mobibox_pay 1.2.3

A Flutter plugin to seamlessly integrate with the Mobibox payment gateway

1.2.3

• Fixed: card payments could stall on the 3DS verification page. When the SALE response returned redirect, the issuer's 3DS page is rendered inside the same WebView as the card fields - but that WebView was wrapped in IgnorePointer for the whole duration of any in-flight payment, including the card flow's own. The page rendered correctly and then silently swallowed every tap, so the payer could not complete verification. Observed on live transactions.
  • MobiPayCheckout now tracks wallet payments separately (_isWalletPaymentInProgress) and only locks the card WebView while an Apple Pay / Google Pay payment is in flight - the case the lock was added for. The card flow's own payment no longer locks it, so 3DS works.
  • All other cross-locking is unchanged: the sheet still can't be dismissed mid-payment, and the wallet buttons are still disabled while a card payment (including its 3DS step) is in flight. Double submission from the card form is prevented inside the HPF form itself (submit button disabled + spinner while in flight).
• Payer fields remain required; the Protocol Mapping "optional parameters" route does not apply to CyberSource merchants. Akurateco confirmed that payer_address/payer_country/payer_city/payer_zip can be marked optional at the platform level, but that the CyberSource connector still requires them downstream - so omitting them passes platform validation and is then declined by the connector. payer_phone cannot be made optional at all. The effective requirement is therefore the union: first name, last name, address, city, zip, country, email, phone. The wallet sheets continue to collect all of them:
  • Apple Pay: requiredBillingContactFields = [.postalAddress, .name], requiredShippingContactFields = [.phoneNumber, .emailAddress], with in-sheet validation across address/city/zip/country/phone/email.
  • Google Pay: FULL-format billing address with phoneNumberRequired: true, plus email.
  • payer_state is the only genuinely optional field, sent when available.

1.2.0

• Added: native Google Pay support (Android only), submitted via the same S2S CARD protocol as Apple Pay (action=SALE&digital_wallet=googlepay, full payer profile, same "Formula 8" hash) - see Appendix C of the Mobibox/Akurateco S2S CARD docs.
  • New MobiPayGooglePayConfig (gateway - value from your Mobibox account manager, gatewayMerchantId - your CLIENT_KEY, paymentApiUrl, merchantDisplayName, environment test/production, countryCode, supportedNetworks, allowedAuthMethods).
  • New MobiPayGooglePayButton mirroring MobiPayApplePayButton's API (availability self-check, payer fallbacks, callbacks, enabled cross-locking). Shown by MobiPayCheckout/MobiPay.startPayment in the same slot as the Apple Pay button - at most one is ever visible, since each hides itself off its own platform.
  • MobiPay: initialize(googlePayConfig: ...), isGooglePayAvailable, requestGooglePayToken, processGooglePaySale; startPayment(googlePayConfig: ..., enableGooglePay: ..., onGooglePayRedirectRequired: ..., onGooglePayCancel: ...). The existing applePayPayer* fallbacks, applePayReturnUrl, and applePayPayerIp apply to Google Pay too (payer data is wallet-agnostic).
  • The Google Pay sheet is asked for a FULL-format billing address + phone + email, which Google enforces in-sheet before returning - so all payer_* fields Mobibox requires are collected natively, with no Apple-style missing-field gap (no validatePayerFields mechanism needed on Android).
  • Payment locking across all three methods: while a Google Pay SALE is in flight the Apple Pay button and card fields are locked (and vice versa); pressing the card form's Pay disables both wallet buttons.
  • MobiPayCardSaleProcessor.processDigitalWalletSale added (digitalWallet = applepay/googlepay); processApplePaySale now delegates to it (signature unchanged, not breaking).
  • Android plugin now implements ActivityAware and depends on com.google.android.gms:play-services-wallet. Host apps must add <meta-data android:name="com.google.android.gms.wallet.api.enabled" android:value="true"/> inside <application> in their own AndroidManifest.xml.

1.1.8

• Fixed: in-sheet validation could dead-end on "Update Shipping Contact". When 1.1.7's validation flagged a missing phone/email, it used paymentContactInvalidError - which refers to the sheet's shipping contact section - while phone/email were requested via requiredBillingContactFields only. The sheet demanded a section that didn't exist in its UI, leaving the payer stuck with no way to proceed (observed on-device). Root cause: Apple provides field-level billing errors for postal-address sub-fields only; there is no billing error key for phone/email/name.
  • Phone/email are now requested via requiredShippingContactFields (billing keeps .postalAddress/.name), so the sheet has a real, editable contact section for those errors to point at. This also restores 1.1.4's reliable auto-fill for phone/email (billing contacts don't dependably carry them - Apple Developer Forums thread 61802 / rdar://26981967), so most payers will never see the prompt at all.
  • name is no longer validated in-sheet (no Apple error key can reference it without the same stuck-state risk). Wallet cards essentially always carry the cardholder name; the Dart-side fallback/exception still backstops it.
  • The payload sent to Dart is unchanged in shape: phone/email are merged from the shipping contact into the same billingContact map. No Dart-side API changes; requires an iOS rebuild (pod install).

1.1.7

• Added: in-sheet payer field validation for Apple Pay. Mobibox's S2S CARD SALE request requires a full payer profile (name, address, city, zip, country, phone, email). Previously, if PassKit's billing contact was missing one of these and no payer* fallback parameter was supplied, the payment failed after the Apple Pay sheet closed, with an exception. Now the missing field is enforced inside the sheet: after the payer authorizes, MobiPayPlugin.swift validates the billing contact and, if a required field is absent, returns field-level PKPaymentErrors - the sheet stays open with the offending field highlighted (e.g. "Postal code is required"), the payer completes it in Apple's own UI and re-authorizes. Re-authorization generates a fresh payment token, so the token-lifetime concern with collecting data outside the sheet does not apply.
  • New optional validatePayerFields parameter on MobiPay.requestApplePayToken / MobiPayPlatform.requestApplePayToken (accepted values: name, address, city, zip, country, phone, email; defaults to [], i.e. no in-sheet enforcement - not breaking).
  • MobiPayApplePayButton computes this list automatically: a field is enforced in-sheet only when the matching payer* fallback parameter was not supplied. Fields the host app can back-fill itself never block the payer.
  • Requires a full iOS rebuild (pod install in the consuming app) - this is a native code change and will not arrive via hot reload or an old TestFlight build.

1.1.6

• Reverted the requiredShippingContactFields workaround added in 1.1.4: MobiPayPlugin.swift requests phone/email via requiredBillingContactFields again (single billingContact source, matching 1.1.3), instead of splitting them out to requiredShippingContactFields. This knowingly reintroduces the intermittent missing phone/email behavior 1.1.4 fixed - PKPaymentRequest now again relies on PassKit auto-filling from the payer's Wallet card most of the time; MobiPayApplePayButton's payerPhone/payerEmail fallback parameters remain the safety net for whichever field PassKit doesn't supply. No Dart-side API changes.
• Fixed: switching focus between the Card Number/Expiry/CVV fields (hosted in iframes within the Hosted Payment Fields form) could blank the form momentarily. applyNumericKeyboard() in mobi_pay_hpf_widget.dart was changing an iframe input's type attribute while it was focused, forcing WebKit to blur/refocus it mid-transition; it's now applied proactively (piggybacking on the existing field-state poll) before the field is ever focused, so the focus-time call is a no-op.
• Fixed: focusing different fields in the card form could scroll the whole bottom sheet down until only the Apple Pay button remained visible. MobiPay.startPayment's bottom sheet padded itself by the live keyboard inset (viewInsets.bottom), which differs between the full keyboard (Cardholder Name) and the numeric keypad (Card Number/Expiry/CVV) - so switching fields repositioned the embedded WebView on every focus change, racing with its own internal keyboard-avoidance scroll. The padding now only grows to the largest inset seen since the sheet opened and resets once the keyboard fully closes, so it no longer changes between fields.

1.1.5

• Added: MobiPayTransactionResult.applePayEmail - the email the payer used/edited in the Apple Pay sheet itself (PassKit's contact), surfaced through the existing onTransactionInitiated/onTransactionComplete/ onTransactionFailed callbacks on MobiPayApplePayButton. Only set when PassKit actually supplied it; null if it fell back to the widget's payerEmail parameter instead, so it's safe to use for fraud/verification checks without risk of it silently being a pre-supplied value.

1.1.4

• Fixed: Apple Pay's billingContact payload would intermittently be missing phoneNumber and/or emailAddress, surfacing as MobiPayApplePayButton's "Apple Pay payer phone/email is required..." errors even though the payer had a valid Wallet card. Root cause: PKPaymentRequest.requiredBillingContactFields does not reliably return phone/email - a billing PKContact is backed by the card's on-file billing address, which doesn't carry those fields (open PassKit bug, Apple Developer Forums thread 61802 / rdar://26981967). MobiPayPlugin.swift now requests .phoneNumber/.emailAddress via requiredShippingContactFields instead (.postalAddress/.name remain on requiredBillingContactFields), which Apple does populate reliably, even with no shippingMethods set. No Dart-side API changes.

1.1.3

• Switched Apple Pay's SALE request from the S2S APM protocol to S2S CARD. S2S APM forwards the Apple Pay token undecrypted, which not every connector supports - on connectors that don't, it fails with error_code: 205001 "Merchant mappings not found." (confirmed via Akurateco support ticket). S2S CARD works on both.
  • New endpoint: POST /post (e.g. https://api.mobibox.io/post) - not the S2S APM /post-va endpoint. Update MobiPayApplePayConfig.paymentApiUrl.
  • New MobiPayHash.generateDigitalWalletSaleHash implementing S2S CARD's "Formula 8": md5(uppercase(reverse(email) + password)).
  • New MobiPayCardSaleProcessor (mobi_pay_card_sale_processor.dart) building the digital_wallet=applepay / payment_token SALE request with S2S CARD's full required payer profile (name, address, city, zip, country, phone, email, term_url_3ds).
  • MobiPayPlugin.swift now sets requiredBillingContactFields on the PKPaymentRequest, so PassKit collects the payer's name/address/phone/ email as part of the Apple Pay sheet - requestApplePayToken returns {"paymentToken": {...}, "billingContact": {...}} instead of the raw token map. MobiPayApplePayButton prefers this native billing contact and falls back to its own payerFirstName/payerLastName/ payerAddress/payerCity/payerZip/payerState/payerCountry/ payerPhone parameters (also newly added) for anything PassKit didn't supply.
• Breaking: MobiPay.processApplePaySale and MobiPayCardSaleProcessor.processApplePaySale require the new payer fields above and termUrl3ds (replacing returnUrl); the S2S APM-only identifier parameter and MobiPayCheckout.applePayIdentifier / MobiPay.startPayment(applePayIdentifier: ...) were removed (S2S CARD has no equivalent field). MobiPayApplePayButton.identifier was also removed.
• MobiPaySaleProcessor.processApplePaySale (S2S APM) is no longer called by this package for Apple Pay, but remains available for merchants whose connector does support undecrypted tokens, or other S2S APM brands.
• Fixed: MobiPayApplePayButton no longer stays tappable while a card payment (or another Apple Pay attempt) is already in flight - and the card fields are now locked while an Apple Pay SALE is in flight too.

1.1.2

• Add native Apple Pay support (iOS only), shown above the existing card fields as a button + "Or pay using" divider, matching the standard checkout layout.
  • MobiPayApplePayConfig - merchant identifier, S2S APM payment URL, country code, supported networks, merchant capabilities.
  • MobiPay.initialize(applePayConfig: ...) and per-call override via MobiPay.startPayment(applePayConfig: ..., enableApplePay: ...).
  • MobiPayApplePayButton / MobiPayApplePayDivider for building a custom layout instead of using startPayment's bottom sheet.
  • New MobiPayHash.generateSaleHash and MobiPaySaleProcessor implementing the raw S2S APM action=SALE&brand=applepay protocol (separate from the Hosted Payment Fields JSON API used for cards).
  • Native iOS PassKit integration (PKPaymentAuthorizationController) added to MobiPayPlugin.swift; PassKit framework added to the podspec.
  • Requires an Apple Pay Merchant Identifier + certificates set up in your Apple Developer account and in the Mobibox admin panel's "Wallets" tab, the com.apple.developer.in-app-payments entitlement enabled in your app's Xcode project, and your S2S APM PAYMENT_URL from your Mobibox account manager. See MobiPayApplePayConfig doc comments for details.

1.1.1

• Update for Mobibox_pay SDK.
• Changelog:
  • Stop Accepting Numeric Input for Cardholder Name