vonpay-medusa 1.0.0 → 1.0.2

package/.medusa/server/src/admin/index.js

@@ -132,7 +132,7 @@ const REASON_COPY = {
   },
   upsell_refund_failed: {
     label: "Late offer charge — refund failed",
-    what: "The buyer's bank approved an offer after the offer had ended, so nothing was added and the plugin tried to refund the charge in full, but the refund did not go through. Refund the payment in Vonpay by the order id. Do not add the item."
+    what: "The buyer was charged for an offer whose item was NOT added to the order — the bank approved it after the offer had ended, the item could not be added, or an earlier declined attempt was approved after all — so the plugin tried to refund that charge in full, but the refund did not go through (refused, or not settled within 48 hours). Refund the payment in Vonpay by the order id. Do not add the item."
   },
   upsell_refund_pending: {
     label: "Late offer charge — refund in progress",
@@ -1164,17 +1164,17 @@ const routeModule = {
 const menuItemModule = {
   menuItems: [
     {
-      label: config$1.label,
-      icon: config$1.icon,
-      path: "/vonpay-holds",
+      label: config.label,
+      icon: config.icon,
+      path: "/vonpay-subscriptions",
       nested: "/orders",
       rank: void 0,
       translationNs: void 0
     },
     {
-      label: config.label,
-      icon: config.icon,
-      path: "/vonpay-subscriptions",
+      label: config$1.label,
+      icon: config$1.icon,
+      path: "/vonpay-holds",
       nested: "/orders",
       rank: void 0,
       translationNs: void 0

package/.medusa/server/src/admin/index.mjs

@@ -129,7 +129,7 @@ const REASON_COPY = {
   },
   upsell_refund_failed: {
     label: "Late offer charge — refund failed",
-    what: "The buyer's bank approved an offer after the offer had ended, so nothing was added and the plugin tried to refund the charge in full, but the refund did not go through. Refund the payment in Vonpay by the order id. Do not add the item."
+    what: "The buyer was charged for an offer whose item was NOT added to the order — the bank approved it after the offer had ended, the item could not be added, or an earlier declined attempt was approved after all — so the plugin tried to refund that charge in full, but the refund did not go through (refused, or not settled within 48 hours). Refund the payment in Vonpay by the order id. Do not add the item."
   },
   upsell_refund_pending: {
     label: "Late offer charge — refund in progress",
@@ -1161,17 +1161,17 @@ const routeModule = {
 const menuItemModule = {
   menuItems: [
     {
-      label: config$1.label,
-      icon: config$1.icon,
-      path: "/vonpay-holds",
+      label: config.label,
+      icon: config.icon,
+      path: "/vonpay-subscriptions",
       nested: "/orders",
       rank: void 0,
       translationNs: void 0
     },
     {
-      label: config.label,
-      icon: config.icon,
-      path: "/vonpay-subscriptions",
+      label: config$1.label,
+      icon: config$1.icon,
+      path: "/vonpay-holds",
       nested: "/orders",
       rank: void 0,
       translationNs: void 0

package/.medusa/server/src/api/store/vonpay/upsells/[order]/accept/route.js

@@ -14,5 +14,5 @@ async function POST(req, res) {
     }
     if ((0, upsell_routes_1.busy)(res, orderId))
         return;
-    res.json(await found.provider.acceptUpsell({ providerId: found.id, orderId, variantId: typeof body.variant_id === "string" ? body.variant_id : "", expectedMinor: body.expected_amount_minor, token, customerId: (0, upsell_routes_1.customerFrom)(req), buyerIp: (0, upsell_routes_1.shopperIpFrom)(req) }));
+    res.json(await found.provider.acceptUpsell({ providerId: found.id, orderId, variantId: typeof body.variant_id === "string" ? body.variant_id : "", expectedMinor: body.expected_amount_minor, token, customerId: (0, upsell_routes_1.customerFrom)(req), buyerIp: (0, upsell_routes_1.shopperIpForRoute)(req, found.provider.shopperIpSecret()) }));
 }

package/.medusa/server/src/api/store/vonpay/upsells/[order]/resume/route.js

@@ -13,5 +13,5 @@ async function POST(req, res) {
     }
     if ((0, upsell_routes_1.busy)(res, orderId))
         return;
-    res.json(await found.provider.resumeUpsell({ providerId: found.id, orderId, token, customerId: (0, upsell_routes_1.customerFrom)(req), buyerIp: (0, upsell_routes_1.shopperIpFrom)(req) }));
+    res.json(await found.provider.resumeUpsell({ providerId: found.id, orderId, token, customerId: (0, upsell_routes_1.customerFrom)(req), buyerIp: (0, upsell_routes_1.shopperIpForRoute)(req, found.provider.shopperIpSecret()) }));
 }

package/.medusa/server/src/lib/errors.js

@@ -16,6 +16,7 @@ exports.VONPAY_ERRORS = {
     options_mode_key_mismatch: "vonpay_options_mode_key_mismatch: mode does not match the secret key's mode",
     options_webhook_secret_invalid: "vonpay_options_webhook_secret_invalid: webhookSecret, when set, must be a string",
     options_webhook_secret_is_api_key: "vonpay_options_webhook_secret_is_api_key: webhookSecret must be the webhook signing secret, not a Vonpay API key",
+    options_shopper_ip_secret_invalid: "vonpay_options_shopper_ip_secret_invalid: shopperIpSecret, when set, must be its own random value of at least 32 characters (not a Vonpay key or the webhook secret)",
     options_storefront_url_invalid: "vonpay_options_storefront_url_invalid: storefrontUrl must be an https origin (http only for localhost in test mode), with no query or fragment",
     options_api_base_url_not_allowed: "vonpay_options_api_base_url_not_allowed: apiBaseUrl is a test-only option and accepts only the Vonpay staging host or a local address",
     options_hold_recheck_invalid: "vonpay_options_hold_recheck_invalid: holdRecheck must be true or false",

package/.medusa/server/src/providers/vonpay/descriptor.js

@@ -16,6 +16,7 @@ exports.readDescriptorConfig = readDescriptorConfig;
 exports.ruleKey = ruleKey;
 exports.sourcesInWords = sourcesInWords;
 exports.fallbackInWords = fallbackInWords;
+const admin_holds_1 = require("./admin-holds");
 const errors_1 = require("../../lib/errors");
 const descriptor_rules_1 = require("./descriptor-rules");
 Object.defineProperty(exports, "DESCRIPTOR_VALUE_MAX", { enumerable: true, get: function () { return descriptor_rules_1.DESCRIPTOR_VALUE_MAX; } });
@@ -141,7 +142,7 @@ async function boundedDescriptorMetadata(option, readers, ms, skipped = () => un
     if (!option)
         return {};
     try {
-        return await bounded(ms, () => descriptorMetadata(option, readers, skipped));
+        return await (0, admin_holds_1.within)(ms, () => descriptorMetadata(option, readers, skipped));
     }
     catch {
         skipped({ field: null, why: "deadline" });
@@ -151,28 +152,13 @@ async function boundedDescriptorMetadata(option, readers, ms, skipped = () => un
 function fieldsOf(option) {
     return new Set(option ? sourcesOf(option).filter((s) => typeof s === "string") : []);
 }
-async function bounded(ms, work) {
-    let timer;
-    try {
-        return await Promise.race([
-            work(),
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("descriptor_read_deadline")), ms);
-            }),
-        ]);
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
 async function readStoreName(query, ms) {
-    const { data } = await bounded(ms, () => query.graph({ entity: "store", fields: ["id", "name"] }));
+    const { data } = await (0, admin_holds_1.within)(ms, () => query.graph({ entity: "store", fields: ["id", "name"] }));
     const rows = data.filter((r) => !!r);
     return rows.length === 1 ? (0, descriptor_rules_1.plainValue)(rows[0].name) : undefined;
 }
 async function readOrderDescriptorFacts(query, orderId, ms) {
-    const { data } = await bounded(ms, () => query.graph({
+    const { data } = await (0, admin_holds_1.within)(ms, () => query.graph({
         entity: "order",
         fields: ["id", "display_id", "metadata", "items.id", "items.product_title", "items.title", "items.created_at"],
         filters: { id: orderId },

package/.medusa/server/src/providers/vonpay/held-list.js

@@ -173,6 +173,23 @@ function upsellsFromCollection(c, now = Date.now()) {
                                         : !atBank && (r.state === "authorized" || r.state === "closing") && stale
                                             ? "upsell_hold_unsettled"
                                             : undefined;
+        for (const p of r?.prior_intents ?? []) {
+            if (p.stuck === undefined)
+                continue;
+            out.push({
+                vp_session_id: null,
+                medusa_payment_session_id: null,
+                payment_collection_id: c.id,
+                reason: p.stuck === "amount_mismatch" ? "amount_mismatch" : "upsell_refund_failed",
+                source: "upsell",
+                held_at: isoOrNull(p.at),
+                order_id: medusaId(r.order_id),
+                payment_id: null,
+                retry_until: null,
+                status: "open",
+                resolution: null,
+            });
+        }
         if (!reason)
             continue;
         out.push({

package/.medusa/server/src/providers/vonpay/options.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UPSELL_VARIANTS_MAX = exports.SAVED_CARDS_TERMS_MAX = exports.SAVED_CARDS_TERMS_MIN = void 0;
+exports.UPSELL_VARIANTS_MAX = exports.SAVED_CARDS_TERMS_MAX = exports.SAVED_CARDS_TERMS_MIN = exports.SHOPPER_IP_SECRET_DISTINCT_MIN = exports.SHOPPER_IP_SECRET_MIN = void 0;
 exports.validateVonpayOptions = validateVonpayOptions;
 exports.successUrlFor = successUrlFor;
 exports.apiOrigin = apiOrigin;
 exports.webhookSecretOf = webhookSecretOf;
 const errors_1 = require("../../lib/errors");
 const descriptor_1 = require("./descriptor");
+exports.SHOPPER_IP_SECRET_MIN = 32;
+exports.SHOPPER_IP_SECRET_DISTINCT_MIN = 10;
 exports.SAVED_CARDS_TERMS_MIN = 20;
 exports.SAVED_CARDS_TERMS_MAX = 1_000;
 const VARIANT_ID = /^variant_[A-Za-z0-9]{1,64}$/;
@@ -86,6 +88,14 @@ function validateVonpayOptions(options) {
         }
     }
     (0, descriptor_1.validateStatementDescriptor)(o.statementDescriptor);
+    if (o.shopperIpSecret !== undefined && o.shopperIpSecret !== null && o.shopperIpSecret !== "") {
+        const v = o.shopperIpSecret;
+        const t = typeof v === "string" ? v.trim() : "";
+        const same = (x) => typeof x === "string" && x.trim() === t;
+        if (t.length < exports.SHOPPER_IP_SECRET_MIN || /^vp_(sk|pk)_/.test(t) || same(o.secretKey) || same(o.webhookSecret) || new Set(t).size < exports.SHOPPER_IP_SECRET_DISTINCT_MIN) {
+            throw (0, errors_1.vonpayError)("options_shopper_ip_secret_invalid");
+        }
+    }
     if (o.apiBaseUrl !== undefined) {
         if (o.mode !== "test")
             throw (0, errors_1.vonpayError)("options_api_base_url_not_allowed");

package/.medusa/server/src/providers/vonpay/reading.js

@@ -23,6 +23,7 @@ exports.decide = decide;
 exports.buyerDeclineOf = buyerDeclineOf;
 exports.retryAfterMsOf = retryAfterMsOf;
 exports.bankCheckUntilOf = bankCheckUntilOf;
+exports.isoPlus = isoPlus;
 exports.shadowVerdict = shadowVerdict;
 const session_data_1 = require("./session-data");
 const KNOWN_NO_MONEY_PAYMENT = new Set(["unpaid", "cancelled"]);
@@ -192,8 +193,11 @@ function bankCheckUntilOf(s) {
         return null;
     if (s.outcome !== undefined && s.outcome !== null && s.outcome !== "in_flight")
         return null;
-    const from = typeof s.updatedAt === "string" ? Date.parse(s.updatedAt) : NaN;
-    return Number.isFinite(from) ? new Date(from + session_data_1.BANK_CHECK_MS).toISOString() : null;
+    return isoPlus(s.updatedAt, session_data_1.BANK_CHECK_MS);
+}
+function isoPlus(value, ms) {
+    const at = typeof value === "string" ? Date.parse(value) : NaN;
+    return Number.isFinite(at) ? new Date(at + ms).toISOString() : null;
 }
 exports.VERDICTS = ["open", "reopened", "in_flight", "declined", "authorized", "charged_once", "closed_no_charge", "needs_review"];
 function shadowVerdict(s, ours) {

package/.medusa/server/src/providers/vonpay/service.js

@@ -256,7 +256,7 @@ class VonpayProviderService extends utils_1.AbstractPaymentProvider {
     async medusaSession(id, fields) {
         return (await this.medusaSessionLookup(id, fields)).rec;
     }
-    async medusaSessionLookup(id, fields) {
+    async medusaSessionLookup(id, fields, opts = {}) {
         const svc = this.resolveOptional("paymentSessionService");
         try {
             if (!svc || typeof svc.retrieve !== "function")
@@ -265,7 +265,8 @@ class VonpayProviderService extends utils_1.AbstractPaymentProvider {
         }
         catch (err) {
             const missing = isNotFound(err);
-            this.log(missing ? "warn" : "error", "medusa_record_unreadable", { record: "payment_session", medusa_session_id: safe(id), missing, ...errorFields(err) });
+            if (!(missing && opts.missingExpected))
+                this.log(missing ? "warn" : "error", "medusa_record_unreadable", { record: "payment_session", medusa_session_id: safe(id), missing, ...errorFields(err) });
             return { missing };
         }
     }
@@ -941,29 +942,40 @@ class VonpayProviderService extends utils_1.AbstractPaymentProvider {
             }),
             now: () => Date.now(),
             upsellAdded: (r, providerId) => this.announceUpsellAdded(providerId, r.order_id, r.acceptance_id),
-            refundLate: (pi, amountMinor, currency) => this.refundLateUpsell(pi, amountMinor, currency),
+            refundLate: (pi, amountMinor, currency, step) => this.refundLateUpsell(pi, amountMinor, currency, step),
             statementDescriptor: () => this.options_.statementDescriptor,
         };
     }
-    async refundLateUpsell(pi, amountMinor, currency) {
+    async refundLateUpsell(pi, amountMinor, currency, step) {
         if (!(0, session_data_2.isVpPaymentIntentIdShape)(pi) || (0, session_data_2.vpPaymentIntentMode)(pi) !== this.mode() || !Number.isInteger(amountMinor) || amountMinor < 1)
             return "failed";
-        const ids = { vp_payment_intent_id: pi };
+        if (!Number.isInteger(step) || step < 0)
+            return "retry";
+        const ids = { vp_payment_intent_id: pi, step };
+        const key = `vpm_upsell_late_rf_${pi}${step === 0 ? "" : `_s${step}`}`;
         try {
-            const refund = await this.vonpay((c) => c.refunds.create({ paymentIntent: pi, amount: amountMinor, currency }, { idempotencyKey: `vpm_upsell_late_rf_${pi}` }));
+            const refund = await this.vonpay((c) => c.refunds.create({ paymentIntent: pi, amount: amountMinor, currency }, { idempotencyKey: key }));
+            const replay = refund.idempotent === true;
             const status = String(refund.status);
             if (REFUND_CONFIRMED.has(status))
                 return "refunded";
-            if (REFUND_DEFINITELY_NOT_MADE.has(status))
+            if (REFUND_DEFINITELY_NOT_MADE.has(status)) {
+                if (replay) {
+                    this.log("info", "refund_transport", { ...ids, outcome: "key_spent" });
+                    return "unsettled";
+                }
                 return "failed";
+            }
             this.log("warn", "refund_transport", { ...ids, outcome: "unrecognised_status" });
             return "retry";
         }
         catch (err) {
             const reading = readRefundError(err);
-            if (reading.kind === "nothing_left")
-                return "refunded";
-            if (reading.kind === "refused" || reading.kind === "key_conflict") {
+            if (reading.kind === "refused" && reading.medusa === "refund_before_settlement") {
+                this.log("info", "refund_transport", { ...ids, outcome: "before_settlement" });
+                return "unsettled";
+            }
+            if (reading.kind === "nothing_left" || reading.kind === "refused" || reading.kind === "key_conflict") {
                 this.log("warn", "refund_transport", { ...ids, outcome: "refused", ...errorFields(err) });
                 return "failed";
             }
@@ -1615,6 +1627,10 @@ class VonpayProviderService extends utils_1.AbstractPaymentProvider {
         const wrote = await this.writeOfferRecord(c.id, record);
         return wrote ? { ok: true, record: wrote } : { ok: false, why: "record_not_written" };
     }
+    shopperIpSecret() {
+        const v = this.options_.shopperIpSecret?.trim();
+        return v ? v : undefined;
+    }
     upsellsEnabled() {
         return !!this.options_.upsells;
     }
@@ -1664,7 +1680,8 @@ class VonpayProviderService extends utils_1.AbstractPaymentProvider {
         const done = { v: 1, order_id: record.order_id, revoked, at: new Date().toISOString() };
         if (!(await this.writeOfferDone(collectionId, done)))
             return { outcome: "retry", why: "record" };
-        this.log("info", "upsell_cleanup_done", { ...ids, revoked: revoked.length, guest: record.buyer_ref === null });
+        const unrecorded = record.buyer_ref === null && !record.vp_payment_method_id;
+        this.log(unrecorded ? "warn" : "info", "upsell_cleanup_done", { ...ids, revoked: revoked.length, guest: record.buyer_ref === null, ...(unrecorded ? { card_recorded: false } : {}) });
         return { outcome: "done", revoked };
     }
     async writeOfferDone(collectionId, value) {
@@ -4023,7 +4040,12 @@ class VonpayProviderService extends utils_1.AbstractPaymentProvider {
             return { action: utils_1.PaymentActions.SUCCESSFUL, data: { session_id: medusaSessionId, amount: (0, money_1.fromMinorUnits)(s.amount, s.currency) }, changedAt };
         }
         if ((0, reading_1.definitivelyNoCharge)(s)) {
-            const rec = await this.medusaSession(medusaSessionId, ["payment_collection_id"]);
+            const found = await this.medusaSessionLookup(medusaSessionId, ["payment_collection_id"], { missingExpected: true });
+            if (found.missing) {
+                this.log("info", "webhook_not_actionable", { ...evt, vp_session_id: vpSessionId, why: "session_gone" });
+                return { action: utils_1.PaymentActions.NOT_SUPPORTED, why: "session_gone" };
+            }
+            const rec = found.rec;
             if (await this.closedInHeldList(rec, vpSessionId))
                 return notActionable("closed");
             return { action: utils_1.PaymentActions.FAILED, data: { session_id: medusaSessionId, amount: (0, money_1.fromMinorUnits)(s.amount, s.currency) } };

package/.medusa/server/src/providers/vonpay/session-data.js

@@ -49,6 +49,7 @@ exports.offerCleanupDone = offerCleanupDone;
 exports.offerOrderIdsOf = offerOrderIdsOf;
 exports.upsellJobOwns = upsellJobOwns;
 exports.upsellAwaitsRecheck = upsellAwaitsRecheck;
+exports.priorOwed = priorOwed;
 exports.upsellDescriptorOf = upsellDescriptorOf;
 exports.acceptanceIdOf = acceptanceIdOf;
 exports.isUpsellRecord = isUpsellRecord;
@@ -558,6 +559,7 @@ function upsellJobOwns(r) {
         r.state === "stopped" ||
         r.state === "refunding" ||
         upsellAwaitsRecheck(r) ||
+        priorOwed(r).length > 0 ||
         (r.state === "held" && r.hold_reason !== null && exports.UPSELL_JOB_HOLD_REASONS.has(r.hold_reason)));
 }
 function upsellAwaitsRecheck(r) {
@@ -565,6 +567,9 @@ function upsellAwaitsRecheck(r) {
 }
 exports.UPSELL_RELEASE_REASONS = ["out_of_stock", "amount_changed", "order_busy", "edit_failed", "hold_lost", "abandoned", "session_unusable", "declined"];
 exports.UPSELL_MAX_ATTEMPTS = 3;
+function priorOwed(r) {
+    return (r.prior_intents ?? []).filter((p) => p.stuck === undefined);
+}
 function upsellDescriptorOf(r) {
     return typeof r.descriptor_key === "string" && typeof r.descriptor_value === "string" ? { [r.descriptor_key]: r.descriptor_value } : {};
 }
@@ -606,6 +611,20 @@ function isUpsellRecord(v) {
     }
     if (r.rechecked === true && (wallet || !["declined", "skipped", "refunding", "refunded"].includes(r.state)))
         return false;
+    if (r.prior_intents !== undefined) {
+        const list = r.prior_intents;
+        if (wallet || !Array.isArray(list) || list.length < 1 || list.length > exports.UPSELL_MAX_ATTEMPTS - 1)
+            return false;
+        for (const p of list) {
+            const x = p;
+            if (!x || typeof x !== "object" || !isVpPaymentIntentIdShape(x.id) || !Number.isInteger(x.amount_minor) || x.amount_minor < 1)
+                return false;
+            if (typeof x.currency !== "string" || !CURRENCY.test(x.currency) || typeof x.at !== "string" || !Number.isFinite(Date.parse(x.at)))
+                return false;
+            if (!(x.stuck === undefined || x.stuck === "refund_failed" || x.stuck === "amount_mismatch"))
+                return false;
+        }
+    }
     if (exports.UPSELL_STOP_STATES.has(r.state) && ((wallet && r.state === "stopped") || r.vp_payment_intent_id === null || r.amount_minor === null))
         return false;
     if (!wallet && (r.vp_session_sealed !== undefined || r.release_reason !== undefined))

package/.medusa/server/src/providers/vonpay/setup-check.js

@@ -6,6 +6,7 @@ exports.requestHost = requestHost;
 exports.hostOf = hostOf;
 exports.infrastructureItems = infrastructureItems;
 exports.upsellEmailItem = upsellEmailItem;
+exports.shopperIpItem = shopperIpItem;
 exports.webhookPathFor = webhookPathFor;
 exports.runSetupCheck = runSetupCheck;
 exports.regionsItem = regionsItem;
@@ -134,6 +135,16 @@ function upsellEmailItem(cfg) {
             fix: 'Add a Medusa notification provider with channels ["email"] (for example SendGrid or Resend) in medusa-config, or set upsells.email: false if your store sends its own.',
         };
 }
+function shopperIpItem(secretSet) {
+    return secretSet
+        ? { id: "shopper_ip", status: "pass", detail: "shopperIpSecret is set: offer charges carry the shopper's address when the storefront signs it with the same value." }
+        : {
+            id: "shopper_ip",
+            status: "warn",
+            detail: "One-click upsells are on, but shopperIpSecret is not set, so offer charges carry no shopper address for the processor's fraud checks.",
+            fix: "Set VONPAY_SHOPPER_IP_SECRET (a long random value, e.g. openssl rand -hex 32) to the SAME value in the Medusa server's and the storefront's environment, and VONPAY_SHOPPER_IP_HEADER in the storefront's.",
+        };
+}
 function webhookPathFor(providerId) {
     return `/hooks/payment/${providerId.replace(/^pp_/, "")}`;
 }
@@ -177,6 +188,9 @@ async function runSetupCheck(scope, settings = {}) {
         items.push(...list);
     if (providers.some(({ provider: p }) => p.upsellEmailEnabled?.() === true))
         items.push(upsellEmailItem(cfg));
+    const upselling = providers.filter(({ provider: p }) => p.upsellsEnabled?.() === true);
+    if (upselling.length > 0)
+        items.push(shopperIpItem(upselling.every(({ provider: p }) => !!p.shopperIpSecret?.())));
     items.push(...infra);
     const unverified = items.filter((i) => i.status === "not_checked").length;
     return { ok: !items.some((i) => i.status === "fail"), complete: unverified === 0, unverified, items };

package/.medusa/server/src/providers/vonpay/ship-hold.js

@@ -29,6 +29,11 @@ function readShipOverride(meta, orderId) {
 }
 const PAID_NOT_ADDED = new Set(["upsell_paid_not_added", "upsell_paid_unsettled", "upsell_outcome_unknown", "upsell_not_settled", "amount_mismatch", "upsell_take_unconfirmed"]);
 const ADDING_PAST_STOP = new Set(["charged", "taking"]);
+function noOfferPossible(offer, acted) {
+    if (offer.kind === "card" && !offer.vp_payment_method_id)
+        return true;
+    return acted.length >= upsell_accept_1.OFFERS_SHOWN_PER_ORDER && !acted.some(session_data_1.upsellMayRetry);
+}
 function shipHoldOf(f, now) {
     const overridden = f.collections.some((c) => readShipOverride(c.metadata, f.id) !== undefined);
     if (f.status === "canceled" || f.status === "archived" || f.fulfilled)
@@ -41,10 +46,12 @@ function shipHoldOf(f, now) {
     const reads = f.collections.flatMap((c) => (0, session_data_1.upsellRecordsOf)(c.metadata).map((x) => x.read));
     if (reads.some((x) => x.kind === "record" && x.r.state === "held" && x.r.hold_reason !== null && PAID_NOT_ADDED.has(x.r.hold_reason)))
         return { hold: "paid", until: null, overridden };
-    const stopped = now >= (0, upsell_token_1.offerStopMs)(offer.r.at);
+    const stopped = now >= (0, upsell_token_1.orderOfferStopMs)(f.created_ms, now);
     const busy = reads.some((x) => x.kind === "unrecognised" || (x.kind === "record" && (stopped ? ADDING_PAST_STOP.has(x.r.state) : session_data_1.UPSELL_IN_FLIGHT_STATES.has(x.r.state))));
     if (busy)
         return { hold: "in_flight", until: null, overridden };
+    if (noOfferPossible(offer.r, reads.flatMap((x) => (x.kind === "record" ? [x.r] : []))))
+        return { hold: "none", until: null, overridden };
     const end = Math.min(f.created_ms, now) + upsell_token_1.OFFER_WINDOW_MS;
     return end > now ? { hold: "open", until: new Date(end).toISOString(), overridden } : { hold: "none", until: null, overridden };
 }

package/.medusa/server/src/providers/vonpay/upsell-accept.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.upsellHoldKey = exports.UPSELL_HOLD_EXPIRES_S = exports.UPSELL_SESSION_MARKER = exports.UPSELL_SETTLE = exports.UPSELL_RECHECK_AFTER_MS = exports.OFFER_PENDING_MS = exports.OFFERS_SHOWN_PER_ORDER = exports.upsellIdempotencyKey = exports.RESUME_ADDED_MS = exports.UPSELL_BANK_LINK_MS = exports.UPSELL_WORKFLOWS = void 0;
+exports.upsellHoldKey = exports.UPSELL_HOLD_EXPIRES_S = exports.UPSELL_SESSION_MARKER = exports.UPSELL_SETTLE = exports.UPSELL_RECHECK_AFTER_MS = exports.OFFER_PENDING_MS = exports.OFFERS_SHOWN_PER_ORDER = exports.upsellIdempotencyKey = exports.RESUME_ADDED_MS = exports.UPSELL_LATE_REFUND_KEY_MS = exports.UPSELL_UNSETTLED_REFUND_MS = exports.UPSELL_BANK_LINK_MS = exports.UPSELL_WORKFLOWS = void 0;
+exports.lateRefundStep = lateRefundStep;
 exports.readUpsellOrderFacts = readUpsellOrderFacts;
 exports.offerOf = offerOf;
 exports.offerStopped = offerStopped;
@@ -47,6 +48,12 @@ exports.UPSELL_WORKFLOWS = Object.freeze({
 });
 const OPEN_COLLECTION = new Set(["not_paid", "awaiting", "authorized", "partially_authorized"]);
 exports.UPSELL_BANK_LINK_MS = 30 * 60_000;
+exports.UPSELL_UNSETTLED_REFUND_MS = 48 * 60 * 60_000;
+exports.UPSELL_LATE_REFUND_KEY_MS = 2 * 60 * 60_000;
+function lateRefundStep(nowMs, since) {
+    const at = since === null ? NaN : Date.parse(since);
+    return Number.isFinite(at) ? Math.max(0, ((nowMs - at) / exports.UPSELL_LATE_REFUND_KEY_MS) | 0) : 0;
+}
 exports.RESUME_ADDED_MS = 2 * 60_000;
 async function readUpsellOrderFacts(query, orderId, ms, unreadable = () => { }) {
     const { data } = await (0, admin_holds_1.within)(ms, () => query.graph({
@@ -134,8 +141,9 @@ function offerOf(f) {
 }
 const upsellIdempotencyKey = (orderId, acceptanceId, attempt) => `vpm_upsell_${orderId}_${acceptanceId}_${attempt}`;
 exports.upsellIdempotencyKey = upsellIdempotencyKey;
-function offerStopped(host, f, offer) {
-    return f.fulfilled || host.now() >= (0, upsell_token_1.offerStopMs)(offer.at);
+function offerStopped(host, f) {
+    const now = host.now();
+    return f.fulfilled || f.status === "canceled" || f.status === "archived" || now >= (0, upsell_token_1.orderOfferStopMs)(f.created_ms, now);
 }
 function passBindsOrder(host, f, offer, token, asker) {
     if (!f.cart_id)
@@ -505,7 +513,7 @@ async function latestOutcome(host, input, orderId, latest) {
         default: {
             const f = await facts(host, orderId);
             const found = f ? offerOf(f) : undefined;
-            if (f && found && offerStopped(host, f, found.offer)) {
+            if (f && found && offerStopped(host, f)) {
                 await settleUpsell(host, { providerId: input.providerId, orderId, acceptanceId: latest.acceptance_id });
                 const now = await facts(host, orderId);
                 const read = now ? (0, session_data_1.readUpsellRecord)(now.collections.find((c) => c.id === found.collectionId)?.metadata, latest.acceptance_id) : undefined;
@@ -701,7 +709,7 @@ async function acceptLocked(host, providerId, orderId, variantId, expected, toke
             case "declined":
                 if (!(0, session_data_1.upsellMayRetry)(r))
                     return refuse("offer_closed", "attempts_exhausted");
-                return newAttempt(ctx, expected, r.attempt + 1, r.at, r.order_change_id);
+                return newAttempt(ctx, expected, r.attempt + 1, r);
             default:
                 return { outcome: "unknown" };
         }
@@ -711,10 +719,12 @@ async function acceptLocked(host, providerId, orderId, variantId, expected, toke
         return refuse("offer_closed", "offers_per_order");
     if (f.variant_ids.includes(variantId))
         return refuse("offer_unavailable", "already_in_order");
-    return newAttempt(ctx, expected, 1, null, null);
+    return newAttempt(ctx, expected, 1, null);
 }
 const WORKFLOWS_PER_ATTEMPT = 6;
-async function newAttempt(ctx, expected, attempt, priorAt, priorChangeId) {
+async function newAttempt(ctx, expected, attempt, prior) {
+    const priorAt = prior?.at ?? null;
+    const priorChangeId = prior?.order_change_id ?? null;
     const { host, offer, ids } = ctx;
     const refuse = (code, why, level = "warn") => {
         host.log(level, "upsell_refused", { ...ids, why });
@@ -770,12 +780,19 @@ async function newAttempt(ctx, expected, attempt, priorAt, priorChangeId) {
         host.log("warn", "upsell_refused", { ...ids, why: "amount_changed", amount_minor: amountMinor, shown_minor: expected });
         return amountMinor >= 1 ? { outcome: "amount_changed", amount_minor: amountMinor, currency: f.currency } : { outcome: "refused", code: "offer_unavailable" };
     }
+    const owed = [
+        ...(prior?.prior_intents ?? []),
+        ...(prior && (0, session_data_1.upsellAwaitsRecheck)(prior) && prior.amount_minor !== null && prior.currency !== null
+            ? [{ id: prior.vp_payment_intent_id, amount_minor: prior.amount_minor, currency: prior.currency, at: prior.at }]
+            : []),
+    ];
     const sending = {
         ...blank(f.id, ctx.variantId, ctx.acc, "sending", attempt, host.now()),
         order_change_id: changeId,
         amount_minor: amountMinor,
         currency: f.currency,
         ...(await upsellDescriptor(ctx, ctx.variantId)),
+        ...(owed.length > 0 ? { prior_intents: owed } : {}),
     };
     if (!(await host.writeUpsell(ctx.collectionId, sending, priorAt === null ? { expect: "none" } : { expect: "at", at: priorAt }))) {
         await cancelEdit(ctx, changeId);
@@ -975,9 +992,7 @@ async function afterAction(ctx, r) {
     return onAnswer(ctx, r, pi);
 }
 function linkUntil(pi) {
-    const issued = pi.nextAction?.issuedAt;
-    const at = typeof issued === "string" ? Date.parse(issued) : NaN;
-    return Number.isFinite(at) ? new Date(at + exports.UPSELL_BANK_LINK_MS).toISOString() : null;
+    return (0, reading_1.isoPlus)(pi.nextAction?.issuedAt, exports.UPSELL_BANK_LINK_MS);
 }
 async function refundLate(ctx, r0, extra = {}) {
     const { host } = ctx;
@@ -991,18 +1006,34 @@ async function refundLate(ctx, r0, extra = {}) {
     if (!r)
         return { outcome: "unknown" };
     const answer = (confirmed) => ({ outcome: "refunded", amount_minor: r.amount_minor, currency: r.currency, ...(confirmed ? {} : { pending: true }) });
-    const res = await host.refundLate(r.vp_payment_intent_id, r.amount_minor, r.currency);
+    const stuck = r0.state === "refunding" && host.now() - Date.parse(r0.at) >= 60 * 60_000;
+    if (!undone) {
+        host.log(stuck ? "error" : "warn", "upsell_late_refund", { ...ids, result: "edit_open" });
+        return answer(false);
+    }
+    const now = await facts(host, ctx.f.id);
+    if (!now)
+        return answer(false);
+    if (now.variant_ids.includes(r.variant_id)) {
+        host.log("error", "upsell_late_refund", { ...ids, result: "item_on_order" });
+        await advance(ctx, r, { state: "held", hold_reason: "upsell_paid_unrecorded", decline_kind: null, rechecked: undefined });
+        return { outcome: "unknown" };
+    }
+    const res = await host.refundLate(r.vp_payment_intent_id, r.amount_minor, r.currency, lateRefundStep(host.now(), r0.state === "refunding" ? r0.at : null));
     if (res === "refunded") {
-        host.log("info", "upsell_late_refund", { ...ids, result: "refunded", edit_undone: undone });
-        return answer(undone && !!(await advance(ctx, r, { state: "refunded" })));
+        host.log("info", "upsell_late_refund", { ...ids, result: "refunded" });
+        return answer(!!(await advance(ctx, r, { state: "refunded" })));
     }
-    if (res === "failed") {
-        host.log("error", "upsell_late_refund", { ...ids, result: "failed" });
+    const waitedOut = res === "unsettled" && r0.state === "refunding" && host.now() - Date.parse(r0.at) >= exports.UPSELL_UNSETTLED_REFUND_MS;
+    if (res === "failed" || waitedOut) {
+        host.log("error", "upsell_late_refund", { ...ids, result: res === "failed" ? "failed" : "not_settled" });
         await advance(ctx, r, { state: "held", hold_reason: "upsell_refund_failed", decline_kind: null, rechecked: undefined });
     }
     else {
-        const stuck = ctx.host.now() - Date.parse(r0.at) >= 60 * 60_000 && r0.state === "refunding";
-        host.log(stuck ? "error" : "warn", "upsell_late_refund", { ...ids, result: stuck ? "still_pending" : "retry" });
+        if (res === "unsettled")
+            host.log("info", "upsell_late_refund", { ...ids, result: "not_settled_yet" });
+        else
+            host.log(stuck ? "error" : "warn", "upsell_late_refund", { ...ids, result: stuck ? "still_pending" : "retry" });
     }
     return answer(false);
 }
@@ -1027,6 +1058,69 @@ async function readStoppedIntent(ctx, r) {
     }
     return { kind: "open", declineKind: null, pi };
 }
+async function recheckPrior(ctx, r) {
+    const { host } = ctx;
+    const all = r.prior_intents ?? [];
+    const next = [];
+    let changed = false;
+    for (const p of all) {
+        if (p.stuck !== undefined) {
+            next.push(p);
+            continue;
+        }
+        const age = host.now() - Date.parse(p.at);
+        if (age < exports.UPSELL_RECHECK_AFTER_MS) {
+            next.push(p);
+            continue;
+        }
+        const ids = { ...ctx.ids, vp_payment_intent_id: p.id, amount_minor: p.amount_minor, prior: true };
+        const stuck = (why) => {
+            next.push({ ...p, stuck: why });
+            changed = true;
+        };
+        const pi = await readIntent(host, p.id);
+        if (!pi) {
+            next.push(p);
+            continue;
+        }
+        if (pi.status === "failed" || pi.status === "voided") {
+            host.log("info", "upsell_rechecked", { ...ids, result: "ended" });
+            changed = true;
+            continue;
+        }
+        if (pi.status !== "succeeded" && pi.status !== "captured") {
+            next.push(p);
+            continue;
+        }
+        if (pi.amount !== p.amount_minor || typeof pi.currency !== "string" || pi.currency.toUpperCase() !== p.currency) {
+            host.log("error", "upsell_outcome_unknown", { ...ids, why: "prior_charge_amount_mismatch" });
+            stuck("amount_mismatch");
+            continue;
+        }
+        host.log("warn", "upsell_charged_after_stop", ids);
+        const res = await host.refundLate(p.id, p.amount_minor, p.currency, lateRefundStep(host.now(), p.at));
+        const waitedOut = res === "unsettled" && age >= exports.UPSELL_UNSETTLED_REFUND_MS;
+        if (res === "refunded") {
+            host.log("info", "upsell_late_refund", { ...ids, result: "refunded" });
+            changed = true;
+        }
+        else if (res === "failed" || waitedOut) {
+            host.log("error", "upsell_late_refund", { ...ids, result: res === "failed" ? "failed" : "not_settled" });
+            stuck("refund_failed");
+        }
+        else {
+            host.log(res === "unsettled" ? "info" : "warn", "upsell_late_refund", { ...ids, result: res === "unsettled" ? "not_settled_yet" : "retry" });
+            next.push(p);
+        }
+    }
+    if (!changed)
+        return r;
+    const { prior_intents: _old, ...rest } = r;
+    const value = next.length > 0 ? { ...rest, prior_intents: next } : rest;
+    if (!(0, session_data_1.isUpsellRecord)(value))
+        return r;
+    return (await host.writeUpsell(ctx.collectionId, value, { expect: "at", at: r.at })) ? value : r;
+}
 function lateSettled(out) {
     return out.outcome === "refunded" && !out.pending ? "refunded" : "waiting";
 }
@@ -1054,12 +1148,17 @@ async function settleUpsell(host, input) {
         const read = (0, session_data_1.readUpsellRecord)(f.collections.find((c) => c.id === found.collectionId)?.metadata, input.acceptanceId);
         if (read.kind !== "record")
             return "none";
-        const r = read.r;
+        let r = read.r;
         const age = host.now() - Date.parse(r.at);
-        const stop = offerStopped(host, f, found.offer);
+        const stop = offerStopped(host, f);
         if (age < exports.UPSELL_SETTLE.afterMs && !stop)
             return "waiting";
         const ctx = { host, providerId: input.providerId, f, offer: found.offer, collectionId: found.collectionId, acc: r.acceptance_id, variantId: r.variant_id, ids: { order_id: orderId, variant_id: r.variant_id, step: "settle" }, lockRemainingMs: lock.lockRemainingMs };
+        if ((0, session_data_1.priorOwed)(r).length > 0 && !session_data_1.UPSELL_IN_FLIGHT_STATES.has(r.state)) {
+            r = await recheckPrior(ctx, r);
+            if (!(0, session_data_1.upsellJobOwns)(r))
+                return "none";
+        }
         if (r.state === "refunding")
             return lateSettled(await refundLate(ctx, r));
         if (r.pay === "wallet" && r.state !== "charged")
@@ -1150,7 +1249,7 @@ async function add(ctx, charged) {
         const fresh = await facts(ctx.host, ctx.f.id);
         if (!fresh)
             return { outcome: "unknown" };
-        if (offerStopped(ctx.host, fresh, ctx.offer) && !fresh.variant_ids.includes(r.variant_id))
+        if (offerStopped(ctx.host, fresh) && !fresh.variant_ids.includes(r.variant_id))
             return refundLate(ctx, r);
     }
     let lastErr;
@@ -1178,8 +1277,12 @@ async function add(ctx, charged) {
         }
     }
     ctx.host.log("error", "upsell_add_failed", { ...ctx.ids, step: "gave_up", vp_payment_intent_id: r.vp_payment_intent_id, error: errName(lastErr) });
-    if (r.state === "charged")
-        await advance(ctx, r, { state: "held", hold_reason: paidHoldReason(await facts(ctx.host, ctx.f.id), r) });
+    if (r.state !== "charged")
+        return { outcome: "unknown" };
+    const fresh = await facts(ctx.host, ctx.f.id);
+    if (fresh && r.upsell_collection_id === null && !fresh.variant_ids.includes(r.variant_id))
+        return refundLate(ctx, r);
+    await advance(ctx, r, { state: "held", hold_reason: paidHoldReason(fresh, r) });
     return { outcome: "unknown" };
 }
 function addedInMedusa(f, r) {
@@ -1689,7 +1792,7 @@ async function walletEditAndTake(ctx, r) {
     let f = await facts(host, ctx.f.id);
     if (!f)
         return { outcome: "processing" };
-    if (offerStopped(host, f, ctx.offer)) {
+    if (offerStopped(host, f)) {
         host.log("info", "upsell_stopped", { ...ctx.ids, vp_payment_intent_id: r.vp_payment_intent_id, from: r.state });
         await cancelOwnEdit(ctx, r);
         return walletRelease(ctx, r, "abandoned");

package/.medusa/server/src/providers/vonpay/upsell-cleanup.js

@@ -32,12 +32,12 @@ exports.UPSELL_CLEANUP_JOB_NAME = "vonpay-upsell-cleanup";
 function isCleanupProvider(p) {
     const o = p;
     const ctor = p?.constructor;
-    return !!o && typeof o === "object" && ctor?.identifier === "vonpay" && typeof o.adminMode === "function" && typeof o.upsellsEnabled === "function" && typeof o.cleanupOfferCards === "function" && typeof o.settleUpsellAcceptance === "function";
+    return !!o && typeof o === "object" && ctor?.identifier === "vonpay" && typeof o.adminMode === "function" && typeof o.cleanupOfferCards === "function" && typeof o.settleUpsellAcceptance === "function";
 }
 const processRunning = { active: false };
 async function cleanupUpsellCards(scope, settings = {}) {
     const log = (0, admin_holds_1.jobLogger)(scope);
-    const run = { ran: false, settled: { added: 0, declined: 0, released: 0, held: 0, waiting: 0, stopped: 0, refunded: 0 }, scanned: 0, due: 0, done: 0, revoked: 0, waiting: 0, failed: 0, scan_complete: true };
+    const run = { ran: false, settled: { added: 0, declined: 0, released: 0, held: 0, waiting: 0, stopped: 0, refunded: 0 }, scanned: 0, scanned_oldest: 0, due: 0, done: 0, revoked: 0, waiting: 0, failed: 0, scan_complete: true };
     const running = settings.running ?? processRunning;
     if (running.active)
         return run;
@@ -51,7 +51,7 @@ async function cleanupUpsellCards(scope, settings = {}) {
         const byMode = new Map();
         const idByMode = new Map();
         for (const e of await (0, admin_holds_1.within)(limits.callMs, () => (0, admin_holds_1.vonpayProviderEntries)(scope, null))) {
-            if (isCleanupProvider(e.provider) && e.provider.upsellsEnabled()) {
+            if (isCleanupProvider(e.provider)) {
                 byMode.set(e.provider.adminMode(), e.provider);
                 idByMode.set(e.provider.adminMode(), e.id);
             }
@@ -94,6 +94,29 @@ async function cleanupUpsellCards(scope, settings = {}) {
         });
         run.scanned = scan.scanned;
         run.scan_complete = scan.complete;
+        if (!scan.complete && !outOfTime()) {
+            const seen = new Set(inFlight.map((a) => a.acceptanceId));
+            const oldest = [];
+            const back = await (0, scan_1.pagedScan)({
+                budget: limits.maxScanned,
+                batch: limits.scanBatch,
+                outOfTime,
+                read: (skip, take) => (0, admin_holds_1.within)(limits.callMs, () => pm.listPaymentCollections({ id: { $gte: `pay_col_${(0, recovery_1.ulidTimePrefix)(started - limits.lookbackMs)}` }, metadata: { $ne: null } }, { select: ["id", "metadata"], skip, take, order: { id: "ASC" } })),
+                each: (c) => {
+                    for (const { read } of (0, session_data_1.upsellRecordsOf)(c.metadata ?? undefined)) {
+                        if (read.kind !== "record" || seen.has(read.r.acceptance_id) || !(0, session_data_1.upsellJobOwns)(read.r) || !jobDue(read.r, started - Date.parse(read.r.at)))
+                            continue;
+                        const offer = (0, session_data_1.readOfferRecord)(c.metadata ?? undefined, read.r.order_id);
+                        if (offer.kind !== "record")
+                            continue;
+                        seen.add(read.r.acceptance_id);
+                        oldest.push({ orderId: read.r.order_id, acceptanceId: read.r.acceptance_id, mode: offer.r.mode });
+                    }
+                },
+            });
+            run.scanned_oldest = back.scanned;
+            inFlight.unshift(...oldest);
+        }
         for (const a of inFlight) {
             if (outOfTime())
                 break;
@@ -139,7 +162,9 @@ async function cleanupUpsellCards(scope, settings = {}) {
             else
                 run.failed++;
         }
-        log("info", "upsell_cleanup_run", { settled_added: run.settled.added, settled_declined: run.settled.declined, settled_released: run.settled.released, settled_held: run.settled.held, settled_waiting: run.settled.waiting, settled_stopped: run.settled.stopped, settled_refunded: run.settled.refunded, scanned: run.scanned, due: run.due, done: run.done, revoked: run.revoked, waiting: run.waiting, failed: run.failed, scan_complete: run.scan_complete });
+        if (!run.scan_complete)
+            log("error", "upsell_cleanup_scan_incomplete", { scanned: run.scanned, budget: limits.maxScanned });
+        log("info", "upsell_cleanup_run", { settled_added: run.settled.added, settled_declined: run.settled.declined, settled_released: run.settled.released, settled_held: run.settled.held, settled_waiting: run.settled.waiting, settled_stopped: run.settled.stopped, settled_refunded: run.settled.refunded, scanned: run.scanned, scanned_oldest: run.scanned_oldest, due: run.due, done: run.done, revoked: run.revoked, waiting: run.waiting, failed: run.failed, scan_complete: run.scan_complete });
     }
     catch (err) {
         log("error", "upsell_cleanup_failed", { why: "run", error: (0, admin_holds_1.errName)(err) });

package/.medusa/server/src/providers/vonpay/upsell-routes.js

@@ -1,26 +1,71 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rateLimitPass = exports.rateLimitUpsell = exports.UPSELL_RATE_KEYS_MAX = exports.PASS_CALLS_PER_MINUTE = exports.UPSELL_CALLS_PER_MINUTE = exports.SHOPPER_IP_HEADER = exports.CART_ID = exports.ORDER_ID = exports.OFFER_TOKEN_HEADER = void 0;
+exports.rateLimitPass = exports.rateLimitUpsell = exports.UPSELL_RATE_KEYS_MAX = exports.PASS_CALLS_PER_MINUTE = exports.UPSELL_CALLS_PER_MINUTE = exports.SHOPPER_IP_REJECT_LOG_MS = exports.SHOPPER_IP_SIG_MAX_AGE_S = exports.SHOPPER_IP_SIG_HEADER = exports.SHOPPER_IP_HEADER = exports.CART_ID = exports.ORDER_ID = exports.OFFER_TOKEN_HEADER = void 0;
 exports.shopperIpFrom = shopperIpFrom;
+exports.shopperIpCheck = shopperIpCheck;
+exports.shopperIpForRoute = shopperIpForRoute;
 exports.upsellProviders = upsellProviders;
 exports.customerFrom = customerFrom;
 exports.offerTokenFrom = offerTokenFrom;
 exports.createLimiter = createLimiter;
 exports.providerForToken = providerForToken;
 exports.busy = busy;
+const node_crypto_1 = require("node:crypto");
 const admin_holds_1 = require("./admin-holds");
+const options_1 = require("./options");
 exports.OFFER_TOKEN_HEADER = "x-vonpay-offer-token";
 exports.ORDER_ID = /^order_[0-9A-Z]{26}$/;
 exports.CART_ID = /^cart_[0-9A-Z]{26}$/;
 exports.SHOPPER_IP_HEADER = "x-vonpay-shopper-ip";
-function shopperIpFrom(req) {
-    const h = req.headers?.[exports.SHOPPER_IP_HEADER];
+exports.SHOPPER_IP_SIG_HEADER = "x-vonpay-shopper-ip-sig";
+exports.SHOPPER_IP_SIG_MAX_AGE_S = 300;
+const SHOPPER_IP_LABEL = "vonpay-shopper-ip/v1";
+const SHOPPER_IP_SIG = /^v1\.(\d{1,12})\.([A-Za-z0-9_-]{43})$/;
+function oneHeader(req, name) {
+    const h = req.headers?.[name];
     const v = Array.isArray(h) ? (h.length === 1 ? h[0] : undefined) : h;
-    return typeof v === "string" && v.length > 0 && v.length <= 45 ? v : null;
+    return typeof v === "string" ? v : undefined;
+}
+function shopperIpFrom(req, secret, nowMs = Date.now()) {
+    return shopperIpCheck(req, secret, nowMs).ip;
+}
+function shopperIpCheck(req, secret, nowMs = Date.now()) {
+    const ip = oneHeader(req, exports.SHOPPER_IP_HEADER);
+    const rawSig = oneHeader(req, exports.SHOPPER_IP_SIG_HEADER);
+    if (ip === undefined && rawSig === undefined)
+        return { ip: null, why: "none" };
+    if (!secret || secret.length < options_1.SHOPPER_IP_SECRET_MIN)
+        return { ip: null, why: "no_secret" };
+    if (rawSig === undefined)
+        return { ip: null, why: "unsigned" };
+    const pass = offerTokenFrom(req);
+    const sig = SHOPPER_IP_SIG.exec(rawSig);
+    if (!ip || ip.length > 45 || !pass || !sig)
+        return { ip: null, why: "malformed" };
+    const ts = Number(sig[1]);
+    if (Math.abs(nowMs / 1000 - ts) > exports.SHOPPER_IP_SIG_MAX_AGE_S)
+        return { ip: null, why: "stale" };
+    const passHash = (0, node_crypto_1.createHash)("sha256").update(pass).digest("hex");
+    const want = (0, node_crypto_1.createHmac)("sha256", secret).update(`${SHOPPER_IP_LABEL}\n${ip}\n${ts}\n${passHash}`).digest();
+    const got = Buffer.from(sig[2], "base64url");
+    return got.length === want.length && (0, node_crypto_1.timingSafeEqual)(got, want) ? { ip } : { ip: null, why: "mismatch" };
+}
+exports.SHOPPER_IP_REJECT_LOG_MS = 10 * 60_000;
+const lastRejectLog = new Map();
+function shopperIpForRoute(req, secret, nowMs = Date.now()) {
+    const r = shopperIpCheck(req, secret, nowMs);
+    if (r.ip === null && r.why !== "none") {
+        const last = lastRejectLog.get(r.why);
+        if (last === undefined || nowMs - last >= exports.SHOPPER_IP_REJECT_LOG_MS) {
+            lastRejectLog.set(r.why, nowMs);
+            (0, admin_holds_1.jobLogger)(req.scope)("warn", "shopper_ip_sig_rejected", { why: r.why });
+        }
+    }
+    return r.ip;
 }
 function isUpsellProvider(p) {
     const ctor = p?.constructor;
-    return !!p && typeof p === "object" && ctor?.identifier === "vonpay" && typeof p.acceptUpsell === "function" && typeof p.prepareUpsellWallet === "function";
+    return !!p && typeof p === "object" && ctor?.identifier === "vonpay" && typeof p.acceptUpsell === "function" && typeof p.prepareUpsellWallet === "function" && typeof p.shopperIpSecret === "function";
 }
 async function upsellProviders(scope) {
     try {

package/.medusa/server/src/providers/vonpay/upsell-token.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OFFER_PASS_TTL_MS = exports.OFFER_CONTINUE_GRACE_MS = exports.OFFER_WINDOW_MS = void 0;
 exports.offerStopMs = offerStopMs;
+exports.orderOfferStopMs = orderOfferStopMs;
 exports.mintOfferPass = mintOfferPass;
 exports.checkOfferPass = checkOfferPass;
 exports.sealHoldSession = sealHoldSession;
@@ -13,6 +14,9 @@ exports.OFFER_CONTINUE_GRACE_MS = 30 * 60_000;
 function offerStopMs(offerAt) {
     return Date.parse(offerAt) + exports.OFFER_WINDOW_MS + exports.OFFER_CONTINUE_GRACE_MS;
 }
+function orderOfferStopMs(orderCreatedMs, nowMs) {
+    return Math.min(orderCreatedMs, nowMs) + exports.OFFER_WINDOW_MS + exports.OFFER_CONTINUE_GRACE_MS;
+}
 exports.OFFER_PASS_TTL_MS = 3 * 60 * 60_000;
 const VERSION = "v2";
 const LABEL = (mode) => `vonpay-medusa/upsell-pass/${VERSION}/${mode}`;

package/README.md

@@ -74,6 +74,7 @@ module.exports = defineConfig({
               mode: process.env.VONPAY_MODE, // "test" or "live"
               storefrontUrl: process.env.VONPAY_STOREFRONT_URL,
               webhookSecret: process.env.VONPAY_WEBHOOK_SECRET, // empty until you register the endpoint
+              shopperIpSecret: process.env.VONPAY_SHOPPER_IP_SECRET, // optional: see "The shopper's address on offer charges"
             },
           },
         ],
@@ -97,6 +98,7 @@ Set these in the server's `.env` (never in `medusa-config.ts` or any file you co
 | `VONPAY_MODE` | yes | `test` or `live`. Must match the key. |
 | `VONPAY_STOREFRONT_URL` | yes | Your storefront's address, such as `https://shop.example.com`. Must be `https`; `http://localhost` is allowed with test keys. Shoppers come back here from their bank's 3-D Secure check. |
 | `VONPAY_WEBHOOK_SECRET` | after setup | The signing secret Vonpay shows when you register your notification endpoint. Leave it empty for the first start (see [Payment notifications](#payment-notifications)). |
+| `VONPAY_SHOPPER_IP_SECRET` | optional | With one-click offers: a long random value of your own (`openssl rand -hex 32`), the SAME value in the storefront's environment. It proves the shopper's address on offer charges is real (see [`upsells`](#upsells-default-off), "The shopper's address on offer charges"). Never your Vonpay key or the webhook secret. |
 | `MEDUSA_BACKEND_URL` | recommended | Your Medusa server's public address, such as `https://api.example.com`. Lets the setup check confirm the notification endpoint is this store's. |
 | `VONPAY_UPDATE_CHECK` | no | `off` turns off the update notice (for a server with no outbound internet). |
 
@@ -493,9 +495,14 @@ writes it from the `VONPAY_SHOPPER_IP_HEADER` environment variable) to the reque
 sets to the visitor's own address, one value it writes itself: `x-real-ip` on Vercel,
 `cf-connecting-ip` behind Cloudflare. It must be a header your host overwrites on every request; a header a
 visitor can send through unchanged lets them choose the address you report. Do not use `x-forwarded-for`
-(its first entry can be typed by anyone; a header holding a list is ignored). Only a public address is sent; private,
-local or malformed values are dropped. Left unset, offers charge as before, without an address. The
-address is never logged or stored by the plugin.
+(its first entry can be typed by anyone; a header holding a list is ignored). Then set the same random value as
+`VONPAY_SHOPPER_IP_SECRET` in BOTH the storefront's environment (the setup command passes it as `shopperIpSecret`;
+server-only, never `NEXT_PUBLIC_`) and the Medusa server's (option `shopperIpSecret`): the storefront signs the address
+with it, and the store ignores any address that is not signed, so someone calling your store directly cannot choose
+it. Only a public address is sent; private, local or malformed values are dropped. Either setting left unset, offer
+charges carry no address (the setup check WARNs; the store logs `shopper_ip_sig_rejected` when an address arrives that
+it cannot believe). **Upgrading from 1.0.1:** 1.0.1 sent the address unsigned; from 1.0.2 it is used only once
+`VONPAY_SHOPPER_IP_SECRET` is set on both sides. The address is never logged or stored by the plugin.
 
 Guest shoppers get offers too, by default: the checkout names them by the email they type, and their
 card is kept for that purchase's offers only, then removed once the offer ends. A guest's card is never

package/bin/vonpay-medusa.cjs

@@ -21,7 +21,8 @@ import { createVonpayStorefrontServer } from "vonpay-medusa/storefront/server"
 
 // Every function below is a public endpoint: none takes an argument — the cart comes from the cookie.
 // VONPAY_SHOPPER_IP_HEADER: the header this storefront's HOSTING sets to the shopper's own address (e.g. x-real-ip on
-// Vercel, cf-connecting-ip behind Cloudflare); unset ⇒ offer charges carry no shopper address.
+// Vercel, cf-connecting-ip behind Cloudflare); VONPAY_SHOPPER_IP_SECRET: the secret that signs it, the SAME value as the
+// store's (server-only, never NEXT_PUBLIC_). Either unset ⇒ offer charges carry no shopper address.
 const vonpay = createVonpayStorefrontServer({
   sdk,
   getAuthHeaders,
@@ -30,6 +31,7 @@ const vonpay = createVonpayStorefrontServer({
   removeCartId,
   initiatePaymentSession,
   shopperIpHeader: process.env.VONPAY_SHOPPER_IP_HEADER?.trim() || undefined,
+  shopperIpSecret: process.env.VONPAY_SHOPPER_IP_SECRET?.trim() || undefined,
 })
 
 export async function completeVonpayCheckout() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vonpay-medusa",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Vonpay payment provider for Medusa v2",
   "author": "Von Payments",
   "license": "MIT",

package/storefront/src/deadline.ts

@@ -0,0 +1,17 @@
+export async function withDeadline<T>(ms: number, run: (signal: AbortSignal) => Promise<T>): Promise<T> {
+  const ask = new AbortController()
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      run(ask.signal),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          ask.abort()
+          reject(Object.assign(new Error("timeout"), { status: "timeout" as const }))
+        }, ms)
+      }),
+    ])
+  } finally {
+    if (timer) clearTimeout(timer)
+  }
+}

package/storefront/src/server.ts

@@ -5,7 +5,9 @@ import { cookies, headers as requestHeaders } from "next/headers"
 import { type CompletionResult, type VonpaySessionView, buyerReferenceOf, vonpaySession } from "./outcome"
 import { STUCK_REPORT_GLOBAL_MAX, STUCK_REPORT_WINDOW_MS, stuckReportLimiter } from "./report-limit"
 import { SAVED_CARDS_COPY, SAVED_CARD_ID, readSavedCards, type VonpayRemoveCardResult, type VonpaySavedCardsResult } from "./saved-cards"
+import { SHOPPER_IP_SECRET_MIN, SHOPPER_IP_SIG_HEADER, signShopperIp } from "./shopper-ip"
 import { sleep } from "./sleep"
+import { withDeadline } from "./deadline"
 import { readOfferAnswer, readOutcome, readWalletSession, type VonpayOffer, type VonpayOfferOutcome, type VonpayWalletSession } from "./upsell"
 
 export interface VonpayStorefrontServerDeps {
@@ -19,6 +21,7 @@ export interface VonpayStorefrontServerDeps {
   removeCartId(): Promise<void>
   initiatePaymentSession(cart: HttpTypes.StoreCart, data: { provider_id: string }): Promise<unknown>
   shopperIpHeader?: string
+  shopperIpSecret?: string
 }
 
 export interface VonpayStorefrontServer {
@@ -50,6 +53,7 @@ export const SHOPPER_IP_HEADER = "x-vonpay-shopper-ip"
 export function createVonpayStorefrontServer(deps: VonpayStorefrontServerDeps): VonpayStorefrontServer {
   const { sdk, getCacheTag, getCartId, removeCartId, initiatePaymentSession } = deps
   const getAuthHeaders = async () => ({ ...((await deps.getAuthHeaders()) as Record<string, string>) })
+  let warnedIpSecret = false
 
 async function completeVonpayCheckout(): Promise<CompletionResult> {
   const cartId = await getCartId()
@@ -200,21 +204,15 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
 
 
   async function requestOfferPass(cartId: string, headers: Record<string, string>): Promise<string | null> {
-    let timer: ReturnType<typeof setTimeout> | undefined
     try {
-      const body = await Promise.race([
-        sdk.client.fetch<{ token?: unknown }>("/store/vonpay/upsells/pass", { method: "POST", headers, body: { cart_id: cartId }, cache: "no-store" }),
-        new Promise<never>((_, reject) => {
-          timer = setTimeout(() => reject(Object.assign(new Error("timeout"), { status: "timeout" })), OFFER_PASS_REQUEST_MS)
-        }),
-      ])
+      const body = await withDeadline(OFFER_PASS_REQUEST_MS, (signal) =>
+        sdk.client.fetch<{ token?: unknown }>("/store/vonpay/upsells/pass", { method: "POST", headers, body: { cart_id: cartId }, cache: "no-store", signal })
+      )
       return typeof body?.token === "string" && body.token.length > 0 && body.token.length <= 2048 ? body.token : null
     } catch (err) {
       const status = (err as { status?: unknown } | null)?.status
       if (status !== 404) console.warn(`vonpay offer: pass request failed (${typeof status === "number" || status === "timeout" ? status : "error"})`)
       return null
-    } finally {
-      if (timer) clearTimeout(timer)
     }
   }
 
@@ -243,7 +241,17 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
     }
     if (!pass) return null
     const ip = await shopperIp()
-    return { ...(await getAuthHeaders()), "x-vonpay-offer-token": pass, ...(ip ? { [SHOPPER_IP_HEADER]: ip } : {}) }
+    const secret = shopperIpSecret()
+    const signed: Record<string, string> = ip && secret ? { [SHOPPER_IP_HEADER]: ip, [SHOPPER_IP_SIG_HEADER]: signShopperIp(secret, ip, pass) } : {}
+    return { ...(await getAuthHeaders()), "x-vonpay-offer-token": pass, ...signed }
+  }
+
+  function shopperIpSecret(): string | null {
+    const v = deps.shopperIpSecret?.trim()
+    if (v && v.length >= SHOPPER_IP_SECRET_MIN) return v
+    if (deps.shopperIpHeader && !warnedIpSecret) console.warn("vonpay: shopperIpHeader is set but VONPAY_SHOPPER_IP_SECRET is missing or shorter than 32 characters — offer charges carry no shopper address")
+    warnedIpSecret = true
+    return null
   }
 
   async function shopperIp(): Promise<string | null> {
@@ -269,25 +277,11 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
     const path = `/store/vonpay/upsells/${encodeURIComponent(orderId)}/offer`
     for (let i = 0; ; i++) {
       let answer: { offer: VonpayOffer | null; pending: boolean; resume: boolean }
-      const ask = new AbortController()
-      let timer: ReturnType<typeof setTimeout> | undefined
       try {
-        answer = readOfferAnswer(
-          await Promise.race([
-            sdk.client.fetch<unknown>(path, { method: "GET", headers, cache: "no-store", signal: ask.signal }),
-            new Promise<never>((_, reject) => {
-              timer = setTimeout(() => {
-                ask.abort()
-                reject(new Error("timeout"))
-              }, OFFER_READ_REQUEST_MS)
-            }),
-          ])
-        )
+        answer = readOfferAnswer(await withDeadline(OFFER_READ_REQUEST_MS, (signal) => sdk.client.fetch<unknown>(path, { method: "GET", headers, cache: "no-store", signal })))
       } catch {
         console.warn("vonpay offer: the offer could not be read")
         return none
-      } finally {
-        if (timer) clearTimeout(timer)
       }
       if (answer.resume || answer.offer || !answer.pending || i >= OFFER_PENDING_WAITS_MS.length) return { offer: answer.offer, resume: answer.resume }
       await sleep(OFFER_PENDING_WAITS_MS[i])
@@ -339,7 +333,7 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
     if (typeof orderId !== "string" || !ORDER_ID.test(orderId) || typeof variantId !== "string" || !VARIANT_ID.test(variantId)) return { ok: false }
     const headers = await offerHeaders()
     if (!headers) return { ok: false }
-    let pending = false
+    let ended = false
     try {
       const body = await sdk.client.fetch<{ ok?: unknown; pending_bank_check?: unknown }>(`/store/vonpay/upsells/${encodeURIComponent(orderId)}/skip`, {
         method: "POST",
@@ -347,12 +341,13 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
         body: { variant_id: variantId },
         cache: "no-store",
       })
-      pending = body?.ok === true && body?.pending_bank_check === true
+      const pending = body?.ok === true && body?.pending_bank_check === true
+      ended = body?.ok === true && !pending
       return { ok: body?.ok === true, ...(pending ? { pendingBankCheck: true as const } : {}) }
     } catch {
       return { ok: false }
     } finally {
-      if (!pending) await endUpsellOffer()
+      if (ended) await endUpsellOffer()
     }
   }
 

package/storefront/src/shopper-ip.ts

@@ -0,0 +1,12 @@
+import { createHash, createHmac } from "node:crypto"
+
+export const SHOPPER_IP_SIG_HEADER = "x-vonpay-shopper-ip-sig"
+export const SHOPPER_IP_SECRET_MIN = 32
+const LABEL = "vonpay-shopper-ip/v1"
+
+export function signShopperIp(secret: string, ip: string, pass: string, nowMs: number = Date.now()): string {
+  const ts = Math.floor(nowMs / 1000)
+  const passHash = createHash("sha256").update(pass).digest("hex")
+  const mac = createHmac("sha256", secret).update(`${LABEL}\n${ip}\n${ts}\n${passHash}`).digest("base64url")
+  return `v1.${ts}.${mac}`
+}