fix(open_crypto_pay): use quote payment id for commits

Author: reubenyap

lib/pages/open_crypto_pay/open_crypto_pay_confirm_view.dart

@@ -290,6 +290,7 @@ class _OpenCryptoPayConfirmViewState
           openCryptoPayCommit: OpenCryptoPayCommit(
             callbackUrl: widget.paymentDetails.callback,
             quoteId: widget.paymentDetails.quote!.id,
+            paymentId: widget.paymentDetails.quote!.paymentId,
             method: widget.selectedMethod.method,
             asset: widget.selectedAsset.asset,
             expiresAt: expiresAt,
@@ -348,6 +349,7 @@ class _OpenCryptoPayConfirmViewState
           openCryptoPayCommit: OpenCryptoPayCommit(
             callbackUrl: widget.paymentDetails.callback,
             quoteId: widget.paymentDetails.quote!.id,
+            paymentId: widget.paymentDetails.quote!.paymentId,
             method: widget.selectedMethod.method,
             asset: widget.selectedAsset.asset,
             expiresAt: expiresAt,

lib/services/open_crypto_pay/models.dart

@@ -99,13 +99,24 @@ class OpenCryptoPayTransferMethod {
 
 class OpenCryptoPayQuote {
   final String id;
+  final String paymentId;
   final DateTime expiration;
 
-  OpenCryptoPayQuote({required this.id, required this.expiration});
+  OpenCryptoPayQuote({
+    required this.id,
+    required this.paymentId,
+    required this.expiration,
+  });
 
   factory OpenCryptoPayQuote.fromJson(Map<String, dynamic> json) {
+    final paymentId = json['payment'] as String?;
+    if (paymentId == null || paymentId.isEmpty) {
+      throw Exception('OpenCryptoPay: quote payment id is missing');
+    }
+
     return OpenCryptoPayQuote(
       id: json['id'] as String,
+      paymentId: paymentId,
       expiration: DateTime.parse(json['expiration'] as String),
     );
   }
@@ -220,11 +231,11 @@ class OpenCryptoPayTransactionDetails {
   }
 }
 
-/// Context required to notify the provider of a broadcast transaction via
-/// the `/tx/` endpoint (derived from the payment details callback URL).
+/// Context required to notify the provider via the `/tx/{paymentId}` endpoint.
 class OpenCryptoPayCommit {
   final String callbackUrl;
   final String quoteId;
+  final String paymentId;
   final String method;
   final String asset;
   final DateTime expiresAt;
@@ -237,6 +248,7 @@ class OpenCryptoPayCommit {
   const OpenCryptoPayCommit({
     required this.callbackUrl,
     required this.quoteId,
+    required this.paymentId,
     required this.method,
     required this.asset,
     required this.expiresAt,

lib/services/open_crypto_pay/open_crypto_pay_api.dart

@@ -126,8 +126,7 @@ class OpenCryptoPayApi {
   }
 
   /// Notifies the provider of a locally broadcast transaction so the merchant
-  /// side can settle the payment. The `/tx/` endpoint is derived from the
-  /// payment details callback URL.
+  /// side can settle the payment.
   Future<void> commitTxId({
     required OpenCryptoPayCommit commit,
     required String txId,
@@ -161,7 +160,7 @@ class OpenCryptoPayApi {
     required OpenCryptoPayCommit commit,
     required Map<String, String> queryParameters,
   }) async {
-    final base = _commitEndpoint(commit.callbackUrl);
+    final base = _commitEndpoint(commit.callbackUrl, commit.paymentId);
     _requireHttps(base, 'commit endpoint');
     final uri = base.replace(
       queryParameters: {
@@ -181,15 +180,19 @@ class OpenCryptoPayApi {
     }
   }
 
-  Uri _commitEndpoint(String callbackUrl) {
+  Uri _commitEndpoint(String callbackUrl, String paymentId) {
     final callback = Uri.parse(callbackUrl);
+    if (paymentId.isEmpty) {
+      throw Exception('OpenCryptoPay: quote payment id is missing');
+    }
     final segments = callback.pathSegments.toList();
-    final cbIndex = segments.indexOf('cb');
+    final cbIndex = segments.lastIndexOf('cb');
     if (cbIndex == -1) {
       throw Exception('OpenCryptoPay: callback URL does not contain /cb/');
     }
-    segments[cbIndex] = 'tx';
-    return callback.replace(pathSegments: segments);
+    return callback.replace(
+      pathSegments: [...segments.take(cbIndex), 'tx', paymentId],
+    );
   }
 
   Uri _redactedUri(Uri uri) {

test/open_crypto_pay_models_test.dart

@@ -0,0 +1,25 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:stackwallet/services/open_crypto_pay/models.dart';
+
+void main() {
+  test("parses quote payment id used for commit endpoint", () {
+    final quote = OpenCryptoPayQuote.fromJson({
+      "id": "quote-id",
+      "payment": "payment-id",
+      "expiration": "2026-04-28T12:00:00Z",
+    });
+
+    expect(quote.id, "quote-id");
+    expect(quote.paymentId, "payment-id");
+  });
+
+  test("rejects quotes without a payment id", () {
+    expect(
+      () => OpenCryptoPayQuote.fromJson({
+        "id": "quote-id",
+        "expiration": "2026-04-28T12:00:00Z",
+      }),
+      throwsException,
+    );
+  });
+}