake.configure` in an initializer. The logger is `Rails.logger`, `private_key`
+is added to `filter_parameters`, and redirects to a URL with `#token=` (authenticated checkout,
+customer portal) to `filter_redirect`.
 
 ```yaml
 # bin/rails credentials:edit
@@ -165,7 +343,7 @@ class WaffoWebhooksController < ActionController::Base
   include Waffo::Pancake::WebhookController
 
   def create
-    HandleWaffoEventJob.perform_later(waffo_event)   # verified, parsed delivery
+    HandleWaffoEventJob.perform_later(waffo_event)   # verified Webhook::Event; wrap it again in the job
     head :ok
   end
 end
@@ -217,14 +395,15 @@ end
 
 `FakeClient` answers `subscription_order` from the orders it was given, moves an order to
 `canceling` / `active` on cancel / reactivate, records every call in `calls`, and raises
-`fail_with` when set.
+`fail_with` when set. It has every API method: lists answer `[]`, counts `0`, reads `nil` and
+writes `{}`. `customer(token)` answers with the same fake.
 
 ## Errors
 
 | Class | When |
 |---|---|
 | `Waffo::Pancake::Rejected` | Waffo refused the request (4xx other than 429). `status` and `errors` carry the details. |
-| `Waffo::Pancake::Unavailable` | Network failure, timeout, 429 or 5xx. Worth retrying later. |
+| `Waffo::Pancake::Unavailable` | Network failure, timeout, 429 or 5xx. Worth retrying later, after `retry_after` seconds when it is set. |
 | `Waffo::Pancake::ConfigurationError` | Missing merchant id, or a key that does not parse. |
 | `Waffo::Pancake::InvalidSignature` | A webhook that does not verify. |
 
@@ -233,7 +412,7 @@ All inherit from `Waffo::Pancake::Error`.
 ## Testing your code
 
 `Client.new` takes a `transport:` callable that replaces the HTTP call. It receives the URI,
-the headers and the JSON body and returns `[status, body]`.
+the headers and the JSON body and returns `[status, body]` or `[status, body, headers]`.
 
 ```ruby
 transport = ->(uri, headers, json) { [200, '{"data":{"orderId":"ORD_1","status":"canceling"}}'] }
@@ -249,6 +428,17 @@ bundle install
 bundle exec rake test        # test:core (no Rails loaded) and test:rails
 ```
 
+`rake test:live` calls the real API. It needs a **test-mode** key and refuses to run otherwise:
+
+```sh
+WAFFO_LIVE=1 WAFFO_ENVIRONMENT=test WAFFO_MERCHANT_ID=... WAFFO_PRIVATE_KEY=... WAFFO_STORE_ID=... \
+  bundle exec rake test:live
+```
+
+`WAFFO_STORE_ID` is only read. Writes go to a temporary store that the run creates and deletes.
+The `Live API` workflow runs this on pushes to `main` and by hand, from the `WAFFO_*` Actions
+secrets. It never runs for pull requests, so a fork cannot reach the key.
+
 Releases are published to RubyGems by the `Release` workflow when a `v*` tag is pushed (see
 [RELEASING.md](RELEASING.md)). It uses
 [trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API key is stored.

data/lib/generators/waffo_pancake/install/templates/webhook_event.rb.tt

@@ -13,5 +13,9 @@ class WaffoWebhookEvent < ApplicationRecord
     [ find_by!(delivery_id: event["id"].to_s), false ]
   end
 
-  def data = payload.fetch("data", {})
+  # The stored payload as Waffo::Pancake::Webhook::Event: readers for the amount fields, and a
+  # deprecation warning when a field Waffo has deprecated is read.
+  def waffo_event = Waffo::Pancake::Webhook::Event.wrap(payload)
+
+  def data = waffo_event.data
 end

data/lib/generators/waffo_pancake/install/templates/webhook_job.rb.tt

@@ -6,7 +6,13 @@ class WaffoWebhookJob < ApplicationJob
   def perform(event)
     return if event.processed_at
 
+    # Amounts: event.data.charged_amount on payment events (what the buyer was actually charged,
+    # after credits and trials), event.data.refunded_amount on refunds, event.data.plan_price on
+    # subscription events. data["amount"] / ["total"] / ["tax*"] are deprecated.
     case event.event_type
+    when "order.completed", "subscription.payment_succeeded"
+      # Record the receipt: event.data.charged_amount. event.data.first_period? tells the first
+      # charge of a subscription from a renewal (event.data.period_number).
     when "subscription.activated", "subscription.renewed", "subscription.recovered", "subscription.uncanceled"
       # Grant access until event.data["currentPeriodEnd"]. To read the order as Waffo has it
       # now, regardless of delivery order: Waffo::Pancake.client.subscription_order(event.order_id)
@@ -17,7 +23,7 @@ class WaffoWebhookJob < ApplicationJob
     when "subscription.past_due"
       # The renewal failed; the payment channel retries once, usually the next day.
     when "refund.succeeded"
-      # Compare event.data["refundedAmount"] with event.data["originalChargedAmount"].
+      # event.data.refunded_amount, out of event.data.original_charged_amount actually collected.
     end
 
     event.update!(processed_at: Time.current)

data/lib/waffo/pancake/api/customer_actions.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Waffo
+  module Pancake
+    module API
+      # Actions that act for one customer, so both Client and CustomerSession have them.
+      #
+      # The gateway decides which credential a route takes, and the two groups below differ:
+      # with an API key, reactivate-order and onetime-order/cancel-order answer 401 "API Key
+      # authentication not supported for this route" (tested on 2026-11-04). They stay here so
+      # the 0.x Client API keeps its shape, and because Waffo can open these routes later.
+      module CustomerActions
+        def create_checkout_session(product_id:, currency:, **params)
+          action("/v1/actions/checkout/create-session", product_id: product_id, currency: currency, **params)
+        end
+
+        # A checkout session that changes the plan of `origin_order_id`. Without a coupon of its
+        # own, the session follows the rules of the origin order's product group.
+        def create_plan_change_session(origin_order_id:, product_id:, currency:, **params)
+          action("/v1/actions/checkout/create-session", origin_order_id: origin_order_id, product_id: product_id,
+                                                        currency: currency, **params)
+        end
+
+        # pending → canceled at once; active, trialing and past_due → canceling, ending with the
+        # paid period. The terminal `canceled` arrives later as a webhook. Optional: cancel_reason,
+        # cancel_comment.
+        def cancel_subscription(order_id, **params)
+          action("/v1/actions/subscription-order/cancel-order", order_id: order_id, **params)
+        end
+
+        # Undoes a cancellation while the order is still `canceling`. Session token only; see the
+        # module comment.
+        def reactivate_subscription(order_id, **params)
+          action("/v1/actions/subscription-order/reactivate-order", order_id: order_id, **params)
+        end
+
+        # Session token only; see the module comment.
+        def cancel_onetime_order(order_id, **params)
+          action("/v1/actions/onetime-order/cancel-order", order_id: order_id, **params)
+        end
+
+        # requested_amount: { amount: "9.99", currency: "USD" }
+        def create_refund_ticket(payment_id:, reason:, requested_amount:, **params)
+          action("/v1/actions/refund-ticket/create-ticket", payment_id: payment_id, reason: reason,
+                                                            requested_amount: requested_amount, **params)
+        end
+
+        def resubmit_refund_ticket(ticket_id:, reason:, requested_amount:, **params)
+          action("/v1/actions/refund-ticket/resubmit-ticket", ticket_id: ticket_id, reason: reason,
+                                                              requested_amount: requested_amount, **params)
+        end
+      end
+    end
+  end
+end

data/lib/waffo/pancake/api/product_actions.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Waffo
+  module Pancake
+    module API
+      # Products and subscription product groups. Merchant API key.
+      module ProductActions
+        # prices: { "USD" => { amount: "9.99", taxCategory: "saas" } }
+        def create_subscription_product(store_id:, name:, billing_period:, prices:, **params)
+          action("/v1/actions/subscription-product/create-product",
+                 store_id: store_id, name: name, billing_period: billing_period, prices: prices, **params)
+        end
+
+        def update_subscription_product(id:, **params)
+          action("/v1/actions/subscription-product/update-product", id: id, **params)
+        end
+
+        # Copies the test version to production (first publish only).
+        def publish_subscription_product(id:, **params)
+          action("/v1/actions/subscription-product/publish-product", id: id, **params)
+        end
+
+        # status: "active" or "inactive"
+        def update_subscription_product_status(id:, status:, **params)
+          action("/v1/actions/subscription-product/update-status", id: id, status: status, **params)
+        end
+
+        def create_onetime_product(store_id:, name:, prices:, **params)
+          action("/v1/actions/onetime-product/create-product", store_id: store_id, name: name, prices: prices, **params)
+        end
+
+        def update_onetime_product(id:, **params)
+          action("/v1/actions/onetime-product/update-product", id: id, **params)
+        end
+
+        # Copies the test version to production.
+        def publish_onetime_product(id:, **params)
+          action("/v1/actions/onetime-product/publish-product", id: id, **params)
+        end
+
+        # status: "active" or "inactive"
+        def update_onetime_product_status(id:, status:, **params)
+          action("/v1/actions/onetime-product/update-status", id: id, status: status, **params)
+        end
+
+        def create_subscription_product_group(store_id:, name:, **params)
+          action("/v1/actions/subscription-product-group/create-group", store_id: store_id, name: name, **params)
+        end
+
+        def update_subscription_product_group(id:, **params)
+          action("/v1/actions/subscription-product-group/update-group", id: id, **params)
+        end
+
+        def delete_subscription_product_group(id:, **params)
+          action("/v1/actions/subscription-product-group/delete-group", id: id, **params)
+        end
+
+        def publish_subscription_product_group(id:, **params)
+          action("/v1/actions/subscription-product-group/publish-group", id: id, **params)
+        end
+      end
+    end
+  end
+end

data/lib/waffo/pancake/api/promotion_actions.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Waffo
+  module Pancake
+    module API
+      # Coupons, promotion codes and the prompt scan. Merchant API key.
+      module PromotionActions
+        # discount: { type: "percentage", percentOff: 20 }
+        def create_coupon(store_id:, name:, discount:, **params)
+          action("/v1/actions/coupon/create-coupon", store_id: store_id, name: name, discount: discount, **params)
+        end
+
+        def update_coupon(id:, name:, **params)
+          action("/v1/actions/coupon/update-coupon", id: id, name: name, **params)
+        end
+
+        def deactivate_coupon(id:, **params)
+          action("/v1/actions/coupon/deactivate-coupon", id: id, **params)
+        end
+
+        def create_promotion_code(coupon_id:, **params)
+          action("/v1/actions/promotion-code/create-promotion-code", coupon_id: coupon_id, **params)
+        end
+
+        def generate_promotion_codes(coupon_id:, count:, **params)
+          action("/v1/actions/promotion-code/generate-promotion-codes", coupon_id: coupon_id, count: count, **params)
+        end
+
+        def deactivate_promotion_code(id:, **params)
+          action("/v1/actions/promotion-code/deactivate-promotion-code", id: id, **params)
+        end
+
+        def scan_prompt(prompt:, **params)
+          action("/v1/actions/verification/scan-prompt", prompt: prompt, **params)
+        end
+      end
+    end
+  end
+end