Class: Www::PaymentsController

Inherits:
ApplicationController show all
Includes:
Controllers::StripeCustomerManagement
Defined in:
app/controllers/www/payments_controller.rb

Overview

Controller: payments.

Constant Summary

Constants included from Controllers::AnalyticsEvents

Controllers::AnalyticsEvents::MAX_QUEUED_EVENTS, Controllers::AnalyticsEvents::SESSION_KEY

Constants included from Controllers::ErrorRendering

Controllers::ErrorRendering::NON_CONTENT_PATH_PREFIXES

Instance Method Summary collapse

Methods inherited from ApplicationController

#account_impersonated?, #add_to_flash, #after_sign_in_path_for, #bypass_forgery_protection?, #chat_enabled?, #cloudflare_cleared?, #default_catalog, #default_url_options, #enable_turbo_frames, #find_publication, #fix_invalid_accept_header, #init_js_utils, #is_globals_call?, #layout_by_resource, #locale_store, #redirect_to, #require_employee_for_crm, #set_base_host, #set_real_ip, #set_report_errors_for, #should_render_layout?, #skip_layout_for_turbo_frame?, #stamp_impersonation_context, #tab_frame_breakout_request?, #warmlyyours_canada_ip?, #warmlyyours_ip?, #y

Methods included from Controllers::ReturnPathHandling

#check_for_return_path, #redirect_to_return_path_or_default

Methods included from Controllers::AnalyticsEvents

#consume_queued_analytics_events, #registration_lead_type, #track_event

Methods included from Controllers::DeviceDetection

#device_detector, #is_ie?

Methods included from Controllers::SubdomainDetection

#is_crm_request?, #is_www_request?, #json_request?

Methods included from Controllers::TurboSafeRedirect

#redirect_to

Methods included from Controllers::TrackingDetection

#bot_request?, #gdpr_country?, #gdpr_country_data, #prevent_bots, #set_tracking_cookie, #track_visitor?

Methods included from Controllers::AcceleratedFileSending

#send_file_accelerated, #send_upload_accelerated

Methods included from Controllers::ErrorRendering

#excp_string, #mail_to_for_error_reporting, #render_400, #render_404, #render_406, #render_410, #render_500, #render_invalid_authenticity_token, #render_ip_spoof_error, #render_unpermitted_parameters, #safe_referer_or_fallback

Methods included from Controllers::TurnstileVerification

#load_turnstile_script_tag, #turnstile_lazy_widget, #turnstile_script_tag, #turnstile_widget, #validate_turnstile!

Methods included from Controllers::CloudflareCaching

edge_cached, #edge_cached_action?, #reset_cloudflare_cache, #set_cloudflare_cache, #skip_edge_cache!, #skip_session

Methods included from Controllers::Webpackable

#preload_webpack_fonts, #webpack_css_include, #webpack_css_url, #webpack_js_include, #wpd_is_running?

Methods included from Controllers::Localizable

#cloudflare_country_locale, #determine_request_locale, #geocoder_locale, #guest_user_locale_check, #locale_optional_www_auth_path?, #param_locale, #set_locale, #set_request_locale, #skip_localization?, #warmlyyours_ip_locale

Methods included from Controllers::Authenticable

#access_denied, #authenticate_account, #authenticate_account!, #authenticate_account_from_login_token!, #check_is_a_manager, #check_is_a_sales_manager, #check_is_an_admin, #check_is_an_employee, #check_party, #clear_mismatched_guest_user, #create_guest_user, #credentials?, #current_or_guest_user, #current_or_guest_user_id_read_only, #current_user, #devise_mapping, #fully_logged_in?, #generate_bot_id, #guest_user, #identifiable?, #init_current_user, #initialize_guest, #load_context_user, #logging_in, #resource, #resource_name, #restrict_access_for_non_employees, #scrubbed_request_path, #user_object, #warn_on_session_guest_id_leak

Methods included from UrlsHelper

#catalog_breadcrumb_links, #catalog_link, #catalog_link_for_product_line, #catalog_link_for_sku, #cms_link, #delocalized_path, #path_to_sales_product_sku, #path_to_sales_product_sku_for_product_line, #path_to_sales_product_sku_for_product_line_slug, #product_line_from_catalog_link, #protocol_neutral_url, #sanitize_external_url, #valid_external_url?

Instance Method Details

#authorize_paypal_order ⇒ void

This method returns an undefined value.

Authorizes the created PayPal order, records the payment/authorization,
and stores a vault token on the customer when PayPal returned one.



192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
 
# File 'app/controllers/www/payments_controller.rb', line 192

def authorize_paypal_order
  paypal_order_id = params[:paypal_order_id]

  auth_response = Payment::Apis::Paypal.authorize_order(paypal_order_id)

  unless auth_response['_http_success']
    error_issue = auth_response.dig('details', 0, 'issue')
    if error_issue == 'INSTRUMENT_DECLINED'
      render json: { error: 'INSTRUMENT_DECLINED' }, status: :unprocessable_content
      return
    end
    render json: { error: auth_response['message'] || 'Unable to authorize PayPal order' }, status: :unprocessable_content
    return
  end

  purchase_unit = auth_response.dig('purchase_units', 0)
  authorization = purchase_unit&.dig('payments', 'authorizations', 0)
  payer = auth_response['payer']

  unless authorization
    render json: { error: 'No authorization found in PayPal response' }, status: :unprocessable_content
    return
  end

  seller_protection = authorization.dig('seller_protection')
  funding_source = params[:funding_source]

  vault_data = auth_response.dig('payment_source', 'paypal', 'attributes', 'vault') ||
               auth_response.dig('payment_source', 'paypal', 'attribute', 'vault')
  store_paypal_vault_on_customer(vault_data, payer) if vault_data&.dig('id').present?

  pp_params = {
    'paypal_transaction_id' => authorization['id'],
    'category' => 'PayPal',
    'amount' => @order.balance,
    'currency' => @order.currency,
    'authorization_type' => 'paypal',
    'reference' => payer&.dig('email_address') || paypal_order_id,
    'email' => payer&.dig('email_address'),
    'remote_ip_address' => request.remote_ip,
    'paypal_metadata' => {
      'payer_id' => payer&.dig('payer_id'),
      'payer_name' => [payer&.dig('name', 'given_name'), payer&.dig('name', 'surname')].compact.join(' ').presence,
      'funding_source' => funding_source,
      'seller_protection' => seller_protection&.dig('status'),
      'seller_protection_dispute_categories' => seller_protection&.dig('dispute_categories'),
      'paypal_order_id' => paypal_order_id,
      'vault_id' => vault_data&.dig('id'),
      'vault_customer_id' => vault_data&.dig('customer', 'id')
    }.compact
  }

  res = Payment::OrderProcessor.new(@order, pp_params, , request, true).process
  if %w[fully_authorized partially_authorized].include?(res.result)
    if res.result == 'fully_authorized'
      @order.reload.send_online_order_confirmation
      @order.support_cases.services.first.create_initial_service_activity if @order.is_smartfit_service?
      @order.create_smartinstall_ticket if @order.is_smartinstall_service?
      @order.create_smartfix_ticket if @order.is_smartfix_service?
      @order.create_smartguide_ticket if @order.is_smartguide_service?
      SupportMailer.smart_service_requested_notification(@order&.support_cases&.services&.first).deliver_later if @order.belongs_to_smartservice_group?
      OrdersMailer.online_order_notification(@order).deliver_later
    end

    render json: { redirect_url: confirmation_payments_path(order_id: @order.encrypted_id) }
  else
    render json: { error: res.error || 'Unable to process PayPal payment' }, status: :unprocessable_content
  end
end

#complete_paypal_vault ⇒ void

This method returns an undefined value.

Completes a PayPal vault setup after the customer approves it, storing
the vault token on the customer.



128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
 
# File 'app/controllers/www/payments_controller.rb', line 128

def complete_paypal_vault
  setup_token_id = params[:approval_session_id] || params[:token_id]

  unless setup_token_id.present?
    flash[:error] = 'PayPal vault approval was missing. Please try again.'
    redirect_to confirmation_payments_path(order_id: @order.encrypted_id) and return
  end

  response = Payment::Apis::Paypal.create_vault_payment_token(setup_token_id)

  if response['_http_success'] && response['id'].present?
    vault_id = response['id']
    customer_id = response.dig('customer', 'id')

    customer = @order.customer
    if customer.is_a?(Customer)
      customer.update(paypal_vault_token_id: vault_id, paypal_vault_customer_id: customer_id)
      Rails.logger.info("[PayPal Vault] Stored vault #{vault_id} for customer #{customer.id}")
    end
  else
    Rails.logger.error("[PayPal Vault] Payment token creation failed: status=#{response['_http_status']}, message=#{response['message']}")
    flash[:error] = 'Unable to save your PayPal account. Please try again.'
  end

  redirect_to confirmation_payments_path(order_id: @order.encrypted_id)
end

#confirmation ⇒ void

This method returns an undefined value.

Displays the order confirmation page, after verifying the requester has
legitimate access (encrypted link or owning session).



70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'app/controllers/www/payments_controller.rb', line 70

def confirmation
  # Security: User must have legitimate access to view this order
  #
  # Access is granted if EITHER:
  # 1. Order ID was encrypted (payment link from email - encryption IS the auth)
  # 2. Order belongs to current user's session (checkout flow)
  #
  # The is_checkout param is NOT trusted for security - it's just for analytics/UX
  #
  unless @order_id_was_encrypted || order_belongs_to_current_user?
    Rails.logger.warn "[SECURITY] Unauthorized order confirmation access: order_id=#{params[:order_id]}, user=#{@context_user&.id}, encrypted=#{@order_id_was_encrypted}"
    flash[:error] = "You don't have permission to view this order."
    redirect_to root_path and return
  end

  @order_track = @order # for google analytics tracking

  return if @order

  redirect_to my_cart_path
end

#create ⇒ void

This method returns an undefined value.

Processes the submitted payment for an invoice, invoiced order, or
regular order.



49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'app/controllers/www/payments_controller.rb', line 49

def create
  if @invoice.present?
    process_invoice_payment(params[:payment])
  elsif @order.present?
    if @order.invoiced?
      # This is an order that has one or more invoices pending payment. It's different than a regular order
      # because this one is in invoiced state and needs special treatment. Only credit card direct purchase is allowed. No pre-authorizations.
      process_order_invoiced_payment(params[:payment])
    else
      # A payment can come from the standalone payment page, or checkout page. In WWW, since this is a WWW controller
      is_checkout = params[:checkout].to_b
      is_www = true
      process_payment(params[:payment], is_checkout, is_www)
    end
  end
end

#create_payment_intent ⇒ void

This method returns an undefined value.

Creates a Stripe payment intent for the order or invoice and returns its
client secret as JSON.



266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
 
# File 'app/controllers/www/payments_controller.rb', line 266

def create_payment_intent
  resource = @order || @invoice
  return render json: { error: 'Order or invoice not found' }, status: :not_found unless resource

  customer = resource.customer
  currency = resource.currency
  amount_cents = if @invoice.present?
                   (@invoice.balance * 100).to_i
                 elsif @order.present? && @order.invoiced?
                   amount = if params[:amount].present?
                              begin
                                BigDecimal(params[:amount])
                              rescue ArgumentError
                                return render json: { error: 'Invalid amount' }, status: :unprocessable_content
                              end
                            else
                              @order.invoice_balance
                            end
                   return render json: { error: 'Amount must be between $0.01 and the invoice balance' }, status: :unprocessable_content if amount <= 0 || amount > @order.invoice_balance

                   (amount * 100).to_i
                 else
                   (@order.balance * 100).to_i
                 end

  capture_method = @order.present? && !@order.invoiced? ? 'manual' : 'automatic'

  ensure_stripe_customer_id!(customer, currency) if customer.present? && capture_method == 'manual'

  description = if @invoice.present?
                  @invoice.reference_number
                elsif @order.present? && @order.invoiced?
                  refs = @order.invoices.unpaid.pluck(:reference_number)
                  refs.any? ? refs.join(' / ') : "Order #{@order.reference_number}"
                elsif @order.present?
                  @order.reference_number.present? ? "Order #{@order.reference_number}" : "Order ID #{@order.id}"
                end

  ref = @order&.reference_number || @invoice&.reference_number
  statement_descriptor = ref.present? ? "WarmlyYours #{ref}".truncate(22) : nil

  pi_params = {
    amount_cents: amount_cents,
    currency: currency,
    capture_method: capture_method,
    allow_redirects: 'always',
    description: description,
    statement_descriptor: statement_descriptor,
    metadata: {
      order_id: @order&.id,
      invoice_id: @invoice&.id,
      customer_id: customer&.id
    }
  }
  pi_params[:customer_id] = customer.stripe_customer_id if customer&.stripe_customer_id.present?

  # Only attach for off_session reuse when the customer explicitly opts in via
  # the "Save my card" checkbox (the JS posts `save_card` alongside the amount).
  # Setting setup_future_usage unconditionally also requires Stripe Elements to
  # be initialized with the same flag — without that match Stripe.js rejects
  # the confirm with a 400 (setup_future_usage mismatch) and the customer sees
  # "Payment failed" with no last_payment_error on the PI.
  pi_params[:setup_future_usage] = 'off_session' if capture_method == 'manual' && pi_params[:customer_id].present? && params[:save_card].to_b

  begin
    pi = Payment::Apis::Stripe.create_payment_intent(**pi_params)
  rescue ::Stripe::StripeError => e
    raise unless pi_params[:setup_future_usage].present? && e.message.include?('not eligible')

    pi_params.delete(:setup_future_usage)
    pi = Payment::Apis::Stripe.create_payment_intent(**pi_params)
  end
  render json: { client_secret: pi.client_secret, payment_intent_id: pi.id }
rescue ::Stripe::StripeError => e
  render json: { error: e.message }, status: :unprocessable_content
rescue StandardError => e
  bt = e.backtrace&.first(8)&.join("\n")
  Rails.logger.error("[create_payment_intent] #{e.class}: #{e.message}\n#{bt}")
  detail = Rails.env.local? ? "#{e.message}\n#{bt}" : e.message
  render json: { error: "Payment setup failed: #{detail}" }, status: :internal_server_error
end

#create_paypal_order ⇒ void

This method returns an undefined value.

Creates a PayPal order for the order's balance and returns its id as JSON.



158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
 
# File 'app/controllers/www/payments_controller.rb', line 158

def create_paypal_order
  order_params = {
    amount: @order.balance,
    currency: @order.currency,
    intent: 'AUTHORIZE',
    description: "Order #{@order.reference_number}",
    shipping: paypal_shipping_address,
    metadata: { order_id: @order.id, invoice_id: @order.reference_number }
  }

  if @order.balance == @order.total
    order_params.merge!(
      subtotal: @order.subtotal,
      shipping_amount: @order.discounted_shipping_total,
      tax_amount: @order.tax_total,
      line_items: @order.line_items.non_shipping.map do |li|
        { name: li.name, sku: li.sku, quantity: li.quantity, amount: li.discounted_price }
      end
    )
  end

  response = Payment::Apis::Paypal.create_order(**order_params)

  if response['id'].present?
    render json: { paypal_order_id: response['id'] }
  else
    render json: { error: response['message'] || 'Unable to create PayPal order' }, status: :unprocessable_content
  end
end

#new ⇒ void

This method returns an undefined value.

Renders the payment form: invoice/credit-memo receipt payment,
invoiced-order payment, or regular checkout/standalone order payment.



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'app/controllers/www/payments_controller.rb', line 15

def new
  if @invoice.present?
    # This is a receipt payment that contains one or multiple invoices or credit memos.
    @payment = Payment.new(customer: @invoice.customer)
    @payment_options = @invoice.online_payment_options
    render :new_invoice
  elsif @order.present? && @order.invoiced?
    # This is an order that has one or more invoices pending payment. It's different than a regular order
    # because this one is in invoiced state and needs special treatment. Only credit card direct purchase is allowed. No pre-authorizations.
    @payment_amount = params[:payment_amount].present? ? BigDecimal(params[:payment_amount]) : @order.invoice_balance

    # Validate payment amount
    if @payment_amount <= 0 || @payment_amount > @order.invoice_balance
      flash.now[:error] =
        "Payment amount must be between #{ActionController::Base.helpers.number_to_currency(0.01, unit: @order.currency_symbol)} and #{ActionController::Base.helpers.number_to_currency(@order.invoice_balance, unit: @order.currency_symbol)}"
      @payment_amount = @order.invoice_balance
    end

    @payment = Payment.new(amount: @payment_amount)
    @receipt = Receipt.new
    @payment_options = @order.payment_options('online_order_invoices')
    render :new_order_invoiced
  else
    # This is a regular online order. Can be a checkout or standalone payment page.
    @payment_options = @order.payment_options('online_order_payment')
    @payment = @order.payments.build(category: 'Credit Card')
    render :new
  end
end

#receipt_confirmation ⇒ void

This method returns an undefined value.

Displays the receipt confirmation page.



95
96
97
 
# File 'app/controllers/www/payments_controller.rb', line 95

def receipt_confirmation
  @receipt = Receipt.find(params[:receipt_id])
end

#save_paypal_vault ⇒ void

This method returns an undefined value.

Starts a PayPal vault (save-for-later) setup and redirects to PayPal's
approval flow.



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
 
# File 'app/controllers/www/payments_controller.rb', line 103

def save_paypal_vault
  return_url = complete_paypal_vault_payments_url(order_id: @order.encrypted_id)
  cancel_url = confirmation_payments_url(order_id: @order.encrypted_id)

  response = Payment::Apis::Paypal.create_vault_setup_token(return_url: return_url, cancel_url: cancel_url)

  if response['_http_success'] && response['id'].present?
    approve_link = response.dig('links')&.find { |l| l['rel'] == 'approve' }&.dig('href')
    if approve_link.present?
      redirect_to approve_link, allow_other_host: true
    else
      flash[:error] = 'Unable to start PayPal vault setup.'
      redirect_to confirmation_payments_path(order_id: @order.encrypted_id)
    end
  else
    Rails.logger.error("[PayPal Vault] Setup token failed: status=#{response['_http_status']}, message=#{response['message']}")
    flash[:error] = 'Unable to save PayPal. Please try again later.'
    redirect_to confirmation_payments_path(order_id: @order.encrypted_id)
  end
end