Restore Paystack Inline in-page sheet/modal; stop separate-browser checkout.

Pass access_code through pay responses and launch PaystackPop from the shared sheet instead of window.open.
2026-07-21 19:12:24 +00:00
parent 42257ab444
commit 86d2dcbf0b
9 changed files with 280 additions and 96 deletions
@@ -164,6 +164,9 @@ Alpine.data('miniPaymentLanding', (config = {}) => ({
    errorMsg: config.errorMsg ?? '',
    showSheet: false,
    checkoutUrl: '',
+    accessCode: '',
+    publicKey: '',
+    returnUrl: '',
    paymentSheetStyle: '',
    sheetBleedStyle: '',

@@ -218,7 +221,10 @@ Alpine.data('miniPaymentLanding', (config = {}) => ({
        this.errorMsg = '';
        this.loading = true;
        this.checkoutUrl = '';
-        // Show sheet/modal immediately; Paystack opens from the in-sheet Continue CTA.
+        this.accessCode = '';
+        this.publicKey = '';
+        this.returnUrl = '';
+        // Show sheet/modal immediately; Paystack Inline opens in-page from the sheet.
        this.showSheet = true;

        const controller = new AbortController();
@@ -245,7 +251,7 @@ Alpine.data('miniPaymentLanding', (config = {}) => ({
                this.errorMsg = apiError || (`Could not start payment (${res.status}). Please try again.`);
                return;
            }
-            if (!data.checkout_url) {
+            if (!data.checkout_url && !data.access_code) {
                this.showSheet = false;
                this.errorMsg = 'Could not start payment. Please try again.';
                return;
@@ -255,7 +261,10 @@ Alpine.data('miniPaymentLanding', (config = {}) => ({
            // (cross-origin iframe is blank / looks like "Pay did nothing").
            const useSheet = data.provider !== 'mtn_momo';
            if (useSheet) {
-                this.checkoutUrl = data.checkout_url;
+                this.checkoutUrl = data.checkout_url || '';
+                this.accessCode = data.access_code || '';
+                this.publicKey = data.public_key || '';
+                this.returnUrl = data.callback_url || '';
            } else {
                this.showSheet = false;
                window.location.assign(data.checkout_url);
@@ -56,6 +56,9 @@
                          }

                          this.checkoutUrl = data.checkout_url;
+            this.accessCode = data.access_code || '';
+            this.publicKey = data.public_key || '';
+            this.returnUrl = data.callback_url || '';
                          this.showSheet = true;
                          this.loading = false;
                      } catch (error) {
@@ -6,13 +6,16 @@
      - operator: signed-in staff flows such as wallet top-up

    Optional overrides: $sheetTitle, $sheetSubtitle, $sheetFooter, $sheetAria, $iframeTitle
-    Requires Alpine ancestor with: showSheet (bool), checkoutUrl (string).
+    Requires Alpine ancestor with:
+      - showSheet (bool)
+      - checkoutUrl (string) — authorization / waiting URL
+      - accessCode (string, optional) — Paystack initialize access_code for Inline
+      - publicKey (string, optional) — unused by resumeTransaction; kept for callers
+      - returnUrl (string, optional) — where to go after Inline onSuccess (?reference=)

-    Paystack (checkout.paystack.com) sends X-Frame-Options: SAMEORIGIN and cannot be
-    embedded. Same-origin URLs (e.g. MoMo waiting pages) still load in an iframe.
-    External checkouts stay in this chrome with a Continue CTA that opens Paystack
-    in a named window (user gesture — not blocked). Auto-popups are intentionally
-    avoided so the sheet/modal always remains visibly on screen.
+    Paystack checkout.paystack.com cannot be iframed (X-Frame-Options: SAMEORIGIN).
+    Primary path: Paystack Inline JS (PaystackPop.resumeTransaction) — in-page overlay,
+    not a separate browser tab. Same-origin URLs (e.g. MoMo waiting) still use iframe.
 --}}
@php
    $audience = $audience ?? 'buyer';
@@ -43,8 +46,9 @@
 (function () {
    if (window.LadillPayCheckout) return;

-    var PENDING_NAME = 'ladill_pay_checkout';
-    var pendingWindow = null;
+    var INLINE_SRC = 'https://js.paystack.co/v2/inline.js';
+    var inlineLoading = null;
+    var activePopup = null;

    function isFrameable(url) {
        if (!url) return false;
@@ -55,46 +59,80 @@
        }
    }

-    function writePendingPlaceholder(win) {
-        if (!win) return;
+    function isPaystackCheckoutUrl(url) {
+        if (!url) return false;
        try {
-            win.document.open();
-            win.document.write('<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Payment</title></head><body style="margin:0;min-height:100vh;display:grid;place-items:center;font-family:system-ui,sans-serif;background:#f8fafc;color:#475569"><p style="font-size:0.95rem">Opening secure checkout…</p></body></html>');
-            win.document.close();
-        } catch (e) {}
-    }
-
-    // Kept for callers; no longer opens a window on Pay click (that stole focus
-    // from the sheet/modal). Prefer opening from the in-sheet Continue CTA.
-    function prepare() {
-        return null;
-    }
-
-    function cancel() {
-        if (pendingWindow && !pendingWindow.closed) {
-            try { pendingWindow.close(); } catch (e) {}
-        }
-        pendingWindow = null;
-    }
-
-    function openCheckout(url) {
-        if (!url) return null;
-        try {
-            if (pendingWindow && !pendingWindow.closed) {
-                pendingWindow.location = url;
-                var win = pendingWindow;
-                pendingWindow = null;
-                return win;
-            }
-            pendingWindow = null;
-            // Named window (no noopener) so payment-return can redirect window.opener.
-            return window.open(url, PENDING_NAME, 'width=480,height=720');
+            var host = new URL(url, window.location.href).hostname.toLowerCase();
+            return host === 'checkout.paystack.com' || host.endsWith('.paystack.com');
        } catch (e) {
-            pendingWindow = null;
-            return null;
+            return false;
        }
    }

+    function accessCodeFromUrl(url) {
+        if (!url || !isPaystackCheckoutUrl(url)) return '';
+        try {
+            var path = new URL(url, window.location.href).pathname.replace(/^\/+/, '');
+            var code = path.split('/')[0] || '';
+            return /^[A-Za-z0-9_-]{6,}$/.test(code) ? code : '';
+        } catch (e) {
+            return '';
+        }
+    }
+
+    function resolveAccessCode(accessCode, checkoutUrl) {
+        var code = (accessCode || '').toString().trim();
+        if (code) return code;
+        return accessCodeFromUrl(checkoutUrl);
+    }
+
+    function loadInlineJs() {
+        if (window.PaystackPop) {
+            return Promise.resolve(window.PaystackPop);
+        }
+        if (inlineLoading) return inlineLoading;
+        inlineLoading = new Promise(function (resolve, reject) {
+            var existing = document.querySelector('script[data-ladill-paystack-inline]');
+            if (existing) {
+                existing.addEventListener('load', function () { resolve(window.PaystackPop); });
+                existing.addEventListener('error', function () { reject(new Error('Paystack script failed')); });
+                return;
+            }
+            var script = document.createElement('script');
+            script.src = INLINE_SRC;
+            script.async = true;
+            script.dataset.ladillPaystackInline = '1';
+            script.onload = function () { resolve(window.PaystackPop); };
+            script.onerror = function () {
+                inlineLoading = null;
+                reject(new Error('Paystack script failed'));
+            };
+            document.head.appendChild(script);
+        });
+        return inlineLoading;
+    }
+
+    function buildReturnUrl(returnUrl, reference) {
+        if (!returnUrl || !reference) return '';
+        try {
+            var u = new URL(returnUrl, window.location.href);
+            u.searchParams.set('reference', reference);
+            return u.toString();
+        } catch (e) {
+            var join = returnUrl.indexOf('?') >= 0 ? '&' : '?';
+            return returnUrl + join + 'reference=' + encodeURIComponent(reference);
+        }
+    }
+
+    function cancelInline() {
+        try {
+            if (activePopup && typeof activePopup.cancelTransaction === 'function') {
+                activePopup.cancelTransaction();
+            }
+        } catch (e) {}
+        activePopup = null;
+    }
+
    function ensureStore() {
        if (!window.Alpine || typeof window.Alpine.store !== 'function') return null;
        if (window.Alpine.store('ladillPayCheckout')) {
@@ -102,41 +140,109 @@
        }
        window.Alpine.store('ladillPayCheckout', {
            frameable: false,
-            popupBlocked: false,
+            inline: false,
            ready: false,
+            launching: false,
+            error: '',
+            _launchToken: 0,
+            _activeCode: '',
            reset() {
                this.frameable = false;
-                this.popupBlocked = false;
+                this.inline = false;
                this.ready = false;
+                this.launching = false;
+                this.error = '';
+                this._activeCode = '';
+                cancelInline();
            },
-            sync(show, url) {
+            sync(show, url, accessCode, returnUrl) {
                if (!show) {
+                    this._launchToken += 1;
                    this.reset();
                    return;
                }
-                this.ready = !!url;
-                if (!url) {
+                this.ready = !!(url || accessCode);
+                if (!url && !accessCode) {
                    this.frameable = false;
-                    this.popupBlocked = false;
+                    this.inline = false;
+                    this.launching = false;
+                    this._activeCode = '';
                    return;
                }
-                this.frameable = isFrameable(url);
-                // Never auto-open an external popup here — the sheet/modal must stay
-                // visible. External checkouts use the Continue CTA (user gesture).
-                this.popupBlocked = !this.frameable;
-            },
-            continueTo(url) {
-                if (!url) return;
                if (isFrameable(url)) {
                    this.frameable = true;
-                    this.popupBlocked = false;
+                    this.inline = false;
+                    this.launching = false;
+                    this._activeCode = '';
+                    cancelInline();
                    return;
                }
-                var popup = openCheckout(url);
-                this.popupBlocked = !(popup && !popup.closed);
-                if (this.popupBlocked) {
-                    window.location.assign(url);
+                var code = resolveAccessCode(accessCode, url);
+                if (code) {
+                    this.frameable = false;
+                    this.inline = true;
+                    if (this._activeCode === code && (this.launching || activePopup)) {
+                        return;
+                    }
+                    this.launchInline(code, returnUrl);
+                    return;
                }
+                // Non-Paystack external URL without access_code — cannot embed.
+                this.frameable = false;
+                this.inline = false;
+                this.launching = false;
+                this._activeCode = '';
+                this.error = 'Secure checkout could not be opened in-page. Please try again.';
+            },
+            launchInline(accessCode, returnUrl) {
+                var store = this;
+                var token = ++this._launchToken;
+                this._activeCode = accessCode;
+                this.launching = true;
+                this.error = '';
+                loadInlineJs().then(function (PaystackPop) {
+                    if (token !== store._launchToken) return;
+                    if (!PaystackPop) throw new Error('Paystack unavailable');
+                    cancelInline();
+                    var popup = new PaystackPop();
+                    activePopup = popup;
+                    popup.resumeTransaction(accessCode, {
+                        onLoad: function () {
+                            if (token !== store._launchToken) return;
+                            store.launching = false;
+                        },
+                        onSuccess: function (transaction) {
+                            if (token !== store._launchToken) return;
+                            store.launching = false;
+                            var reference = (transaction && (transaction.reference || transaction.trxref)) || '';
+                            var dest = buildReturnUrl(returnUrl, reference);
+                            if (dest) {
+                                window.location.assign(dest);
+                                return;
+                            }
+                            // Fallback: reload so server can reconcile via webhook.
+                            window.location.reload();
+                        },
+                        onCancel: function () {
+                            if (token !== store._launchToken) return;
+                            store.launching = false;
+                            store._activeCode = '';
+                            activePopup = null;
+                            window.dispatchEvent(new CustomEvent('ladill-pay-cancelled'));
+                        },
+                        onError: function (err) {
+                            if (token !== store._launchToken) return;
+                            store.launching = false;
+                            store._activeCode = '';
+                            store.error = (err && err.message) ? String(err.message) : 'Could not open secure payment.';
+                        },
+                    });
+                }).catch(function (err) {
+                    if (token !== store._launchToken) return;
+                    store.launching = false;
+                    store._activeCode = '';
+                    store.error = (err && err.message) ? String(err.message) : 'Could not load payment script.';
+                });
            },
        });
        return window.Alpine.store('ladillPayCheckout');
@@ -153,9 +259,16 @@

    window.LadillPayCheckout = {
        isFrameable: isFrameable,
-        prepare: prepare,
-        cancel: cancel,
-        open: openCheckout,
+        isPaystackCheckoutUrl: isPaystackCheckoutUrl,
+        accessCodeFromUrl: accessCodeFromUrl,
+        resolveAccessCode: resolveAccessCode,
+        prepare: function () { return null; },
+        cancel: function () {
+            cancelInline();
+            var store = ensureStore();
+            if (store) store.reset();
+        },
+        open: function () { return null; },
        ensureStore: ensureStore,
    };
 })();
@@ -172,10 +285,16 @@
        }
        const store = $store.ladillPayCheckout;
        if (store) {
-            store.sync(showSheet, checkoutUrl);
+            store.sync(
+                showSheet,
+                typeof checkoutUrl !== 'undefined' ? checkoutUrl : '',
+                typeof accessCode !== 'undefined' ? accessCode : '',
+                typeof returnUrl !== 'undefined' ? returnUrl : ''
+            );
        }
     "
     @keydown.escape.window="if (showSheet) showSheet = false"
+     @ladill-pay-cancelled.window="showSheet = false"
     class="fixed inset-0 z-[9999] flex items-end justify-center md:items-center md:p-6"
     role="dialog"
     aria-modal="true"
@@ -191,11 +310,10 @@
         x-transition:leave="transition-opacity duration-200"
         x-transition:leave-start="opacity-100"
         x-transition:leave-end="opacity-0"
-         @click="showSheet = false">
+         @click="showSheet = false; window.LadillPayCheckout?.cancel?.()">
    </div>

-    {{-- One panel: bottom sheet (mobile) + centered modal (desktop). Avoid Tailwind
-         `hidden` + Alpine x-show which can leave the desktop panel stuck invisible. --}}
+    {{-- One panel: bottom sheet (mobile) + centered modal (desktop). --}}
    <div data-ladill-pay-panel
         class="relative flex w-full flex-col overflow-hidden rounded-t-2xl bg-white shadow-2xl md:max-w-lg md:rounded-2xl"
         style="height: min(90dvh, 720px); max-height: 90dvh; padding-bottom: env(safe-area-inset-bottom, 0px)"
@@ -220,7 +338,7 @@
                <button type="button"
                        x-ref="checkoutClose"
                        x-init="$watch('showSheet', value => { if (value) { $nextTick(() => $refs.checkoutClose?.focus()) } })"
-                        @click="showSheet = false"
+                        @click="showSheet = false; window.LadillPayCheckout?.cancel?.()"
                        class="shrink-0 rounded-full p-1.5 text-slate-400 transition hover:bg-slate-100 hover:text-slate-700"
                        aria-label="Close">
                    <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" aria-hidden="true">
@@ -238,35 +356,45 @@
                    title="{{ $iframeTitle }}"></iframe>

            <div x-show="!$store.ladillPayCheckout || !$store.ladillPayCheckout.frameable"
-                 class="flex min-h-[60dvh] flex-col items-center justify-center gap-4 px-6 py-10 text-center md:min-h-[28rem] md:px-8 md:py-12">
+                 class="flex min-h-[60dvh] flex-col items-center justify-center gap-4 px-6 py-10 text-center md:min-h-[28rem] md:px-8 md:py-12"
+                 data-ladill-pay-inline-status>
                <div class="flex h-12 w-12 items-center justify-center rounded-full bg-indigo-50 text-indigo-600" aria-hidden="true">
-                    <svg x-show="!checkoutUrl" class="h-6 w-6 animate-spin" fill="none" viewBox="0 0 24 24">
+                    <svg x-show="!$store.ladillPayCheckout || $store.ladillPayCheckout.launching || !checkoutUrl && !(typeof accessCode !== 'undefined' && accessCode)"
+                         class="h-6 w-6 animate-spin" fill="none" viewBox="0 0 24 24">
                        <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
                        <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path>
                    </svg>
-                    <svg x-show="checkoutUrl" class="h-6 w-6" fill="none" viewBox="0 0 24 24" stroke-width="1.75" stroke="currentColor">
+                    <svg x-show="$store.ladillPayCheckout && $store.ladillPayCheckout.inline && !$store.ladillPayCheckout.launching && !$store.ladillPayCheckout.error"
+                         class="h-6 w-6" fill="none" viewBox="0 0 24 24" stroke-width="1.75" stroke="currentColor">
                        <path stroke-linecap="round" stroke-linejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25Z"/>
                    </svg>
+                    <svg x-show="$store.ladillPayCheckout && $store.ladillPayCheckout.error"
+                         class="h-6 w-6 text-red-500" fill="none" viewBox="0 0 24 24" stroke-width="1.75" stroke="currentColor">
+                        <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m9-.75a9 9 0 1 1-18 0 9 9 0 0 1 18 0Zm-9 3.75h.008v.008H12v-.008Z"/>
+                    </svg>
                </div>
                <div class="max-w-xs space-y-1 md:max-w-sm">
                    <p class="text-sm font-semibold text-slate-800"
-                       x-text="!checkoutUrl
-                          ? 'Starting secure checkout…'
-                          : 'Continue to Paystack to pay'"></p>
-                    <p class="text-xs leading-snug text-slate-500">
-                        <span x-show="!checkoutUrl">Please wait while we prepare your payment.</span>
-                        <span x-show="checkoutUrl">A secure Paystack window will open. Keep this page open until you finish.</span>
-                    </p>
+                       data-ladill-pay-status-title
+                       x-text="$store.ladillPayCheckout && $store.ladillPayCheckout.error
+                          ? 'Checkout unavailable'
+                          : ($store.ladillPayCheckout && $store.ladillPayCheckout.inline && !$store.ladillPayCheckout.launching
+                              ? 'Complete payment in the Paystack window'
+                              : 'Starting secure checkout…')"></p>
+                    <p class="text-xs leading-snug text-slate-500"
+                       x-text="$store.ladillPayCheckout && $store.ladillPayCheckout.error
+                          ? $store.ladillPayCheckout.error
+                          : 'Paystack opens on this page — not in a separate browser.'"></p>
                </div>
                <button type="button"
-                        data-ladill-pay-continue
-                        x-show="checkoutUrl"
-                        @click="$store.ladillPayCheckout.continueTo(checkoutUrl)"
+                        data-ladill-pay-retry
+                        x-show="$store.ladillPayCheckout && $store.ladillPayCheckout.error"
+                        @click="$store.ladillPayCheckout.sync(true, typeof checkoutUrl !== 'undefined' ? checkoutUrl : '', typeof accessCode !== 'undefined' ? accessCode : '', typeof returnUrl !== 'undefined' ? returnUrl : '')"
                        class="inline-flex w-full max-w-xs items-center justify-center rounded-xl bg-indigo-600 px-4 py-3 text-sm font-semibold text-white hover:bg-indigo-700">
-                    Continue to Paystack
+                    Try again
                </button>
                <button type="button"
-                        @click="showSheet = false"
+                        @click="showSheet = false; window.LadillPayCheckout?.cancel?.()"
                        class="text-xs font-medium text-slate-500 hover:text-slate-700">
                    Cancel
                </button>
@@ -338,6 +338,9 @@
    errorMsg: '',
    showSheet: false,
    checkoutUrl: '',
+    accessCode: '',
+    publicKey: '',
+    returnUrl: '',
    async give() {
        if (!this.amount || parseFloat(this.amount) <= 0) { this.errorMsg = 'Enter a valid amount.'; return; }
        if (!this.name.trim()) { this.errorMsg = 'Enter your name.'; return; }
@@ -363,6 +366,9 @@
                window.LadillPayCheckout?.cancel?.(); window.location.href = data.checkout_url;
            } else {
                this.checkoutUrl = data.checkout_url;
+            this.accessCode = data.access_code || '';
+            this.publicKey = data.public_key || '';
+            this.returnUrl = data.callback_url || '';
                this.showSheet   = true;
                this.loading     = false;
            }
@@ -675,7 +681,10 @@
            if (data.provider === 'mtn_momo') {
                window.LadillPayCheckout?.cancel?.(); window.location.href = data.checkout_url;
            } else {
-                this.checkoutUrl = data.checkout_url; this.showSheet = true; this.loading = false;
+                this.checkoutUrl = data.checkout_url;
+            this.accessCode = data.access_code || '';
+            this.publicKey = data.public_key || '';
+            this.returnUrl = data.callback_url || ''; this.showSheet = true; this.loading = false;
            }
        } catch(e) { window.LadillPayCheckout?.cancel?.(); this.errorMsg = 'Network error. Please try again.'; this.loading = false; }
    }
@@ -1161,6 +1170,9 @@
    errorMsg: '',
    showSheet: false,
    checkoutUrl: '',
+    accessCode: '',
+    publicKey: '',
+    returnUrl: '',
    shippingType: @js($shippingType),
    shippingFee: @js($shippingFee),
    freeAbove: @js($freeShippingAbove),
@@ -1214,6 +1226,9 @@
                window.LadillPayCheckout?.cancel?.(); window.location.href = data.checkout_url;
            } else {
                this.checkoutUrl = data.checkout_url;
+            this.accessCode = data.access_code || '';
+            this.publicKey = data.public_key || '';
+            this.returnUrl = data.callback_url || '';
                this.showSheet   = true;
                this.loading     = false;
            }
@@ -139,6 +139,9 @@
                errorMsg: config.errorMsg ?? '',
                showSheet: false,
                checkoutUrl: '',
+                accessCode: '',
+                publicKey: '',
+                returnUrl: '',
                paymentSheetStyle: '',
                sheetBleedStyle: '',
                init() {
@@ -169,8 +172,10 @@
                    this.errorMsg = '';
                    this.loading = true;
                    this.checkoutUrl = '';
-                    // Open sheet chrome immediately so mobile bottom sheet / desktop
-                    // modal is visible before Paystack (popup opens from Continue).
+                    this.accessCode = '';
+                    this.publicKey = '';
+                    this.returnUrl = '';
+                    // Open sheet chrome immediately (mobile bottom sheet / desktop modal).
                    this.showSheet = true;
                    const controller = new AbortController();
                    const timer = setTimeout(() => controller.abort(), 45000);
@@ -195,7 +200,7 @@
                            this.errorMsg = apiError || ('Could not start payment (' + res.status + '). Please try again.');
                            return;
                        }
-                        if (!data.checkout_url) {
+                        if (!data.checkout_url && !data.access_code) {
                            this.showSheet = false;
                            this.errorMsg = 'Could not start payment. Please try again.';
                            return;
@@ -203,7 +208,10 @@
                        // Legacy MoMo waiting page must be full-page — never trap it in the Paystack iframe.
                        const useSheet = data.provider !== 'mtn_momo';
                        if (useSheet) {
-                            this.checkoutUrl = data.checkout_url;
+                            this.checkoutUrl = data.checkout_url || '';
+                            this.accessCode = data.access_code || '';
+                            this.publicKey = data.public_key || '';
+                            this.returnUrl = data.callback_url || '';
                        } else {
                            this.showSheet = false;
                            window.location.assign(data.checkout_url);