SCA / 3D Secure

[cgrisar]

Hi Erin,

will Charge be SCA-compliant by Sept 14?

Charles

[edalzell]

That's my plan.

[edalzell]

@cgrisar how do you use Charge? Checkout modal? Simple purchase? Subscription?

[cgrisar]

Hi Erin,

Decided to forego Charge altogether. I’ve written my own php / vue code. The solution is 3D Secure (Charge isn’t I believe)

C

On 29 Aug 2019, at 03:22, Erin Dalzell notifications@github.com wrote:

@cgrisar https://github.com/cgrisar how do you use Charge? Checkout modal? Simple purchase? Subscription?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/edalzell/statamic-charge/issues/24?email_source=notifications&email_token=AB4E6QDK3EISCMTSRDP2QNDQG4QE3A5CNFSM4IJWTJ72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5M5UVQ#issuecomment-525982294, or mute the thread https://github.com/notifications/unsubscribe-auth/AB4E6QHORMWMTZNMGVUGDN3QG4QE3ANCNFSM4IJWTJ7Q.

[edalzell]

Yup, that’s what I’m looking into right now.

[cgrisar]

I can share my code It’s somewhat more complex than the old way.

Not sure if I’ll turn into an add-on. Wouldn’t want to compete against one of yours, though

Charles Grisar

Le 29 août 2019 à 11:45, Erin Dalzell <notifications@github.com mailto:notifications@github.com> a écrit :

Yup, that’s what I’m looking into right now.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/edalzell/statamic-charge/issues/24?email_source=notifications&email_token=AB4E6QHCFD3VDRY6LYHY32TQG6LDDA5CNFSM4IJWTJ72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5N5CXY#issuecomment-526111071, or mute the thread https://github.com/notifications/unsubscribe-auth/AB4E6QADHOBVBIHKXMY6IODQG6LDDANCNFSM4IJWTJ7Q.

[edalzell]

Our code will likely look similar. I doesn't look that much more complicated on the PHP side. PaymentIntents instead of charging. And make a tag to get the session stuff to the front end. And a few more web hooks maybe but Charge already handles those.

You could submit a PR if that's easier if you'd like. Free license for Charge.

[cgrisar]

PHP Is straightforward. I had more code in vue. There are up to 3 back and forth: PaymentIntent create, PaymentIntent retrieve and then on the client side the handling of the request (with possible back and forth with the issuing bank). I didn’t use the web hooks

On 29 Aug 2019, at 23:48, Erin Dalzell notifications@github.com wrote:

Our code will likely look similar. I doesn't look that much more complicated on the PHP side. PaymentIntents instead of charging. And make a tag to get the session stuff to the front end. And a few more web hooks maybe but Charge already handles those.

You could submit a PR if that's easier if you'd like. Free license for Charge.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/edalzell/statamic-charge/issues/24?email_source=notifications&email_token=AB4E6QFFR4V5RBOZDBPP5CDQHA7Z3A5CNFSM4IJWTJ72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5P5TLY#issuecomment-526375343, or mute the thread https://github.com/notifications/unsubscribe-auth/AB4E6QB5F3CKSYJU6VY6XFTQHA7Z3ANCNFSM4IJWTJ7Q.

[edalzell]

Ya I plan to leave all that front end stuff out of Charge this time so that folks can use it however they want. Stripe has great docs, folks should use that.

[cgrisar]

I found out the stripe docs are insufficient for this specific issue.

The PHP-stuff was rather easy compared to the client part. Besides that, the Vue-stripe-elements is ok for charge but cannot handle payment intents out of the box. A lot of people might be into trouble.

On 29 Aug 2019, at 23:59, Erin Dalzell notifications@github.com wrote:

Ya I plan to leave all that front end stuff out of Charge this time so that folks can use it however they want. Stripe has great docs, folks should use that.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/edalzell/statamic-charge/issues/24?email_source=notifications&email_token=AB4E6QHU7V3LZ55RBHAQ6HDQHBBELA5CNFSM4IJWTJ72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5P6MLY#issuecomment-526378543, or mute the thread https://github.com/notifications/unsubscribe-auth/AB4E6QBFGEUBHIWPSB2UMD3QHBBELANCNFSM4IJWTJ7Q.

[lukeagsmith]

@edalzell Do you have an update on this?

How long before you think the update will be released? Really hoping not to roll our own!

We'd even be happy to buy it as a new license/pay and upgrade if you were calling it v3.

[cgrisar]

@lukeagsmith The real hassle of SCA-compliancy lies in the front end. You couldn't use "charge" out of the box, even if a call to PaymentCreate is changed by one to PaymentIntents.

[edalzell]

@cgrisar @lukeagsmith how do you use Charge? If for one time payments I have that done.

Will be working on the subscription stuff (which is a bit harder) this week.

[lukeagsmith]

@edalzell Yes, it's for one-time payments.

If you have that available that would be great.

[edalzell]

@cgrisar @lukeagsmith I've updated to 2.9, haven't done the docs yet sorry. Will do a big clean up next week.

You can use the Session or PaymentIntent now, either via tag or via API.

Tag:

            '{{ charge:payment_intent amount="1100" description="The description" }}',

API:

            fetch('/!/Charge/payment_intent', {
                method: 'POST',
                body: JSON.stringify(data), // data can be `string` or {object}!
                headers: {
                    'Content-Type': 'application/json',
                    'X-CSRF-TOKEN': '{{ csrf_token }}'
                }
            }).then(res => res.json())
            .then(function(json) {
                // Stripe gives a warning if you don't disable the submit button
                document.getElementById('customSubmitButton').disabled = true;

                stripe.handleCardPayment(
                    json.client_secret,
                    card,
                    {
                        payment_method_data: {
                            billing_details: {
                                name: document.getElementById('name').value,
                                email: document.getElementById('email').value,
                            }
                        }
                    }
                ).then(function(result) {
                    document.getElementById('customSubmitButton').disabled = false;
                    if (result.error) {
                        // Display error.message in your UI.
                        var displayError = document.getElementById('card-errors');
                        displayError.textContent = result.error.message;
                    } else {
                        // The payment has succeeded
                        // Display a success message

                        // add the payment intent id to the form so Charge can store the charge id in the submission
                        addToForm('payment_intent', result.paymentIntent.id, form);

                        // let Statamic & Charge do their things
                        form.submit();
                    }
                });
            }).catch(error => console.error('Error:', error));
        });

Session is similar

[netnakgraham]

Hello, and thank you, Would the API version above take the place of using a "data-charge-form" attribute in a statamic form?

[edalzell]

Yes @netnakgraham, all of that goes away as all of the stripe stuff is now on the front end and your responsibility.

The flow is:

1. generate appropriate secret/id
2. call the appropriate stripe method (handlePayment, handleCard, etc)
3. pass the relevant details in your form back to Statamic/Charge.

[danielfowler]

And it appears that the tag version above would go into a data-secret="{{ charge:payment_intent .... }}" attribute on the data-charge-button?

[edalzell]

@danielfowler you don’t use that data stuff anymore as the actual charging happens via your own JS.

Let’s pop on Discord and get you sorted.

I’m going to write up docs this weekend.

[netnakgraham]

I have it working correctly now with the Stripe card element, one thing to mention is that the line that calls Stripe in the Charge JS tag was commented out, so stripe was not defined. Thanks again

[edalzell]

Ya I'm going to remove that JS tag from Charge as the user is now responsible for all Stripe front end stuff.

[edalzell]

Basic one-time purchases support SCA now in 2.9.1. More work to be done please open new issues for any additional functionality or bugs.