@easypayment/medusa-paypal-ui 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -1,25 +1,97 @@
-# Changelog
-
-All notable changes to `@easypayment/medusa-paypal-ui` are documented here.
-
-## 1.1.0
-
-### Added
-- **Transient-failure retry** in the HTTP client (opt-in `retries`, jittered
-  backoff on network errors / timeouts / 429 / 5xx). Wired into the idempotent
-  `markPaymentComplete` and `captureOrder` calls so a network blip right after
-  capture — the classic "captured but cart not completed" gap — is retried
-  instead of stranding a paid-but-unfinalized order.
-- Tests for the retry logic and the capture/complete retry paths.
-
-### Changed
-- Test environment switched from `node` to `jsdom` so component/hook tests can
-  run against a DOM (the client tests continue to pass under it).
-
-## 1.0.56
-
-### Added
-- Unit test suite (vitest) for the framework-agnostic client logic: the HTTP
-  client (base-url/path normalization, publishable-key header, 401/403 handling,
-  HTML-tag stripping, empty-body and non-JSON guards, timeout surfacing) and the
-  Next.js router-error detection helper.
+# Changelog
+
+All notable changes to `@easypayment/medusa-paypal-ui` are documented here.
+
+## 1.2.0 — 2026-09-02
+
+### Fixed
+- **A reload between capture and finalization no longer strands the buyer.**
+  The "money was captured" state is now persisted per cart in
+  `sessionStorage`; after a reload/crash the components restore the
+  finalize-only "Retry — finish placing my order" path instead of showing
+  payment buttons that would confusingly fail (or invite a second payment)
+  against an already-captured PayPal order.
+- **Cart edits can no longer be answered with a stale-amount PayPal order.**
+  `createOrder` now sends a fresh `Idempotency-Key` per attempt, so the
+  backend's `PayPal-Request-Id` is unique per click and PayPal cannot replay a
+  cached order created for a previous cart total. (Capture requests
+  intentionally send no key — the server's per-order key is the correct
+  idempotency scope there.)
+
+### Added
+- `credentials` option on the HTTP client (`HttpOptions.credentials`). Defaults
+  to the historical `"include"`; set `"omit"`/`"same-origin"` for backends
+  answering with `Access-Control-Allow-Origin: *`, which browsers reject for
+  credentialed requests.
+- Exported `markCartCaptured` / `wasCartCaptured` / `clearCartCaptured` for
+  storefronts with custom payment flows.
+- `usePayPalPaymentMethods` now returns an `error` field (non-null when the
+  config fetch failed and the enabled/title values are optimistic defaults),
+  so storefronts can stop advertising methods that will fail once selected.
+
+### Changed
+- A payment method the merchant disabled in admin now renders a neutral
+  "currently unavailable" notice instead of blank space under the selected
+  option.
+- `PayPalPaymentSection` is now a thin wrapper over `MedusaNextPayPalAdapter`
+  (previously two ~90%-identical render paths). Public APIs, exports, and
+  rendered UI are unchanged; provider-id constants moved to a single module
+  and are re-exported from their historical locations.
+
+## 1.1.0
+
+### Fixed (re-audit)
+- **Card submit rejections no longer strand the buyer under the processing
+  overlay.** `cardFieldsForm.submit()` returns a promise whose rejection is not
+  routed to the provider's `onError`; it is now caught, the overlay/state reset,
+  and the validation message shown.
+- **A payment can no longer be taken twice after a finalization failure.** Once
+  a capture succeeds, any later failure (order completion, consumer callback)
+  now shows a dedicated "Retry — finish placing my order" action that retries
+  only the finalization; the PayPal button/card form no longer re-appears to
+  invite a second, distinct charge for the same cart.
+- **Back-button (bfcache) restores no longer leave a stuck overlay.** The DOM
+  processing overlay and both components' React overlays reset on `pageshow`
+  with `persisted: true`.
+- **Requests can no longer hang forever.** The 30s HTTP timeout now also applies
+  when a caller passes an `AbortSignal` (hook config fetches), and it covers
+  reading the response body, not just the headers.
+- **Buyers now see the backend's error message.** Error bodies are parsed as
+  JSON and the backend's buyer-facing `message` (unsupported currency,
+  rate-limit, "payment processed but order not finalized", "PayPal is currently
+  disabled") is shown instead of a raw JSON blob or a misleading CORS hint.
+- **Ineligible PayPal buttons no longer spin forever.** If the SDK resolves but
+  never initializes the buttons (ineligible country/currency/funding), a clear
+  "PayPal is not available" message replaces the infinite "Loading PayPal…"
+  spinner after 10s.
+- **Missing `orderID` guard added to the card `onApprove`** (matching the
+  buttons flow) so an empty id fails fast with a clear message.
+- **Next.js 15 `notFound()` is no longer treated as a payment failure**
+  (`NEXT_HTTP_ERROR_FALLBACK` digests are now recognized as router errors).
+- **CJS TypeScript consumers get correct types.** The exports map now serves
+  `dist/*.d.cts` under the `require` condition (fixes TS1479 under
+  `node16`/`nodenext` resolution).
+- **`PayPalSettingsResponse` now matches the actual endpoint response**
+  (`paymentAction`, `advancedCardEnabled`); the old `data` envelope shape is
+  kept as deprecated so existing code compiles.
+
+
+### Added
+- **Transient-failure retry** in the HTTP client (opt-in `retries`, jittered
+  backoff on network errors / timeouts / 429 / 5xx). Wired into the idempotent
+  `markPaymentComplete` and `captureOrder` calls so a network blip right after
+  capture — the classic "captured but cart not completed" gap — is retried
+  instead of stranding a paid-but-unfinalized order.
+- Tests for the retry logic and the capture/complete retry paths.
+
+### Changed
+- Test environment switched from `node` to `jsdom` so component/hook tests can
+  run against a DOM (the client tests continue to pass under it).
+
+## 1.0.56
+
+### Added
+- Unit test suite (vitest) for the framework-agnostic client logic: the HTTP
+  client (base-url/path normalization, publishable-key header, 401/403 handling,
+  HTML-tag stripping, empty-body and non-JSON guards, timeout surfacing) and the
+  Next.js router-error detection helper.