From b7b18b1fc5adec6d0ebc70aa97677ceaa7b4430c Mon Sep 17 00:00:00 2001
From: Mikel Martin <mikel.martin@sequra.es>
Date: Wed, 25 Sep 2024 13:04:35 +0200
Subject: [PATCH 1/2] Use different base url depending on the test/live mode

---
 .../Listing/Column/SequraOrderLink.php        | 32 +++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/Ui/Component/Listing/Column/SequraOrderLink.php b/Ui/Component/Listing/Column/SequraOrderLink.php
index 9e321c0..a7db5e3 100644
--- a/Ui/Component/Listing/Column/SequraOrderLink.php
+++ b/Ui/Component/Listing/Column/SequraOrderLink.php
@@ -7,9 +7,12 @@
 use Magento\Framework\View\Element\UiComponent\ContextInterface;
 use Magento\Framework\View\Element\UiComponentFactory;
 use Magento\Framework\UrlInterface;
+use SeQura\Core\BusinessLogic\Domain\Connection\Models\ConnectionData;
+use SeQura\Core\BusinessLogic\Domain\Connection\Services\ConnectionService;
 use SeQura\Core\BusinessLogic\Domain\Order\Models\OrderRequest\OrderRequestStates;
 use SeQura\Core\BusinessLogic\Domain\Order\Models\SeQuraOrder;
 use SeQura\Core\BusinessLogic\Domain\Order\Service\OrderService;
+use SeQura\Core\BusinessLogic\SeQuraAPI\BaseProxy;
 use SeQura\Core\Infrastructure\ServiceRegister;
 use Sequra\Core\Services\BusinessLogic\Utility\SeQuraTranslationProvider;
 
@@ -23,7 +26,8 @@ class SequraOrderLink extends Column
     protected $assetRepository;
     protected $urlBuilder;
     protected $translationProvider;
-    public const SEQURA_PORTAL_URL = 'https://simbox.sequrapi.com/orders/';
+    public const SEQURA_PORTAL_SANDBOX_URL = 'https://simbox.sequrapi.com/orders/';
+    public const SEQURA_PORTAL_URL = 'https://simba.sequra.com/orders/';
 
     /**
      * @param ContextInterface $context
@@ -117,7 +121,7 @@ private function getButtonLink(string $orderReference): string
         $imagePath = $this->assetRepository->getUrl('Sequra_Core::images/sequra-logo.png');
 
         return html_entity_decode(
-            '<a class="sequra-link" href="' . $this->urlBuilder->getUrl(self::SEQURA_PORTAL_URL . $orderReference) . '" target="_blank" onclick="event.stopPropagation()">
+            '<a class="sequra-link" href="' . $this->getButtonLinkUrl($orderReference) . '" target="_blank" onclick="event.stopPropagation()">
                         <button class="sequra-preview">
                             <img class="sequra-logo" src=' . $imagePath . ' alt="sequra-logo">
                                 ' . $this->translationProvider->translate("sequra.viewOnSequra") . '
@@ -125,6 +129,14 @@ private function getButtonLink(string $orderReference): string
                    </a>');
     }
 
+    private function getButtonLinkUrl(string $orderReference): string
+    {
+        $connectionSettings = $this->getConnectionSettings();
+        $baseUrl = $connectionSettings && $connectionSettings->getEnvironment() === BaseProxy::LIVE_MODE ?
+            self::SEQURA_PORTAL_URL : self::SEQURA_PORTAL_SANDBOX_URL;
+        return $this->urlBuilder->getUrl( $baseUrl . $orderReference );
+    }
+
     /**
      * Returns an instance of Order service.
      *
@@ -138,4 +150,20 @@ private function getOrderService(): OrderService
 
         return $this->orderService;
     }
+
+    /**
+     * @return ConnectionData|null
+     */
+    private function getConnectionSettings(): ?ConnectionData
+    {
+        return $this->getConnectionService()->getConnectionData();
+    }
+
+    /**
+     * @return ConnectionService
+     */
+    private function getConnectionService(): ConnectionService
+    {
+        return ServiceRegister::getService(ConnectionService::class);
+    }
 }

From 53d5d63dc9c56334d5cfa84fb686b2de399eec9a Mon Sep 17 00:00:00 2001
From: Mikel Martin <mikel.martin@sequra.es>
Date: Wed, 25 Sep 2024 13:09:28 +0200
Subject: [PATCH 2/2] Enable csp report_only mode to not block inline script in
 the sequra checkout form

---
 composer.json         |  2 +-
 etc/config.xml        | 12 ++++++++++--
 etc/csp_whitelist.xml | 32 ++++++++++++++++----------------
 etc/module.xml        |  2 +-
 4 files changed, 28 insertions(+), 20 deletions(-)

diff --git a/composer.json b/composer.json
index a231088..34bc1ce 100644
--- a/composer.json
+++ b/composer.json
@@ -8,7 +8,7 @@
         "pagos",
         "magento2"
     ],
-    "version": "2.5.1",
+    "version": "2.5.2",
     "license": "MIT",
     "authors": [
         {
diff --git a/etc/config.xml b/etc/config.xml
index 1cb8013..c4ced25 100644
--- a/etc/config.xml
+++ b/etc/config.xml
@@ -1,6 +1,14 @@
 <?xml version="1.0"?>
-<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
     <default>
+        <csp>
+            <mode>
+                <storefront>
+                    <report_only>1</report_only>
+                </storefront>
+            </mode>
+        </csp>
         <payment>
             <sequra_payment>
                 <debug>1</debug>
@@ -20,4 +28,4 @@
             </sequra_payment>
         </payment>
     </default>
-</config>
+</config>
\ No newline at end of file
diff --git a/etc/csp_whitelist.xml b/etc/csp_whitelist.xml
index c33e315..712b764 100644
--- a/etc/csp_whitelist.xml
+++ b/etc/csp_whitelist.xml
@@ -3,34 +3,34 @@
     <policies>
         <policy id="img-src">
             <values>
-                <value id="sequra-sandbox-cdn" type="host">https://sandbox.sequracdn.com</value>
-                <value id="sequra-production-cdn" type="host">https://live.sequracdn.com</value>
-                <value id="sequra-sandbox-api" type="host">https://sandbox.sequrapi.com</value>
-                <value id="sequra-production-api" type="host">https://live.sequrapi.com</value>
+                <value id="sequra-sandbox-cdn" type="host">sandbox.sequracdn.com</value>
+                <value id="sequra-production-cdn" type="host">live.sequracdn.com</value>
+                <value id="sequra-sandbox-api" type="host">sandbox.sequrapi.com</value>
+                <value id="sequra-production-api" type="host">live.sequrapi.com</value>
             </values>
         </policy>
         <policy id="script-src">
             <values>
-                <value id="sequra-sandbox-cdn" type="host">https://sandbox.sequracdn.com</value>
-                <value id="sequra-production-cdn" type="host">https://live.sequracdn.com</value>
-                <value id="sequra-sandbox-api" type="host">https://sandbox.sequrapi.com</value>
-                <value id="sequra-production-api" type="host">https://live.sequrapi.com</value>
+                <value id="sequra-sandbox-cdn" type="host">sandbox.sequracdn.com</value>
+                <value id="sequra-production-cdn" type="host">live.sequracdn.com</value>
+                <value id="sequra-sandbox-api" type="host">sandbox.sequrapi.com</value>
+                <value id="sequra-production-api" type="host">live.sequrapi.com</value>
             </values>
         </policy>
         <policy id="connect-src">
             <values>
-                <value id="sequra-sandbox-cdn" type="host">https://sandbox.sequracdn.com</value>
-                <value id="sequra-production-cdn" type="host">https://live.sequracdn.com</value>
-                <value id="sequra-sandbox-api" type="host">https://sandbox.sequrapi.com</value>
-                <value id="sequra-production-api" type="host">https://live.sequrapi.com</value>
+                <value id="sequra-sandbox-cdn" type="host">sandbox.sequracdn.com</value>
+                <value id="sequra-production-cdn" type="host">live.sequracdn.com</value>
+                <value id="sequra-sandbox-api" type="host">sandbox.sequrapi.com</value>
+                <value id="sequra-production-api" type="host">live.sequrapi.com</value>
             </values>
         </policy>
         <policy id="frame-src">
             <values>
-                <value id="sequra-sandbox-cdn" type="host">https://sandbox.sequracdn.com</value>
-                <value id="sequra-production-cdn" type="host">https://live.sequracdn.com</value>
-                <value id="sequra-sandbox-api" type="host">https://sandbox.sequrapi.com</value>
-                <value id="sequra-production-api" type="host">https://live.sequrapi.com</value>
+                <value id="sequra-sandbox-cdn" type="host">sandbox.sequracdn.com</value>
+                <value id="sequra-production-cdn" type="host">live.sequracdn.com</value>
+                <value id="sequra-sandbox-api" type="host">sandbox.sequrapi.com</value>
+                <value id="sequra-production-api" type="host">live.sequrapi.com</value>
             </values>
         </policy>
     </policies>
diff --git a/etc/module.xml b/etc/module.xml
index fe5d5cf..da32681 100644
--- a/etc/module.xml
+++ b/etc/module.xml
@@ -5,7 +5,7 @@
  */
 -->
 <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
-    <module name="Sequra_Core" setup_version="2.5.1">
+    <module name="Sequra_Core" setup_version="2.5.2">
         <sequence>
             <module name="Magento_Catalog"/>
             <module name="Magento_ConfigurableProduct"/>