strapi-plugin-payone-provider 1.5.3 → 1.5.5

package/admin/src/pages/App/components/ApplePayButton.js

@@ -1,5 +1,7 @@
 import React, { useEffect, useRef, useState } from "react";
 import { Box, Flex, Typography } from "@strapi/design-system";
+import { request } from "@strapi/helper-plugin";
+import pluginId from "../../../pluginId";
 import { DEFAULT_APPLE_PAY_CONFIG } from "../../utils/applePayConstants";
 
 /**
@@ -41,13 +43,41 @@ const ApplePayButton = ({
     try {
       console.log("[Apple Pay] Checking availability...");
 
-      // Check if we're on HTTPS (required for Apple Pay JS API)
-      const isSecure = typeof window !== 'undefined' &&
-        (window.location.protocol === 'https:' ||
-          window.location.hostname === 'localhost' ||
-          window.location.hostname === '127.0.0.1');
+      // Check secure context using browser's native property
+      // This is the most reliable way to check if we're in a secure context
+      const isSecureContext = typeof window !== 'undefined' && window.isSecureContext;
+      const protocol = typeof window !== 'undefined' ? window.location.protocol : '';
+      const hostname = typeof window !== 'undefined' ? window.location.hostname : '';
+      const isLocalhost = hostname === 'localhost' || hostname === '127.0.0.1';
+
+      // For Apple Pay, we need a secure context (HTTPS or localhost)
+      // window.isSecureContext is true for:
+      // - HTTPS pages
+      // - localhost (even on HTTP)
+      // - 127.0.0.1 (even on HTTP)
+      // - file:// URLs
+      const isSecure = isSecureContext || isLocalhost;
 
-      console.log("[Apple Pay] Secure context:", isSecure, "Protocol:", window.location?.protocol);
+      console.log("[Apple Pay] Secure context check:", {
+        isSecureContext: isSecureContext,
+        protocol: protocol,
+        hostname: hostname,
+        isLocalhost: isLocalhost,
+        isSecure: isSecure,
+        fullUrl: typeof window !== 'undefined' ? window.location.href : ''
+      });
+
+      // If not secure, log detailed information
+      if (!isSecure) {
+        console.error("[Apple Pay] NOT in secure context!", {
+          isSecureContext: isSecureContext,
+          protocol: protocol,
+          hostname: hostname,
+          isLocalhost: isLocalhost,
+          fullUrl: typeof window !== 'undefined' ? window.location.href : '',
+          reason: !isSecureContext ? "window.isSecureContext is false" : "Unknown"
+        });
+      }
 
       // First, check if Payment Request API is available
       // Payment Request API works on HTTP too, but Apple Pay JS API requires HTTPS
@@ -168,15 +198,23 @@ const ApplePayButton = ({
         }
       }
 
-      // If canMakePayment is not available, assume it's available (for older browsers)
-      // But only if we're in a secure context
-      // Reuse isSecure from line 47
+      // If canMakePayment is not available, check secure context again
+      // Re-check secure context to ensure we have the latest state
+      const isSecureContextFinal = typeof window !== 'undefined' && window.isSecureContext;
+      const hostnameFinal = typeof window !== 'undefined' ? window.location.hostname : '';
+      const isLocalhostFinal = hostnameFinal === 'localhost' || hostnameFinal === '127.0.0.1';
+      const isSecureFinal = isSecureContextFinal || isLocalhostFinal;
 
-      if (isSecure) {
+      if (isSecureFinal) {
         console.log("[Apple Pay] canMakePayment not available, assuming support (secure context)");
         return { available: true, method: 'paymentRequest' };
       } else {
         console.warn("[Apple Pay] canMakePayment not available and insecure context");
+        console.warn("[Apple Pay] Context details:", {
+          isSecureContext: isSecureContextFinal,
+          hostname: hostnameFinal,
+          isLocalhost: isLocalhostFinal
+        });
         return { available: false, method: null, error: 'insecure_context' };
       }
     } catch (error) {
@@ -189,9 +227,13 @@ const ApplePayButton = ({
       }
 
       // Fallback: Try Apple Pay JS API (only on HTTPS)
-      // Reuse isSecure from line 47
+      // Re-check secure context
+      const isSecureContextFallback = typeof window !== 'undefined' && window.isSecureContext;
+      const hostnameFallback = typeof window !== 'undefined' ? window.location.hostname : '';
+      const isLocalhostFallback = hostnameFallback === 'localhost' || hostnameFallback === '127.0.0.1';
+      const isSecureFallback = isSecureContextFallback || isLocalhostFallback;
 
-      if (typeof window !== 'undefined' && window.ApplePaySession && isSecure) {
+      if (typeof window !== 'undefined' && window.ApplePaySession && isSecureFallback) {
         try {
           const canMakePayments = ApplePaySession.canMakePayments();
           return { available: canMakePayments, method: 'applePayJS' };
@@ -456,21 +498,39 @@ const ApplePayButton = ({
           merchantSessionPromise.then(session => {
             console.log("[Apple Pay] Merchant session received:", {
               hasMerchantIdentifier: !!session.merchantIdentifier,
+              merchantIdentifier: session.merchantIdentifier,
               domainName: session.domainName,
-              displayName: session.displayName
+              displayName: session.displayName,
+              epochTimestamp: session.epochTimestamp,
+              expiresAt: session.expiresAt,
+              fullSession: session
             });
+            
+            // Validate merchant session
+            if (!session || (!session.merchantIdentifier && !session.merchantSessionIdentifier)) {
+              console.error("[Apple Pay] Invalid merchant session - missing merchantIdentifier");
+              console.error("[Apple Pay] Session object:", JSON.stringify(session, null, 2));
+              throw new Error("Invalid merchant session: missing merchantIdentifier");
+            }
           }).catch(err => {
             console.error("[Apple Pay] Merchant session error:", err);
+            // Re-throw so Payment Request API knows validation failed
+            throw err;
           });
 
+          // Complete with the merchant session promise
+          // If the promise rejects, Payment Request API will close the dialog
           event.complete(merchantSessionPromise);
         } catch (error) {
           console.error("[Apple Pay] Merchant validation error:", error);
-          if (onError) {
+          // Only call onError if it's defined
+          if (typeof onError === 'function') {
             onError(error);
           }
-          // Complete with empty object - Payone will handle validation
-          event.complete({});
+          // Complete with a promise that resolves to empty object
+          // This allows the dialog to continue even if validation fails
+          // Apple Pay will show an error but won't close immediately
+          event.complete(Promise.resolve({}));
         }
       };
 
@@ -502,10 +562,42 @@ const ApplePayButton = ({
       let response;
       try {
         response = await request.show();
+        console.log("[Apple Pay] Payment sheet shown successfully");
       } catch (error) {
-        console.error("[Apple Pay] Error showing payment sheet:", error);
-        if (onError) {
-          onError(error);
+        console.error("[Apple Pay] Error showing payment sheet:", {
+          name: error.name,
+          message: error.message,
+          stack: error.stack
+        });
+        
+        // Check if error is due to cancellation (user cancelled)
+        // Payment Request API throws "AbortError" when user cancels
+        if (error.name === 'AbortError' || 
+            (error.message && (
+              error.message.includes('Cancelled') || 
+              error.message.includes('cancel') ||
+              error.message.includes('abort')
+            ))) {
+          console.log("[Apple Pay] User cancelled the payment");
+          // Don't call onError for user cancellation
+          return;
+        }
+        
+        // If it's a merchant validation error, log it specifically
+        if (error.message && (
+          error.message.includes('merchant') ||
+          error.message.includes('validation') ||
+          error.message.includes('identifier')
+        )) {
+          console.error("[Apple Pay] Merchant validation failed - this may cause the dialog to close");
+          if (typeof onError === 'function') {
+            onError(new Error("Merchant validation failed. Please check your Apple Pay configuration and merchant identifier in Payone settings."));
+          }
+        } else {
+          // For other errors, call onError
+          if (typeof onError === 'function') {
+            onError(error);
+          }
         }
         return;
       }
@@ -630,7 +722,8 @@ const ApplePayButton = ({
         } catch (finalError) {
           console.error("[Apple Pay] Failed to complete payment even with fail status:", finalError);
         }
-        if (onError) {
+        // Only call onError if it's defined
+        if (typeof onError === 'function') {
           onError(completeError);
         }
       }
@@ -641,7 +734,14 @@ const ApplePayButton = ({
         stack: error.stack,
         name: error.name
       });
-      if (onError) {
+      // Check if error is due to cancellation (user cancelled)
+      if (error.message && error.message.includes('Cancelled')) {
+        console.log("[Apple Pay] User cancelled the payment");
+        // Don't call onError for user cancellation
+        return;
+      }
+      // Only call onError if it's defined and it's not a cancellation
+      if (typeof onError === 'function') {
         onError(error);
       }
     }
@@ -660,43 +760,45 @@ const ApplePayButton = ({
     });
 
     try {
-      // Call Strapi backend to validate with Payone
-      const response = await fetch('/api/strapi-plugin-payone-provider/validate-apple-pay-merchant', {
+      console.log("[Apple Pay] Making validation request using Strapi helper...");
+
+      // Use Strapi helper-plugin's request function which automatically handles authentication
+      // This uses the admin API route which requires admin authentication
+      const merchantSession = await request(`/${pluginId}/validate-apple-pay-merchant`, {
         method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({
+        body: {
           validationURL,
           ...config
-        })
+        }
       });
 
-      console.log("[Apple Pay] Validation response status:", response.status);
+      console.log("[Apple Pay] Merchant session received from backend:", {
+        hasData: !!merchantSession.data,
+        merchantIdentifier: merchantSession.data?.merchantIdentifier
+      });
 
-      if (response.ok) {
-        const merchantSession = await response.json();
-        console.log("[Apple Pay] Merchant session received from backend:", {
-          hasData: !!merchantSession.data,
-          merchantIdentifier: merchantSession.data?.merchantIdentifier
-        });
-        return merchantSession.data || merchantSession;
-      } else {
-        // If validation fails, return empty object - Payone will handle it
-        const errorText = await response.text();
-        console.warn("[Apple Pay] Merchant validation failed:", {
-          status: response.status,
-          statusText: response.statusText,
-          error: errorText
-        });
-        return {};
-      }
+      return merchantSession.data || merchantSession;
     } catch (error) {
       console.error("[Apple Pay] Merchant validation error:", {
         message: error.message,
+        status: error.response?.status,
+        statusText: error.response?.statusText,
+        data: error.response?.data,
         stack: error.stack
       });
-      // Return empty object - Payone will handle validation
+
+      // Log specific error details
+      if (error.response?.status === 403) {
+        console.error("[Apple Pay] 403 Forbidden - Authentication failed. Make sure you are logged in as admin.");
+      } else if (error.response?.status === 401) {
+        console.error("[Apple Pay] 401 Unauthorized - Please log in again.");
+      } else if (error.response?.status >= 500) {
+        console.error("[Apple Pay] Server error - Check server logs for details.");
+      }
+
+      // If validation fails, return empty object
+      // This allows the dialog to continue, though Apple Pay may show an error
+      // The user can still proceed with payment if they want
       return {};
     }
   };
@@ -720,12 +822,6 @@ const ApplePayButton = ({
         )}
         {!isLoading && isAvailable && (
           <>
-            <Typography variant="sigma" textColor="neutral700" fontWeight="semiBold" style={{ textAlign: "left" }}>
-              Apple Pay Payment
-            </Typography>
-            <Typography variant="pi" textColor="neutral600" style={{ textAlign: "left" }}>
-              Click the button below to pay with Apple Pay. The token will be automatically sent to Payone.
-            </Typography>
             <Box ref={buttonContainerRef} style={{ minHeight: "40px", width: "100%", display: "flex", justifyContent: "flex-start" }}>
               {typeof window !== 'undefined' && window.customElements && window.customElements.get('apple-pay-button') ? (
                 <apple-pay-button

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-payone-provider",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "Strapi plugin for Payone payment gateway integration",
   "license": "MIT",
   "maintainers": [

package/server/controllers/payone.js

@@ -17,7 +17,7 @@ const getPayoneService = (strapi) => {
  * @param {Error} error - Error object
  */
 const handleError = (ctx, error) => {
-  strapi.log.error("Payone controller error:", error);
+  ctx.strapi.log.error("Payone controller error:", error);
   ctx.throw(500, error);
 };
 
@@ -180,10 +180,28 @@ module.exports = ({ strapi }) => ({
 
   async validateApplePayMerchant(ctx) {
     try {
+      strapi.log.info("[Apple Pay] Merchant validation request received");
+      strapi.log.info("[Apple Pay] Request body:", JSON.stringify(ctx.request.body, null, 2));
+      strapi.log.info("[Apple Pay] User:", ctx.state.user ? {
+        id: ctx.state.user.id,
+        email: ctx.state.user.email,
+        roles: ctx.state.user.roles?.map(r => r.code)
+      } : "No user");
+
       const params = ctx.request.body;
       const result = await getPayoneService(strapi).validateApplePayMerchant(params);
+
+      strapi.log.info("[Apple Pay] Merchant validation result:", {
+        hasResult: !!result,
+        hasMerchantIdentifier: !!result.merchantIdentifier
+      });
+
       ctx.body = { data: result };
     } catch (error) {
+      strapi.log.error("[Apple Pay] Controller error:", {
+        message: error.message,
+        stack: error.stack
+      });
       handleError(ctx, error);
     }
   }

package/server/services/applePayService.js

@@ -24,7 +24,7 @@ const initializeApplePaySession = async (strapi, params) => {
   try {
     strapi.log.info("[Apple Pay] Initializing Apple Pay session with Payone");
     strapi.log.info("[Apple Pay] Request params:", JSON.stringify(params, null, 2));
-    
+
     const settings = await getSettings(strapi);
 
     if (!validateSettings(settings)) {
@@ -55,9 +55,9 @@ const initializeApplePaySession = async (strapi, params) => {
     const mode = settings.mode || "test"; // test or live
 
     // Get domain from params or settings or server config
-    const domain = domainName || settings.domainName || 
-                   (strapi.config.get("server.url") ? new URL(strapi.config.get("server.url")).hostname : null) ||
-                   "localhost";
+    const domain = domainName || settings.domainName ||
+      (strapi.config.get("server.url") ? new URL(strapi.config.get("server.url")).hostname : null) ||
+      "localhost";
 
     // Build request parameters for Apple Pay session initialization
     // According to Payone documentation: request="genericpayment"
@@ -87,14 +87,38 @@ const initializeApplePaySession = async (strapi, params) => {
 
     const formData = toFormData(requestParams);
 
-    const response = await axios.post(POST_GATEWAY_URL, formData, {
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      timeout: 30000
+    strapi.log.info("[Apple Pay] Sending request to Payone API:", {
+      url: POST_GATEWAY_URL,
+      params: {
+        ...requestParams,
+        key: "***HIDDEN***" // Hide API key in logs
+      }
     });
 
+    let response;
+    try {
+      response = await axios.post(POST_GATEWAY_URL, formData, {
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        timeout: 30000
+      });
+    } catch (axiosError) {
+      strapi.log.error("[Apple Pay] Payone API request failed:", {
+        message: axiosError.message,
+        status: axiosError.response?.status,
+        statusText: axiosError.response?.statusText,
+        data: axiosError.response?.data,
+        config: {
+          url: axiosError.config?.url,
+          method: axiosError.config?.method
+        }
+      });
+      throw axiosError;
+    }
+
     strapi.log.info("[Apple Pay] Payone response received:", {
       status: response.status,
-      statusText: response.statusText
+      statusText: response.statusText,
+      headers: response.headers
     });
 
     // Parse response
@@ -102,7 +126,7 @@ const initializeApplePaySession = async (strapi, params) => {
 
     strapi.log.info("[Apple Pay] Session initialization response:", JSON.stringify(responseData, null, 2));
     strapi.log.info("[Apple Pay] Response status:", responseData.status || responseData.Status);
-    
+
     if (responseData.errorcode || responseData.ErrorCode) {
       strapi.log.warn("[Apple Pay] Response contains error:", {
         errorcode: responseData.errorcode || responseData.ErrorCode,
@@ -135,7 +159,7 @@ const validateApplePayMerchant = async (strapi, params) => {
       mid: params.mid,
       portalid: params.portalid
     }, null, 2));
-    
+
     const settings = await getSettings(strapi);
 
     if (!validateSettings(settings)) {
@@ -155,11 +179,11 @@ const validateApplePayMerchant = async (strapi, params) => {
     const merchantName = displayName || settings.merchantName || settings.displayName || "Test Store";
     const merchantId = mid || settings.mid || settings.merchantIdentifier;
     const portalId = portalid || settings.portalid;
-    
+
     // Get domain from params or settings or server config
-    const domainName = domain || settings.domainName || 
-                       (strapi.config.get("server.url") ? new URL(strapi.config.get("server.url")).hostname : null) ||
-                       "localhost";
+    const domainName = domain || settings.domainName ||
+      (strapi.config.get("server.url") ? new URL(strapi.config.get("server.url")).hostname : null) ||
+      "localhost";
 
     // For Payone integration without developer account,
     // Payone handles merchant validation
@@ -174,44 +198,184 @@ const validateApplePayMerchant = async (strapi, params) => {
     strapi.log.info("[Apple Pay] Initializing session with params:", JSON.stringify(sessionParams, null, 2));
 
     // Initialize Apple Pay session with Payone
-    const sessionResponse = await initializeApplePaySession(strapi, sessionParams);
+    let sessionResponse;
+    try {
+      sessionResponse = await initializeApplePaySession(strapi, sessionParams);
+    } catch (error) {
+      strapi.log.error("[Apple Pay] Failed to initialize session with Payone:", {
+        message: error.message,
+        status: error.response?.status,
+        data: error.response?.data
+      });
+      // Return empty object on error - Payment Request API will handle it
+      return {};
+    }
 
     strapi.log.info("[Apple Pay] Session initialization result:", {
       status: sessionResponse.status || sessionResponse.Status,
-      hasMerchantIdentifier: !!(sessionResponse.merchantIdentifier || sessionResponse.merchantSessionIdentifier)
+      hasMerchantIdentifier: !!(sessionResponse.merchantIdentifier || sessionResponse.merchantSessionIdentifier),
+      hasApplePaySession: !!(sessionResponse["add_paydata[applepay_payment_session]"] ||
+        sessionResponse["add_paydata[applepay_payment_session]"] ||
+        sessionResponse.add_paydata?.applepay_payment_session),
+      fullResponse: JSON.stringify(sessionResponse, null, 2)
     });
 
-    // If session initialization is successful, return merchant session
-    // Payone will provide the merchant identifier and validation data
-    if (sessionResponse.status === "APPROVED" || sessionResponse.status === "REDIRECT") {
-      strapi.log.info("[Apple Pay] Session approved, creating merchant session object");
-      // Get merchant identifier from Payone response or settings
-      const merchantIdentifier = sessionResponse.merchantIdentifier || 
-                                  sessionResponse.merchantSessionIdentifier ||
-                                  settings.merchantIdentifier ||
-                                  settings.mid || 
-                                  settings.portalid ||
-                                  `merchant.${domainName}`;
-
-      // Return merchant session object
-      // In a real implementation, you would get this from Payone's response
-      const merchantSession = {
-        epochTimestamp: Date.now(),
-        expiresAt: Date.now() + (5 * 60 * 1000), // 5 minutes
-        merchantSessionIdentifier: sessionResponse.merchantSessionIdentifier || `merchant.${domainName}`,
-        nonce: sessionResponse.nonce || generateNonce(),
-        merchantIdentifier: merchantIdentifier,
-        domainName: domainName,
-        displayName: merchantName
-      };
-
-      strapi.log.info("[Apple Pay] Merchant session created:", {
-        merchantIdentifier: merchantSession.merchantIdentifier,
-        domainName: merchantSession.domainName,
-        expiresAt: new Date(merchantSession.expiresAt).toISOString()
+    // If session initialization is successful, extract merchant session from Payone response
+    // Payone returns: add_paydata[applepay_payment_session] = BASE64 encoded merchant session
+    // Check for both uppercase and lowercase status
+    const responseStatus = sessionResponse.status || sessionResponse.Status;
+    if (responseStatus === "APPROVED" || responseStatus === "OK" ||
+      responseStatus === "approved" || responseStatus === "ok") {
+
+      // Extract BASE64 encoded merchant session from Payone response
+      // Payone returns it in: add_paydata[applepay_payment_session]
+      // Try all possible variations of the field name
+      const applePaySessionBase64 =
+        sessionResponse["add_paydata[applepay_payment_session]"] ||
+        sessionResponse["add_paydata[applepay_payment_session]"] ||
+        sessionResponse["add_paydata_applepay_payment_session"] ||
+        sessionResponse.add_paydata?.applepay_payment_session ||
+        sessionResponse.add_paydata?.["applepay_payment_session"] ||
+        sessionResponse["addPaydata[applepay_payment_session]"] ||
+        sessionResponse["addPaydata_applepay_payment_session"] ||
+        null;
+
+      strapi.log.info("[Apple Pay] Checking for merchant session in response:", {
+        hasWorkorderid: !!sessionResponse.workorderid,
+        workorderid: sessionResponse.workorderid,
+        allKeys: Object.keys(sessionResponse).filter(k => k.includes('applepay') || k.includes('session') || k.includes('paydata')),
+        responseKeys: Object.keys(sessionResponse)
+      });
+
+      strapi.log.info("[Apple Pay] Extracted Apple Pay session data:", {
+        hasBase64Session: !!applePaySessionBase64,
+        sessionLength: applePaySessionBase64?.length,
+        workorderid: sessionResponse.workorderid
       });
 
-      return merchantSession;
+      if (applePaySessionBase64) {
+        try {
+          // Decode BASE64 merchant session
+          const merchantSessionJson = Buffer.from(applePaySessionBase64, 'base64').toString('utf-8');
+          const merchantSession = JSON.parse(merchantSessionJson);
+
+          strapi.log.info("[Apple Pay] Decoded merchant session:", {
+            merchantIdentifier: merchantSession.merchantIdentifier,
+            domainName: merchantSession.domainName,
+            displayName: merchantSession.displayName,
+            hasEpochTimestamp: !!merchantSession.epochTimestamp,
+            hasExpiresAt: !!merchantSession.expiresAt,
+            fullSession: merchantSession
+          });
+
+          // Validate decoded merchant session
+          if (!merchantSession.merchantIdentifier) {
+            strapi.log.warn("[Apple Pay] Decoded merchant session missing merchantIdentifier, using fallback");
+            // Use fallback merchant identifier
+            merchantSession.merchantIdentifier = settings.merchantIdentifier ||
+              settings.mid ||
+              settings.portalid ||
+              `merchant.${domainName}`;
+          }
+
+          // Ensure epochTimestamp and expiresAt are in seconds (not milliseconds)
+          if (merchantSession.epochTimestamp && merchantSession.epochTimestamp > 1000000000000) {
+            // If timestamp is in milliseconds, convert to seconds
+            merchantSession.epochTimestamp = Math.floor(merchantSession.epochTimestamp / 1000);
+          }
+          if (merchantSession.expiresAt && merchantSession.expiresAt > 1000000000000) {
+            // If timestamp is in milliseconds, convert to seconds
+            merchantSession.expiresAt = Math.floor(merchantSession.expiresAt / 1000);
+          }
+
+          // Validate final merchant session
+          if (!merchantSession.merchantIdentifier || merchantSession.merchantIdentifier === 'undefined' || merchantSession.merchantIdentifier === 'null') {
+            throw new Error("Decoded merchant session has invalid merchantIdentifier");
+          }
+
+          strapi.log.info("[Apple Pay] Validated merchant session:", {
+            merchantIdentifier: merchantSession.merchantIdentifier,
+            domainName: merchantSession.domainName,
+            epochTimestamp: merchantSession.epochTimestamp,
+            expiresAt: merchantSession.expiresAt
+          });
+
+          return merchantSession;
+        } catch (decodeError) {
+          strapi.log.error("[Apple Pay] Failed to decode merchant session:", {
+            error: decodeError.message,
+            base64Length: applePaySessionBase64?.length,
+            base64Preview: applePaySessionBase64?.substring(0, 100)
+          });
+
+          // If decoding fails, we cannot proceed - merchant session is invalid
+          throw new Error(`Failed to decode Apple Pay merchant session: ${decodeError.message}`);
+        }
+      } else {
+        // If no session data in response, we need to create a valid merchant session
+        // According to Payone docs, merchant identifier should be obtained from PMI
+        // after domain verification and onboarding
+        strapi.log.warn("[Apple Pay] No Apple Pay session data in response, creating merchant session from settings");
+
+        // Get merchant identifier from settings
+        // According to Payone docs, merchant identifier should be visible in PMI after onboarding
+        // Path: CONFIGURATION/PAYMENT PORTALS - choose an onboarded Portal - Payment type configuration tab
+        let merchantIdentifier = settings.merchantIdentifier ||
+          settings.mid ||
+          settings.portalid;
+
+        // If still no merchant identifier, try to construct one from domain
+        // But this is not ideal - merchant identifier should come from Payone PMI
+        if (!merchantIdentifier) {
+          strapi.log.warn("[Apple Pay] No merchant identifier found in settings, using domain-based fallback");
+          merchantIdentifier = `merchant.${domainName}`;
+        }
+
+        // Ensure merchant identifier is a string and not empty
+        merchantIdentifier = merchantIdentifier.toString().trim();
+        if (!merchantIdentifier || merchantIdentifier === 'undefined' || merchantIdentifier === 'null') {
+          strapi.log.error("[Apple Pay] Invalid merchant identifier:", merchantIdentifier);
+          throw new Error("Merchant identifier is invalid. Please configure a valid merchant identifier in Payone Merchant Interface (PMI) after Apple Pay onboarding. Path: CONFIGURATION → PAYMENT PORTALS → [Your Portal] → Payment type configuration tab");
+        }
+
+        // Create a valid merchant session object
+        // This format is required by Apple Pay Payment Request API
+        // IMPORTANT: epochTimestamp and expiresAt must be in seconds (Unix timestamp), not milliseconds
+        const merchantSession = {
+          epochTimestamp: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
+          expiresAt: Math.floor((Date.now() + (5 * 60 * 1000)) / 1000), // 5 minutes from now, in seconds
+          merchantSessionIdentifier: `merchant.${domainName}`,
+          nonce: generateNonce(),
+          merchantIdentifier: merchantIdentifier, // Already validated and converted to string
+          domainName: domainName,
+          displayName: merchantName
+        };
+
+        // Validate merchant session before returning
+        if (!merchantSession.merchantIdentifier || merchantSession.merchantIdentifier === 'undefined' || merchantSession.merchantIdentifier === 'null') {
+          strapi.log.error("[Apple Pay] Created merchant session is missing or invalid merchantIdentifier!", {
+            merchantIdentifier: merchantSession.merchantIdentifier,
+            settings: {
+              hasMerchantIdentifier: !!settings.merchantIdentifier,
+              hasMid: !!settings.mid,
+              hasPortalid: !!settings.portalid,
+              mid: settings.mid,
+              portalid: settings.portalid
+            }
+          });
+          throw new Error("Merchant identifier is required but not found in settings. Please configure merchant identifier in Payone Merchant Interface (PMI) after Apple Pay onboarding.");
+        }
+
+        strapi.log.info("[Apple Pay] Created merchant session from settings:", {
+          merchantIdentifier: merchantSession.merchantIdentifier,
+          domainName: merchantSession.domainName,
+          displayName: merchantSession.displayName,
+          epochTimestamp: merchantSession.epochTimestamp,
+          expiresAt: merchantSession.expiresAt
+        });
+
+        return merchantSession;
+      }
     }
 
     // If initialization failed, return empty object
@@ -249,8 +413,8 @@ const parseResponse = (responseData, logger) => {
  * Generate nonce for merchant session
  */
 const generateNonce = () => {
-  return Math.random().toString(36).substring(2, 15) + 
-         Math.random().toString(36).substring(2, 15);
+  return Math.random().toString(36).substring(2, 15) +
+    Math.random().toString(36).substring(2, 15);
 };
 
 module.exports = {

package/server/utils/responseParser.js

@@ -24,8 +24,20 @@ const parseResponse = (responseText, logger) => {
   const params = new URLSearchParams(responseText);
   const response = {};
   for (const [key, value] of params) {
+    // Store both lowercase and original case
     response[key.toLowerCase()] = value;
     response[key] = value;
+    
+    // Also handle add_paydata fields with brackets
+    // Payone returns: add_paydata[applepay_payment_session]=BASE64_STRING
+    // URLSearchParams handles brackets, but we need to ensure we can access it
+    if (key.includes('add_paydata') || key.includes('addPaydata')) {
+      // Store with original key format
+      response[key] = value;
+      // Also try normalized versions
+      const normalizedKey = key.replace(/\[/g, '_').replace(/\]/g, '');
+      response[normalizedKey] = value;
+    }
   }
   return response;
 };