vonpay-medusa 1.0.3 → 1.0.4

package/README.md

@@ -504,6 +504,18 @@ charges carry no address (the setup check WARNs; the store logs `shopper_ip_sig_
 it cannot believe). **Upgrading from 1.0.1:** 1.0.1 sent the address unsigned; from 1.0.2 it is used only once
 `VONPAY_SHOPPER_IP_SECRET` is set on both sides. The address is never logged or stored by the plugin.
 
+**A repeated return from the bank still gets the offer (1.0.4).** The offer page needs a pass the storefront
+gets while the cart is still open. From 1.0.4 the card step also gets it when the shopper presses Pay, before
+they can leave for their bank's check, so a return that is repeated (a lost answer, a reload) still finds the
+offer. **Upgrading a storefront set up before 1.0.4:** add this to `src/lib/vonpay/actions.ts` (the setup
+command leaves an existing file as it is); without it the checkout works exactly as before.
+
+```ts
+export async function prepareVonpayOffer() {
+  return vonpay.prepareVonpayOffer()
+}
+```
+
 Guest shoppers get offers too, by default: the checkout names them by the email they type, and their
 card is kept for that purchase's offers only, then removed once the offer ends. A guest's card is never
 added to an existing customer's account because the guest typed that customer's email. `guests: false`

package/bin/vonpay-medusa.cjs

@@ -50,6 +50,11 @@ export async function startVonpayPayment() {
   return vonpay.startVonpayPayment()
 }
 
+// The offer pass, fetched at Pay (before the shopper can leave for the bank) and kept in an httpOnly cookie.
+export async function prepareVonpayOffer() {
+  return vonpay.prepareVonpayOffer()
+}
+
 // "My saved cards": the signed-in customer's cards. Remove takes the card id; the store's server checks
 // the card is this customer's before anything is removed.
 export async function listVonpaySavedCards() {
@@ -476,7 +481,7 @@ function setupStorefront(root, opts = {}) {
       note(step, "failed", err && err.message ? err.message : String(err))
     }
   }
-  const write = (file, content, step) =>
+  const write = (file, content, step, hint) =>
     guarded(step, () => {
       const rel = path.relative(root, file)
       if (!insideRoot(file)) return note(step, "manual", `${rel} resolves outside this project (a symlinked folder) — create it yourself`)
@@ -486,8 +491,10 @@ function setupStorefront(root, opts = {}) {
       } catch {}
       if (isLink) return note(step, "manual", `${rel} is a symlink — left alone`)
       if (fs.existsSync(file) && !force) {
-        const same = fs.readFileSync(file, "utf8") === content
-        return note(step, same ? "present" : "manual", same ? rel : `${rel} exists and differs — left as is (re-run with --force to replace it)`)
+        const existing = fs.readFileSync(file, "utf8")
+        const same = existing === content
+        const extra = !same && hint ? hint(existing) : null
+        return note(step, same ? "present" : "manual", same ? rel : `${rel} exists and differs — left as is (re-run with --force to replace it)${extra ? `; ${extra}` : ""}`)
       }
       if (!dryRun) {
         fs.mkdirSync(path.dirname(file), { recursive: true })
@@ -523,7 +530,11 @@ function setupStorefront(root, opts = {}) {
     if (!fs.existsSync(path.join(root, f))) throw new Error(`${f} not found — this command expects Medusa's Next.js starter layout (src/lib/config.ts exporting \`sdk\`, src/lib/data/cookies.ts and cart.ts)`)
   }
 
-  write(path.join(root, "src/lib/vonpay/actions.ts"), actionsFile(), "server actions (src/lib/vonpay/actions.ts)")
+  write(path.join(root, "src/lib/vonpay/actions.ts"), actionsFile(), "server actions (src/lib/vonpay/actions.ts)", (existing) =>
+    existing.includes("prepareVonpayOffer")
+      ? null
+      : "it has no prepareVonpayOffer (1.0.4): add `export async function prepareVonpayOffer() { return vonpay.prepareVonpayOffer() }` so a repeated return from the bank still gets the offer (package README, upsells)"
+  )
   const thumbnail = fs.existsSync(path.join(root, "src/modules/products/components/thumbnail/index.tsx")) ? "@modules/products/components/thumbnail" : null
   write(path.join(root, "src/lib/vonpay/index.tsx"), componentsFile(detectUiImport(root, pkg), thumbnail), "card step + return page (src/lib/vonpay/index.tsx)")
   const checkoutGroup = path.join(root, "src/app/[countryCode]/(checkout)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vonpay-medusa",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Vonpay payment provider for Medusa v2",
   "author": "Von Payments",
   "license": "MIT",
@@ -61,6 +61,7 @@
     "check:money": "node scripts/ci/check-money-arithmetic.mjs src && node scripts/ci/check-money-arithmetic.mjs --self-test",
     "check:release-install": "node scripts/ci/check-release-install.mjs && node scripts/ci/check-release-install.mjs --self-test",
     "check:ci-scope": "node scripts/ci/check-ci-scope.mjs && node scripts/ci/check-ci-scope.mjs --self-test",
+    "check:bridge-alert": "node scripts/ci/bridge-alert.mjs --self-test",
     "check:harness-isolation": "node scripts/ci/check-harness-isolation.mjs src apps && node scripts/ci/check-harness-isolation.mjs --self-test",
     "check:pack": "node scripts/ci/check-pack.mjs && node scripts/ci/check-pack.mjs --self-test",
     "check:pan-canary": "node scripts/ci/check-pan-canary.mjs && node scripts/ci/check-pan-canary.mjs --self-test",

package/storefront/src/context.tsx

@@ -4,7 +4,8 @@ import { type ReactNode, createContext, useContext } from "react"
 import type { VonpayStorefrontServer } from "./server"
 import { DEFAULT_UI, type VonpayUi } from "./ui"
 
-export type VonpayActions = Pick<VonpayStorefrontServer, "completeVonpayCheckout" | "refreshVonpayPayment" | "reportStuckVonpayPayment" | "startVonpayPayment">
+export type VonpayActions = Pick<VonpayStorefrontServer, "completeVonpayCheckout" | "refreshVonpayPayment" | "reportStuckVonpayPayment" | "startVonpayPayment"> &
+  Partial<Pick<VonpayStorefrontServer, "prepareVonpayOffer">>
 
 interface VonpayContextValue {
   actions: VonpayActions

package/storefront/src/csp.ts

@@ -2,7 +2,7 @@ import list from "./vora-csp.json"
 import { VORA_JS_URL, type VonpayBrowserConfig } from "./config"
 
 export const VORA_CSP_VERSION = list.version
-export const VORA_CSP_SHA384 = "sha384-iqprMTN9Eh03U8wTGDw6iSGVdot0G7Se0lYYslVuZkUZmn9BC0TOgXB+zb5TpqaP"
+export const VORA_CSP_SHA384 = "sha384-i1//4S+DUC1heRzIqlkwPggQhcxx/zzDp3RbtJrfKW721JphljXobflGiqV5VL99"
 
 export const VONPAY_DEFAULT_API_ORIGIN = "https://checkout.vonpay.com"
 

package/storefront/src/offer-pass.ts

@@ -0,0 +1,10 @@
+export function offerPassCartId(token: string): string | null {
+  const parts = token.split(".")
+  if (parts.length !== 3 || parts[0] !== "v2" || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return null
+  try {
+    const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")) as { cart_id?: unknown } | null
+    return typeof claims?.cart_id === "string" && claims.cart_id.length > 0 ? claims.cart_id : null
+  } catch {
+    return null
+  }
+}

package/storefront/src/offer-prepare.ts

@@ -0,0 +1,21 @@
+import { sleep } from "./sleep"
+
+export const OFFER_PREPARE_WAIT_MS = 3_500
+
+export function startOfferPrepare(actions: object): () => Promise<void> {
+  let prepare: unknown
+  try {
+    prepare = (actions as { prepareVonpayOffer?: unknown }).prepareVonpayOffer
+  } catch {
+    prepare = undefined
+  }
+  if (typeof prepare !== "function") return () => Promise.resolve()
+  let started: Promise<unknown>
+  try {
+    started = Promise.resolve((prepare as () => unknown)()).catch(() => undefined)
+  } catch {
+    started = Promise.resolve()
+  }
+  const done = started.then(() => undefined)
+  return () => Promise.race([done, sleep(OFFER_PREPARE_WAIT_MS)])
+}

package/storefront/src/server.ts

@@ -6,6 +6,7 @@ import { type CompletionResult, type VonpaySessionView, buyerReferenceOf, vonpay
 import { STUCK_REPORT_GLOBAL_MAX, STUCK_REPORT_WINDOW_MS, stuckReportLimiter } from "./report-limit"
 import { SAVED_CARDS_COPY, SAVED_CARD_ID, readSavedCards, type VonpayRemoveCardResult, type VonpaySavedCardsResult } from "./saved-cards"
 import { SHOPPER_IP_SECRET_MIN, SHOPPER_IP_SIG_HEADER, signShopperIp } from "./shopper-ip"
+import { offerPassCartId } from "./offer-pass"
 import { sleep } from "./sleep"
 import { withDeadline } from "./deadline"
 import { readOfferAnswer, readOutcome, readWalletSession, type VonpayOffer, type VonpayOfferOutcome, type VonpayWalletSession } from "./upsell"
@@ -29,6 +30,7 @@ export interface VonpayStorefrontServer {
   refreshVonpayPayment(): Promise<{ vpSessionId: string | null; status: string } | null>
   reportStuckVonpayPayment(): Promise<{ reference: string | null }>
   startVonpayPayment(): Promise<{ started: boolean }>
+  prepareVonpayOffer(): Promise<{ prepared: boolean }>
   listSavedCards(): Promise<VonpaySavedCardsResult>
   removeSavedCard(id: string): Promise<VonpayRemoveCardResult>
   upsellOffer(orderId: string): Promise<VonpayOffer | null>
@@ -41,6 +43,7 @@ export interface VonpayStorefrontServer {
 }
 
 export const OFFER_PASS_COOKIE = "_vonpay_offer_pass"
+export { offerPassCartId }
 const passCookieName = () => (process.env.NODE_ENV === "production" ? `__Host-${OFFER_PASS_COOKIE}` : OFFER_PASS_COOKIE)
 export const OFFER_PASS_MAX_AGE_S = 90 * 60
 export const OFFER_PASS_REQUEST_MS = 3_000
@@ -61,7 +64,7 @@ async function completeVonpayCheckout(): Promise<CompletionResult> {
 
   const headers = { ...(await getAuthHeaders()) }
 
-  const pass = await requestOfferPass(cartId, headers)
+  const pass = (await requestOfferPass(cartId, headers)) ?? (await keptOfferPass(cartId))
   if (!pass) await endUpsellOffer()
 
   let response: HttpTypes.StoreCompleteCartResponse
@@ -159,6 +162,19 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
   }
 }
 
+  async function prepareVonpayOffer(): Promise<{ prepared: boolean }> {
+    try {
+      const cartId = await getCartId()
+      if (!cartId) return { prepared: false }
+      const pass = await requestOfferPass(cartId, { ...(await getAuthHeaders()) })
+      if (pass) await setOfferPass(pass)
+      else if (!(await keptOfferPass(cartId))) await endUpsellOffer()
+      return { prepared: pass !== null }
+    } catch {
+      return { prepared: false }
+    }
+  }
+
   async function startVonpayPayment(): Promise<{ started: boolean }> {
     const cartId = await getCartId()
     if (!cartId) return { started: false }
@@ -216,6 +232,16 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
     }
   }
 
+  async function keptOfferPass(cartId: string): Promise<string | null> {
+    let token: string | undefined
+    try {
+      token = (await cookies()).get(passCookieName())?.value
+    } catch {
+      return null
+    }
+    return token && offerPassCartId(token) === cartId ? token : null
+  }
+
   async function setOfferPass(token: string): Promise<void> {
     try {
       ;(await cookies()).set(passCookieName(), token, { httpOnly: true, sameSite: "lax", secure: process.env.NODE_ENV === "production", path: "/", maxAge: OFFER_PASS_MAX_AGE_S })
@@ -363,6 +389,7 @@ async function readSavedStatus(cartId: string, headers: Record<string, string>):
     refreshVonpayPayment,
     reportStuckVonpayPayment,
     startVonpayPayment,
+    prepareVonpayOffer,
     listSavedCards,
     removeSavedCard,
     upsellOffer,

package/storefront/src/vonpay-card-payment.tsx

@@ -37,6 +37,7 @@ import {
   takeDeclineNote,
 } from "./reload-once"
 import type { SaveUnavailable } from "./vonpay-payment-view"
+import { startOfferPrepare } from "./offer-prepare"
 import { sleep } from "./sleep"
 import { useContactStore } from "./use-contact-store"
 import VonpayPaymentView from "./vonpay-payment-view"
@@ -494,10 +495,12 @@ function CardPayment({
     }
     inFlight.current = true
     setWalletNote(undefined)
-    void confirm().finally(() => {
-      inFlight.current = false
-    })
-  }, [confirm])
+    void startOfferPrepare(actions)()
+      .then(() => confirm())
+      .finally(() => {
+        inFlight.current = false
+      })
+  }, [confirm, actions])
   const afterAction = useCallback(() => {
     if (!walletTapPending.current) return
     walletTapPending.current = false
@@ -509,7 +512,7 @@ function CardPayment({
     if (action.kind === "redirect" && !inFlight.current) {
       inFlight.current = true
       setPhase("redirecting")
-      window.location.assign(action.url)
+      void startOfferPrepare(actions)().then(() => window.location.assign(action.url))
       return
     }
     askServerForWallet()
@@ -555,6 +558,7 @@ function CardPayment({
     const collection = collectionRef.current
     if (!collection) return false
     if (saveUnavailableNow.current || (saveRequiredNow.current && !termsActiveNow.current && saveTickedNow.current === false)) return false
+    const offerReady = startOfferPrepare(actions)
     setPhase("submitting")
     let result: VoraSubmitResult | undefined
     try {
@@ -577,14 +581,16 @@ function CardPayment({
         return false
       case "redirect":
         setPhase("redirecting")
+        await offerReady()
         window.location.assign(action.url)
         return true
       case "declined_ask_server":
       case "complete":
+        await offerReady()
         await confirm()
         return false
     }
-  }, [confirm])
+  }, [confirm, actions])
 
   const startNewPayment = useCallback(async () => {
     setPhase("loading")

package/storefront/src/vora-csp.json

@@ -1,8 +1,8 @@
 {
-  "version": "1.39.1",
+  "version": "1.44.1",
   "modes": {
     "test": {
-      "version": "1.39.1",
+      "version": "1.44.1",
       "mode": "test",
       "directives": {
         "script-src": [
@@ -18,9 +18,11 @@
           "https://embed.sandbox.portal.vonpay.com",
           "https://applepay.cdn-apple.com",
           "https://pay.sandbox.google.com",
+          "https://checkout.vonpay.com",
+          "https://hooks.stripe.com",
+          "'self'",
           "https://js.stripe.com",
           "https://*.js.stripe.com",
-          "https://hooks.stripe.com",
           "https://link.com",
           "https://*.link.com"
         ],
@@ -134,6 +136,36 @@
           "feature": "google-pay",
           "why": "Google Pay JS adds a <style> element for its button."
         },
+        {
+          "directive": "frame-src",
+          "source": "https://embed.sandbox.vonpay.gr4vy.app",
+          "feature": "wallet-modal",
+          "why": "The bank check for a wallet payment, in a modal on your page."
+        },
+        {
+          "directive": "frame-src",
+          "source": "https://checkout.vonpay.com",
+          "feature": "wallet-modal",
+          "why": "The page that reports the wallet bank check's result back to vora.js."
+        },
+        {
+          "directive": "frame-src",
+          "source": "https://embed.sandbox.vonpay.gr4vy.app",
+          "feature": "bank-check",
+          "why": "The card-update bank check pop-up."
+        },
+        {
+          "directive": "frame-src",
+          "source": "https://hooks.stripe.com",
+          "feature": "bank-check",
+          "why": "The same, on Stripe."
+        },
+        {
+          "directive": "frame-src",
+          "source": "'self'",
+          "feature": "bank-check",
+          "why": "Your return page."
+        },
         {
           "directive": "script-src",
           "source": "https://js.stripe.com",
@@ -200,10 +232,18 @@
           "feature": "stripe-link",
           "why": "Link artwork."
         }
+      ],
+      "ifNoUnsafeInline": [
+        {
+          "directive": "style-src",
+          "source": "'sha256-OuajJxe804doBGkJvwnBjnP1cpvNWFjHltumC6RbkcA='",
+          "feature": "default-look",
+          "why": "A one-line style element (@layer vora-defaults;) that puts the built-in default look below your own CSS layers. Without it the look still works, but your layered CSS (Tailwind v4 and similar) does not override it."
+        }
       ]
     },
     "live": {
-      "version": "1.39.1",
+      "version": "1.44.1",
       "mode": "live",
       "directives": {
         "script-src": [
@@ -219,9 +259,11 @@
           "https://embed.portal.vonpay.com",
           "https://applepay.cdn-apple.com",
           "https://pay.google.com",
+          "https://checkout.vonpay.com",
+          "https://hooks.stripe.com",
+          "'self'",
           "https://js.stripe.com",
           "https://*.js.stripe.com",
-          "https://hooks.stripe.com",
           "https://link.com",
           "https://*.link.com"
         ],
@@ -335,6 +377,36 @@
           "feature": "google-pay",
           "why": "Google Pay JS adds a <style> element for its button."
         },
+        {
+          "directive": "frame-src",
+          "source": "https://embed.vonpay.gr4vy.app",
+          "feature": "wallet-modal",
+          "why": "The bank check for a wallet payment, in a modal on your page."
+        },
+        {
+          "directive": "frame-src",
+          "source": "https://checkout.vonpay.com",
+          "feature": "wallet-modal",
+          "why": "The page that reports the wallet bank check's result back to vora.js."
+        },
+        {
+          "directive": "frame-src",
+          "source": "https://embed.vonpay.gr4vy.app",
+          "feature": "bank-check",
+          "why": "The card-update bank check pop-up."
+        },
+        {
+          "directive": "frame-src",
+          "source": "https://hooks.stripe.com",
+          "feature": "bank-check",
+          "why": "The same, on Stripe."
+        },
+        {
+          "directive": "frame-src",
+          "source": "'self'",
+          "feature": "bank-check",
+          "why": "Your return page."
+        },
         {
           "directive": "script-src",
           "source": "https://js.stripe.com",
@@ -401,6 +473,14 @@
           "feature": "stripe-link",
           "why": "Link artwork."
         }
+      ],
+      "ifNoUnsafeInline": [
+        {
+          "directive": "style-src",
+          "source": "'sha256-OuajJxe804doBGkJvwnBjnP1cpvNWFjHltumC6RbkcA='",
+          "feature": "default-look",
+          "why": "A one-line style element (@layer vora-defaults;) that puts the built-in default look below your own CSS layers. Without it the look still works, but your layered CSS (Tailwind v4 and similar) does not override it."
+        }
       ]
     }
   }