Add a new provider module for LAVA Business (api.lava.ru):
- invoice creation via POST /business/invoice/create signed with
HMAC-SHA256 over the raw request body in the Signature header
- webhook handling with Authorization-header signature verification
that accepts both raw-body and sorted-keys JSON canonicalizations
(legacy PHP SDK shops sign the latter), plus amount cross-check
before finalizing a successful payment
- pending invoice reuse through /business/invoice/status
- Telegram pay_lava callback flow and Web App payment creation
- admin settings manifest fields, presentation overrides, and
RUB-only currency support declared on the provider SPEC
Register the SPEC in the provider registry and wire the provider into
the payment method order, success-email labels, and locale override
prefixes.
PAYMENT_REQUEST_TIMEOUT_SECONDS was read once in each provider's
__init__ and baked into the aiohttp session, so admin overrides
(applied in-process) only took effect after a container restart.
Providers now hand HttpClientMixin a timeout source callable; the
mixin builds the session with the current value and swaps in a fresh
session when the value changes, closing the replaced one only after
any in-flight request on it is bound by its own total timeout.
Also:
- check the Heleket payment-info success flag before reading the
payload so a non-dict provider response cannot raise in the
pending-payment reuse path
- add PAYMENT_REQUEST_TIMEOUT_SECONDS to the FreeKassa settings stub
in test_security.py (fixes three tests broken by the new field)
Keep one-off device top-ups scoped to the active subscription term and move device renewal into subscription checkout.
Carry HWID renewal metadata through provider callbacks and webhooks, including YooKassa saved-card flows.
Add admin extension controls, docs, demo data, and regression coverage.
3252a8
BADtochka
BADtochkaandGitHub