Keep Mini QR Paystack checkout fully in-app.

Stop form POSTs from 307ing to ladl.link or redirecting away to
checkout.paystack.com, open Paystack Inline with access_code, and use
the single-chrome sheet so payment stays on the Mini page.

app/Http/Controllers/Public/PaymentController.php

@@ -41,7 +41,7 @@ class PaymentController extends Controller
             return back()->withInput()->with('error', $e->getMessage());
         }
 
-        if ($request->expectsJson()) {
+        if ($request->expectsJson() || $request->ajax()) {
             return response()->json([
                 'checkout_url' => $result['checkout_url'],
                 'access_code' => $result['access_code'] ?? null,
@@ -52,7 +52,24 @@ class PaymentController extends Controller
             ]);
         }
 
-        return redirect()->away($result['checkout_url']);
+        // Never send the browser to checkout.paystack.com — reopen the landing
+        // with checkout payload so Paystack Inline can run in-page.
+        $provider = (string) ($result['provider'] ?? '');
+        if ($provider === 'mtn_momo') {
+            $waiting = (string) ($result['checkout_url'] ?? '');
+            if ($waiting !== '' && str_starts_with($waiting, url('/'))) {
+                return redirect()->to($waiting);
+            }
+        }
+
+        return redirect()
+            ->to(url('/q/'.$shortCode))
+            ->with('checkout_url', $result['checkout_url'] ?? null)
+            ->with('access_code', $result['access_code'] ?? null)
+            ->with('public_key', $result['public_key'] ?? null)
+            ->with('callback_url', $result['callback_url'] ?? null)
+            ->with('provider', $provider !== '' ? $provider : 'paystack')
+            ->with('amount', $validated['amount']);
     }
 
     public function callback(Request $request, string $shortCode): View

app/Http/Middleware/RedirectLegacyQrToLadillLink.php

@@ -19,13 +19,20 @@ class RedirectLegacyQrToLadillLink
             return $next($request);
         }
 
-        // Same-origin AJAX from Mini-hosted payment pages (e.g. mini.ladill.com)
-        // must hit local /q/{code}/pay — redirecting to ladl.link breaks CORS and
-        // the checkout sheet never opens.
+        // Same-origin pay from Mini-hosted pages (e.g. mini.ladill.com) must hit
+        // local /q/{code}/pay — redirecting to ladl.link breaks CORS / form POSTs
+        // and used to dump the browser onto checkout.paystack.com.
         if ($request->ajax() || $request->expectsJson() || $request->wantsJson()) {
             return $next($request);
         }
 
+        // Form POST (and any method) to the Mini pay endpoint stays on Mini so
+        // PaymentController can return JSON or flash payload for in-page Inline.
+        $path = ltrim($request->path(), '/');
+        if (preg_match('#^q/[^/]+/pay(?:/callback)?$#i', $path) === 1) {
+            return $next($request);
+        }
+
         return LadillLink::legacyRedirect($request);
     }
 }