Fix proxied checkout CSRF for Merchant, Give, Invoice and Events.

Public order/pay POSTs hit ladl.link first; satellite CSRF tokens cannot bind to Link (or platform/satellite) sessions, which returned 419 and showed "Could not start checkout." Except public checkout paths and return access_code from owner-gateway Paystack init. Sync contained Paystack sheet.
2026-07-21 22:53:52 +00:00
parent 5166cd8a64
commit 97a30ee6b3
4 changed files with 493 additions and 58 deletions
@@ -47,8 +47,19 @@ class MerchantGatewayService
            throw new RuntimeException($response->json('message') ?: 'Paystack could not start checkout.');
        }

+        $accessCode = (string) ($response->json('data.access_code') ?? '');
+        $checkoutUrl = (string) $response->json('data.authorization_url');
+        if ($accessCode === '' && $checkoutUrl !== '') {
+            $path = ltrim((string) (parse_url($checkoutUrl, PHP_URL_PATH) ?: ''), '/');
+            $maybe = explode('/', $path)[0] ?? '';
+            if (preg_match('/^[A-Za-z0-9_-]{6,}$/', $maybe) === 1) {
+                $accessCode = $maybe;
+            }
+        }
+
        return [
-            'checkout_url' => (string) $response->json('data.authorization_url'),
+            'checkout_url' => $checkoutUrl,
+            'access_code' => $accessCode !== '' ? $accessCode : null,
            'reference' => (string) ($response->json('data.reference') ?: $reference),
            'provider' => PaymentGatewaySetting::PROVIDER_PAYSTACK,
        ];