@easypayment/medusa-paypal-ui 1.2.8 → 1.3.1

package/CHANGELOG.md

@@ -2,6 +2,90 @@
 
 All notable changes to `@easypayment/medusa-paypal-ui` are documented here.
 
+## 1.3.1 — 2026-10-06
+
+_(Published as 1.3.1: the 1.3.0 version number was burned by an interrupted npm publish and can't be reused.)_
+
+### Fixed
+
+- **"PayPal is disabled" (403) detection works again.** It matched the text
+  "403"/"Forbidden" in error messages, but the HTTP client prefers the
+  backend's JSON message, which rarely contains either — so a disabled plugin
+  fell back to showing both payment methods as enabled. Detection is now by
+  status code (`HttpError.status === 403`), and `HttpError` is exported so
+  storefronts can branch on statuses too.
+- **A currency/region switch no longer serves a stale config for up to 5
+  minutes.** The config cache key now includes the publishable API key and an
+  optional `currencyCode` (new prop on `PayPalPaymentSection`,
+  `MedusaNextPayPalAdapter`, and both hooks — pass the cart's currency);
+  `invalidatePayPalConfigCache(cartId?)` is exported for manual invalidation.
+- **Double-click on the PayPal button can no longer create two orders.** The
+  guard read async React state, so two clicks in the same tick both passed;
+  it now uses a synchronous ref (as the card form already did).
+- Malformed 2xx responses (non-JSON content type, JSON parse failure) are no
+  longer treated as transient and retried — a server answering 200 with HTML
+  answers the same on a retry.
+- The full-screen processing overlay no longer monkeypatches
+  `history.pushState`/`replaceState` to detect soft navigations (fragile next
+  to the Next.js router); it watches the URL instead. The in-component and
+  shared DOM overlays also no longer stack on top of each other.
+- The server-safe `fetchPayPalConfig` (order entrypoint) now composes a
+  caller-supplied `AbortSignal` with its 30s timeout instead of letting the
+  signal replace the timeout entirely.
+
+### Added
+
+- `credentials` prop on `PayPalPaymentSection`, `MedusaNextPayPalAdapter`,
+  `PayPalSmartButtons`, and `PayPalAdvancedCard`, forwarded to every API call
+  (previously only `createPayPalStoreApi` accepted it, so the README's
+  wildcard-CORS advice didn't reach the components).
+- `usePayPalConfig` returns a `retry()` function, and the adapter's
+  config-error card shows a "Try again" button instead of requiring a reload.
+- Both hooks share one config cache and deduplicate in-flight requests — a
+  checkout page that mounts both issues a single `/store/paypal/config` call.
+- `createOrder` / `captureOrder` / `getSettings` accept an `AbortSignal`;
+  `markPaymentComplete` accepts an options object (`{ publishableApiKey,
+credentials, timeoutMs, signal }` — the legacy string argument still works);
+  `createHttpClient` accepts `timeoutMs`.
+- Accessibility: decorative icons are `aria-hidden`, overlays/spinners
+  announce their visible text (no overriding `aria-label`), `aria-busy`
+  reflects busy (not disabled) state, and animations respect
+  `prefers-reduced-motion`.
+
+### Changed
+
+- **PayPal partner attribution (BN) code changed to `MBJ_Medusa_SI`** — the
+  Medusa-platform code PayPal assigned (2026-10-06), passed to the PayPal JS
+  SDK as `data-partner-attribution-id` (previously `MBJTechnolabs_SI_SPB`),
+  matching the backend's REST attribution.
+- `onPaid` / `onSuccess` callback types are now `void | Promise<void>` (they
+  were always awaited).
+- `PAYPAL_PROVIDER_IDS` and the `PayPalProviderId` type are actually exported
+  from both entrypoints now (1.2.8 exported them from an internal module that
+  consumers couldn't reach).
+- The spinner/overlay/error markup that was copied across four components
+  lives in one shared internal module.
+
+### Dev
+
+- ESLint (typescript-eslint + react-hooks + jsx-a11y) added and clean; lint,
+  format, and a React 18 test job run in CI; `tsc` now typechecks the tests.
+- 40 new tests (73 total): shared config cache (TTL, dedupe, invalidation,
+  eviction), hooks under React Testing Library (403 handling, retry, shared
+  in-flight fetch, currency-change refetch), client timeout/abort/credentials
+  behavior, and the server-safe order helpers.
+- `react`/`react-dom` are proper devDependencies; full MIT license text;
+  npm keywords, `engines`, `homepage`/`bugs` metadata added.
+
+## 1.2.8 — 2026-09-28
+
+### Changed
+
+- `isPayPalProviderId` is now a type guard and the `PayPalProviderId` type is
+  exported from an internal constants module (aligned with
+  `@easypayment/medusa-payment-paypal` 1.2.8). Superseded by 1.3.0, which
+  exports them from the public entrypoints.
+
 ## 1.2.7 — 2026-09-23
 
 ### Changed

package/LICENSE

@@ -1 +1,21 @@
-MIT License
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -786,9 +786,15 @@ You don't need to do anything for these — they're automatic:
 
 <br>
 
-- `usePayPalPaymentMethods` returns an `error` field (non-null when the config fetch failed and the enabled flags are optimistic defaults).
+- `usePayPalPaymentMethods` returns an `error` field (non-null when the config fetch failed and the enabled flags are optimistic defaults). A `403` from the backend (plugin disabled) is detected by status code and flips both methods off.
+- `usePayPalConfig` returns `{ config, loading, error, retry }` — call `retry()` to refetch after a failure (the adapter's error card has a built-in "Try again" button).
+- Pass `currencyCode` (the cart's currency) to the components/hooks: it's part of the config cache key, so a region/currency switch refetches instead of serving a stale config. `invalidatePayPalConfigCache(cartId?)` is exported for manual invalidation.
+- Both hooks share one config cache **and one in-flight request** — a page that mounts both issues a single `/store/paypal/config` call.
+- `HttpError` is exported: every non-2xx API failure carries a `status` you can branch on.
+- All API calls time out after 30s by default (`timeoutMs` option on `createHttpClient` / `markPaymentComplete`), retry transient failures on idempotent endpoints, and accept an `AbortSignal`.
 - Captured-state helpers are exported for custom flows: `markCartCaptured` / `wasCartCaptured` / `clearCartCaptured` (per-cart `sessionStorage` flag behind the reload-safe retry).
-- If your backend responds with `Access-Control-Allow-Origin: *`, pass `credentials: "omit"` to `createPayPalStoreApi({ ... })` — browsers block credentialed requests against a wildcard origin. Default stays `"include"`.
+- If your backend responds with `Access-Control-Allow-Origin: *`, pass `credentials: "omit"` — either to `createPayPalStoreApi({ ... })` or directly as a `credentials` prop on `PayPalPaymentSection` / `MedusaNextPayPalAdapter` / the components. Default stays `"include"`.
+- Accessibility: spinners and overlays are `role="status"`, errors are `role="alert"`, decorative icons are `aria-hidden`, and animations respect `prefers-reduced-motion`.
 
 </details>