Backward compatibilty fix.

Merge pull request #19 from SatoDri/19.0-fix-security-and-ipn
Fix amount tampering, broken IPN URL and invoice status handling (19.0)
2026-08-12 22:15:19 +02:00 · 2026-08-12 22:11:31 +02:00 · 2026-08-12 09:52:27 +02:00 · 2026-08-07 20:22:15 +02:00 · 2026-07-20 00:06:39 +02:00 · 2026-07-20 00:06:39 +02:00
32 changed files with 794 additions and 461 deletions
@@ -0,0 +1,12 @@
 # BTCPay Server payment gateway for Odoo 16, 17, 18 and 19
 ## Accept bitcoin payments on Odoo 16, 17, 18 and 19
 This odoo addon allows you to accept bitcoin and Lightning Network (and other cryptocurrency) payments in your Odoo e-commerce store.  
 ![BTCPay Server Banner](https://raw.githubusercontent.com/btcpayserver/odoo/17.0/payment_btcpayserver/static/description/BTCPay-Odoo-17-featured.png)
 ## How to install
 Please find the installation instructions here:
 - [Odoo 18 + 19 documentation](https://github.com/btcpayserver/odoo/blob/19.0/payment_btcpayserver/README.md)
 - [Odoo 17 documentation](https://github.com/btcpayserver/odoo/blob/17.0/payment_btcpayserver/README.md)
 - [Odoo 16 documentation](https://github.com/btcpayserver/odoo/blob/16.0/payment_btcpayserver/README.md)
@@ -1,54 +0,0 @@
 # payment_btcpay
 # BTCPay Server payment gateway for Odoo 16.0
 ## This is the module to connect Odoo 16.0 and BTCPay
 This module allows you to accept bitcoin (and other cryptocurrency) payments in your Odoo e-commerce store.  
 ![BTCPay Server Website](../payment_btcpay/static/description/BTCPayServer_org.png)
 ## Install the module
 * Clone our [repository](https://github.com/btcpayserver/odoo) or download the .zip from the [releases page](https://github.com/btcpayserver/odoo/releases)
 * Place the `payment_btcpay` directory in your Odoo addons directory
 * Install dependencies by running `pip install -r requirements.txt` (from inside the `payment_btcpay` directory)
 * Restart Odoo
 * Go to Apps -> Update Apps List
 * Remove the "Apps" filter and search for "btcpay"
 * Click **Activate** button
 ## Configure BTCPay as payment provider
 * Go to  **Website** -> **Configuration** -> **Payment Providers**
 * Search for BTCPay and click on button **Activate**
 In the BTCPay settings form, tab "Credentials":
 * Set field "State" to enabled
 * Set field "BTCPay Server URL" as test or live URL including https://. Example URL: https://testnet.demo.btcpayserver.org
 * Get a pairing code from your BTCPay Server store: Settings -> Access Tokens
  * Click on "Create Token" button
  * Label: enter e.g. "My odoo store"
  * Public Key: leave empty
  * Click on "Request Pairing" button, on next page click "Approve" button
  * At the top copy the code next to "Server initiated pairing code", e.g. "hg7z8wN"
 * Back in Odoo, paste the code into "Pairing Code" field
 * Hit Tab key on your keyboard (or click on another field) and the pairing process will start automatically
 * When the pairing is successful the "Token" and "Private Key" field will be filled automatically
 * Field Facade, keep default 'merchant'.
 On the tab "Configuration":
 * Set field "Payment Journal" to "Bank", you can click the dropdown and click on the suggestion "Bank"
 * Now you can **save** the settings
 ![Payment Provider Settings](../payment_btcpay/static/description/BTCPayPaymentSettings.png)
 ## How does the payment page look?
 During the checkout the customers will have the option to select the payment method "Pay with Bitcoin / Lightning Network". After selecting they will be redirected to the BTCPay checkout page as shown below.
 ![Payment Provider](../payment_btcpay/static/description/BTCPayLooksLike.png)
 ## Transaction BTCPay Details
 In transaction object, you will find more technical information about this method of payment:
 * Transaction Id: cryptocurrency transaction hash for the executed payout
 * Invoice Id: the id of the invoice for which you want to fetch an event token
 * Transaction Status: That indicates state of transaction
 ![Transaction Btcpay Details](../payment_btcpay/static/description/BtcpayTxDetails.png)
@@ -1,112 +0,0 @@
 # ******************************************************************************
 # PAYMENT BTCPAY FOR ODOO
 #
 # Copyright (C) 2020 Susanna Fort <susannafm@gmail.com>
 #
 # ******************************************************************************
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License as
 # published by the Free Software Foundation; either version 2 of
 # the License, or any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # For a full copy of the GNU General Public License see the LICENSE.txt file.
 #
 # ******************************************************************************
 import logging
 import pprint
 import requests
 import werkzeug
 from werkzeug import urls
 from werkzeug.exceptions import Forbidden
 from odoo import _, http, SUPERUSER_ID
 from odoo.exceptions import ValidationError
 from odoo.http import request
 from odoo.tools import html_escape
 import json
 from ..models.libs.client import BTCPayClient
 _logger = logging.getLogger(__name__)
 class BTCPayController(http.Controller):
    _checkout_url = '/btcpay/checkout'
    _notify_url = '/payment/btcpay/ipn'
    _return_url = '/payment/btcpay/return'
    @http.route(_checkout_url, type='http',  auth='public', csrf=False, website=True)
    def checkout(self, **data):
        _logger.info("CHECKOUT: notification received from BTCPay with data:\n%s", pprint.pformat(data))
        tx_sudo = request.env['payment.transaction'].sudo()._get_tx_from_notification_data('btcpay', data)
        provider = tx_sudo.provider_id
        notification_url = str(data.get('notify_url')).replace("http://", "https://")
        base_url = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
        redirect_url = urls.url_join(base_url, self._return_url)
        client = BTCPayClient(host=provider.btcpay_location, pem=provider.btcpay_privateKey, tokens={provider.btcpay_facade: provider.btcpay_token})
        invoice = client.create_invoice(
            {"price": data.get('amount'),
             "currency": data.get('currency_id'),
             "orderId": data.get('reference'),
             "token": provider.btcpay_token,
             "redirectURL": redirect_url,
             "notificationURL": notification_url,
             "extendedNotifications": True,
             "buyer": {"email": data.get('email'),
                       "name": data.get('name'),
                       "address1": data.get('street'),
                       "locality": data.get('city'),
                       "postalCode": data.get('zip'),
                       "country": data.get('country'),
                       "notify": False}})
        _logger.info('Invoice %s \n NOTIFY URL: %s', invoice, notification_url)
        return werkzeug.utils.redirect(invoice['url'])
    @http.route(_notify_url, type='json', auth='public', csrf=False)
    def btcpay_ipn(self, **post):
        """ BTCPay IPN. """
        _logger.info('BTCPAY IPN RECEIVED... ')
        data = json.loads(request.httprequest.data)
        _logger.info("%s", pprint.pformat(data))
        try:
            notification_data = {"reference": data['data']['orderId'],
                                 "invoiceID": data['data']['id']}
            # Check the origin and integrity of the notification
            tx_sudo = request.env['payment.transaction'].sudo()._get_tx_from_notification_data('btcpay', notification_data)
            provider = tx_sudo.provider_id
            client = BTCPayClient(host=provider.btcpay_location, pem=provider.btcpay_privateKey,
                                  tokens={provider.btcpay_facade: provider.btcpay_token})
            fetched_invoice = client.get_invoice(notification_data['invoiceID'])
            _logger.info('fetched_invoice = %s',pprint.pformat(fetched_invoice))
            notification_data = {"reference": fetched_invoice['orderId'],
                    "status": fetched_invoice['status'],
                    "invoiceID": fetched_invoice['id'],
                    "txid": fetched_invoice['url']}
            # Handle the notification data
            tx_sudo._handle_notification_data('btcpay', notification_data)
        except ValidationError:  # Acknowledge the notification to avoid getting spammed
            _logger.exception("Unable to handle the notification data; skipping to acknowledge")
        return ''
    @http.route(_return_url, type='http', auth="public", methods=['GET'], crsf=False, save_session=False)
    def btcpay_return_from_redirect(self, **data):
        """ BTCPay return
            We could process and check the invoice status here but there is no need to as the status get's updated via
            IPN anyway, so just show the user the order confirmation / payment status page.
        """
        _logger.info("BTCPay: user returned to shop after payment")
        return request.redirect('/payment/status')
@@ -1,13 +0,0 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo noupdate="1">
    <record id="payment_provider_btcpay" model="payment.provider">
        <field name="name">BTCPay payments</field>
        <field name="display_as">Pay with Bitcoin / Lightning Network</field>
        <field name="code">btcpay</field>
        <field name="image_128" type="base64" file="payment_btcpay/static/description/icon.png"/>
        <field name="module_id" ref="base.module_payment_btcpay"/>
        <field name="redirect_form_view_id" ref="redirect_form"/>
    </record>
 </odoo>
@@ -1,135 +0,0 @@
 import logging
 import pprint
 from werkzeug import urls
 from odoo import _, api, fields, models
 from odoo.exceptions import ValidationError
 from odoo.addons.payment import utils as payment_utils
 _logger = logging.getLogger(__name__)
 class PaymentTransaction(models.Model):
    _inherit = 'payment.transaction'
    btcpay_invoiceId = fields.Char("Invoice Id")
    btcpay_txid = fields.Char("Transaction Id")
    btcpay_status = fields.Char("Transaction Status")
    api_url = '/btcpay/checkout'
    checkout_url = '/btcpay/checkout'
    notify_url = 'payment/btcpay/ipn'
    def _get_specific_rendering_values(self, processing_values):
        """ Override of payment to return Specific rendering values.
        Note: self.ensure_one() from `_get_processing_values`
        :param dict processing_values: The generic and specific processing values of the transaction
        :return: The dict of provider-specific processing values
        :rtype: dict
        """
        res = super()._get_specific_rendering_values(processing_values)
        if self.provider_code != 'btcpay':
            return res
        base_url = self.provider_id.get_base_url()
        _logger.info('Hola! API URL: %s', processing_values)
        partner_first_name, partner_last_name = payment_utils.split_partner_name(self.partner_name)
        return {
            'address1': self.partner_address,
            'amount': self.amount,
            'city': self.partner_city,
            'country': self.partner_country_id.code,
            'currency_code': self.currency_id.name,
            'email': self.partner_email,
            'first_name': partner_first_name,
            'item_name': f"{self.company_id.name}: {self.reference}",
            'item_number': self.reference,
            'last_name': partner_last_name,
            'lc': self.partner_lang,
            'state': self.partner_state_id.name,
            'zip_code': self.partner_zip,
            'api_url':  self.checkout_url,
            'notify_url': base_url + self.notify_url,
        }
    def _get_tx_from_notification_data(self, provider_code, notification_data):
        """ Override of payment to find the transaction based on BTCPay data.
        :param str provider_code: The code of the provider that handled the transaction
        :param dict notification_data: The notification data sent by the provider
        :return: The transaction if found
        :rtype: recordset of `payment.transaction`
        :raise: ValidationError if the data match no transaction
        """
        tx = super()._get_tx_from_notification_data(provider_code, notification_data)
        _logger.info('GET TX FROM NOTIFICATION Notification_data %s', pprint.pformat(notification_data))
        if provider_code != 'btcpay' or len(tx) == 1:
            return tx
        reference = notification_data.get('reference')
        tx = self.search([('reference', '=', reference), ('provider_code', '=', 'btcpay')])
        if not tx:
            raise ValidationError(
                "BTCPay: " + _("No transaction found matching reference %s.", reference)
            )
        return tx
    def _handle_notification_data(self, provider_code, notification_data):
        """ Match the transaction with the notification data, update its state and return it.
        :param str provider_code: The code of the provider handling the transaction.
        :param dict notification_data: The notification data sent by the provider.
        :return: The transaction.
        :rtype: recordset of `payment.transaction`
        """
        tx = self._get_tx_from_notification_data(provider_code, notification_data)
        tx._process_notification_data(notification_data)
        tx._execute_callback()
        return tx
    def _process_notification_data(self, notification_data):
        """ Override of payment to process the transaction based on BTCPay data.
        Note: self.ensure_one()
        :param dict notification_data: The notification data sent by the provider
        :return: None
        :raise: ValidationError if inconsistent data were received
        """
        super()._process_notification_data(notification_data)
        if self.provider_code != 'btcpay':
            return
        _logger.info("_process_notification_data %s", pprint.pformat(notification_data))
        txn_id = notification_data.get('reference')
        if not all(txn_id):
            raise ValidationError(
                "BTCPay: " + _("Missing value for txn_id (%(txn_id)s)).", txn_id=txn_id))
        self.provider_reference = txn_id
        self.btcpay_txid = notification_data.get('txid')
        self.btcpay_status = notification_data.get('status')
        if self.btcpay_status in ['paid','processing']:
            self._set_pending(state_message=notification_data.get('pending_reason'))
        elif self.btcpay_status in ['confirmed', 'complete']:
            self._set_done()
            confirmed_orders = self._check_amount_and_confirm_order()
            confirmed_orders._send_order_confirmation_mail()
        elif self.btcpay_status in ['new']:
            self.btcpay_invoiceId = notification_data.get('invoiceID')
        elif self.btcpay_status in ['cancel','cancelled']:
            self._set_canceled()
        elif self.btcpay_status in ['invalid']:
            _logger.info(
                "received data with invalid payment status (%s) for transaction with reference %s",
                self.btcpay_status, self.reference
            )
            self._set_error(
                "BTCPay: " + _("Received data with invalid payment status: %s", self.btcpay_status)
            )
@@ -1 +0,0 @@
 btcpay-python
@@ -1,87 +0,0 @@
 <html xmlns="http://www.w3.org/1999/html">
 <body>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">BTCPay Gateway</h2>
        <h3 class="oe_slogan">This is the module to connect Odoo 16.0 and Btcpay</h3>
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BTCPayServer_org.png" class="oe_picture oe_screenshot">
            </div>
        </div>
        <div class="oe_span6">
            <p class='oe_mt32'>
            This module allow you to create an easily way to accept Bitcoins
            </p>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Configure Payment Provider</h2>
        <div class="oe_span6">
            <p class='oe_mt32'>
                <ul>
                    <li>Install BTCPay Module -> Website -> eCommerce -> Payment Acquirers -> BTCPay</li>
                    <li>Put your facace. Best option is 'merchant'.</li>
                    <li>Put the location as test or live url. Test example url: https://testnet.demo.btcpayserver.org</li>
                    <li>Put the Confirmation URL where BTCpay will return after payment.</li>
                    <li>Put your "Pairing Code" if you want that system get the "Token", after that "Pairing Code" will be deleted and the "Token" will appear in the corresponding field. You must safe the changes in order that this happens. NOTE: if you want to get new "Token" throw new "Pairing Code", please remove the "Token" field. Keep in mind that "Token" field must be in blank if you want to get throw the API.</li>
                    <li>Put your "Token" if you have it and don't want to use Pairing Code to get it.  Remember, if you want to get throw API please don't write anything here.</li>
                    <li>If you have a Private Key you can write here otherwise system will get when you safe the Payment Provider </li>
                    <li>Remember to Publish On Website</li>
                </ul>
            </p>
        </div>
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BTCPayPaymentSettings.png" class="oe_picture oe_screenshot">
            </div>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">How it looks like?</h2>  
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BTCPayLooksLike.png" class="oe_picture oe_screenshot">
            </div>
        </div>
        <div class="oe_span6">
            <p class='oe_mt32'>
                <ul>
                    In payment webpage where payment methods appear, you will find new payment method called BTCPay.
                    If you click on it you will be redirect to the server that you indicate in location field.
                </ul>
            </p>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Transaction BTCPay Details</h2>  
        <div class="oe_span6">
            <p class='oe_mt32'>
                <ul>
                    In transaction object, you will find more technical information about this method of payment:
                    <li>Transaction Id: cryptocurrency transaction hash for the executed payout.</li>
                    <li>Invoice Id: the id of the invoice for which you want to fetch an event token</li>
                    <li>Transaction Status: That indicates state of transaction</li>
                </ul>
            </p>
        </div>
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BtcpayTxDetails.png" class="oe_picture oe_screenshot">
            </div>
        </div>
    </div>
 </section>
 </body>
 </html>
@@ -1,25 +0,0 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
    <template id="redirect_form">
        <form t-att-action="api_url" method="post">
            <input type="hidden" name="reference" t-att-value="item_number"/>
            <input type="hidden" name="name" t-att-value="first_name"/>
            <input type="hidden" name="email" t-att-value="email"/>
            <input type="hidden" name="street" t-att-value="address1"/>
            <input type="hidden" name="zip" t-att-value="zip_code"/>
            <input type="hidden" name="city" t-att-value="city"/>
            <input type="hidden" name="currency_id" t-att-value="currency_code"/>
            <input type="hidden" name="country" t-att-value="country"/>
            <input type="hidden" name="custom" t-att-value="item_name"/>
            <input type="hidden" name="amount" t-att-value="amount"/>
            <input type="hidden" name="notify_url" t-att-value="notify_url"/>
            <button type="submit" width="100px" t-att-class="submit_class">
                <img t-if="not submit_txt" src="/static/description/icon.png"/>
                <span t-if="submit_txt"> <t t-esc="submit_txt"/> <span class="fa fa-long-arrow-right"/>
                </span>
            </button>
        </form>
    </template>
 </odoo>
@@ -0,0 +1,73 @@
 # BTCPay Server payment gateway for Odoo 18 / 19
 ## This is the module to connect Odoo 18 / 19 and BTCPay Server
 This module allows you to accept bitcoin (and other cryptocurrency) payments in your Odoo e-commerce store.  
 ![BTCPay Server Banner](https://raw.githubusercontent.com/btcpayserver/odoo/18.0/payment_btcpayserver/static/description/BTCPay-Odoo-17-featured.png)
 :::tip
 If you use Odoo 16 you can find the documentation [here](https://github.com/btcpayserver/odoo/blob/16.0/payment_btcpayserver/README.md) and for Odoo 17 [here](https://github.com/btcpayserver/odoo/blob/17.0/payment_btcpayserver/README.md).
 :::
 :::tip
 The following instructions work for Odoo 18 and 19. You just need to make sure to download the matching branch release or use the matching branch (18.0 or 19.0) mentioned in the steps below.
 :::
 ## Install the module
 * Clone our [repository](https://github.com/btcpayserver/odoo) or download the .zip from the [releases page](https://github.com/btcpayserver/odoo/releases)
 * Make sure you are on branch `19.0` (or `18.0`) or downloaded a [release](https://github.com/btcpayserver/odoo/releases) tagged with version v19.x (or v18.x)
 * Place the `payment_btcpayserver` directory in your Odoo addons directory
 * Install dependencies by running `pip install -r requirements.txt` (from inside the `payment_btcpayserver` directory)
 * Restart Odoo
 * Go to Apps -> Update Apps List
 * Remove the "Apps" filter and search for "btcpay"
 * Click **Activate** button
 ## Configure BTCPay as payment provider
 * Go to  **Website** -> **Configuration** -> **Payment Providers**
 * Search for BTCPay and click on button **Activate**
 In the BTCPay settings form, tab "Credentials":
 * Set field "State" to enabled
 * Set field "BTCPay Server URL" as test or live URL including https://. Example URL: https://testnet.demo.btcpayserver.org
 * Get a pairing code from your BTCPay Server store: 
  * Go to: Settings -> Access Tokens
  * Click on "Create Token" button
  * Label: enter e.g. "My odoo store"
  * Public Key: leave empty
  * Click on "Request Pairing" button, on next page click "Approve" button
  * At the top copy the code next to "Server initiated pairing code", e.g. "hg7z8wN"
 * Back in Odoo: paste the code into "Pairing Code" field
 * Hit Tab key on your keyboard (or click on another field) and the pairing process will start automatically
 * When the pairing is successful the "Token" and "Private Key" field will be filled automatically (see screenshot below)
 * Field Facade, keep default 'merchant'.
 On the tab "Configuration":
 * Make sure field "Payment Journal" is set to "Bank", otherwise you can click the dropdown and click on the suggestion "Bank"
 * Now you can **save** the settings
 Check the payment method is enabled:
 * Go to  **Website** -> **Configuration** -> **Payment Methods**
 * Make sure "Pay with Bitcoin / Lightning Network" is active
 Congrats, all done. Do some testing to be sure all works.
 ![Payment Provider Settings](https://raw.githubusercontent.com/btcpayserver/odoo/18.0/payment_btcpayserver/static/description/BTCPayPaymentSettings.png)
 ## How does the payment page look?
 During the checkout the customers will have the option to select the payment method "Pay with Bitcoin / Lightning Network". After selecting they will be redirected to the BTCPay checkout page as shown below.
 ![Checkout page example](https://raw.githubusercontent.com/btcpayserver/odoo/18.0/payment_btcpayserver/static/description/BTCPayLooksLike.png)
 ## Transaction BTCPay Details
 In transaction object, you will find more technical information about this method of payment:
 * Transaction Id: cryptocurrency transaction hash for the executed payout
 * Invoice Id: the id of the invoice for which you want to fetch an event token
 * Transaction Status: That indicates state of transaction
 ![Transaction details of BTCPay](https://raw.githubusercontent.com/btcpayserver/odoo/18.0/payment_btcpayserver/static/description/BtcpayTxDetails.png)
 ## Troubleshooting
 ### The order and transaction status does not get updated to "paid"
 If the BTCPay connection generally works, like redirect to BTCPay checkout page (QR-code) then check your odoo logs and make sure PDF generation generally works. If there are errors mentioning wkhtmltopdf then you need to install `wkhtmltopdf` on your server.
@@ -6,9 +6,9 @@ from . import models
 from odoo.addons.payment import setup_provider, reset_payment_provider
-def post_init_hook(cr, registry):
+def post_init_hook(env):
-    setup_provider(cr, registry, 'btcpay')
+    setup_provider(env, 'btcpayserver')
-def uninstall_hook(cr, registry):
+def uninstall_hook(env):
-    reset_payment_provider(cr, registry, 'btcpay')
+    reset_payment_provider(env, 'btcpayserver')
@@ -1,7 +1,7 @@
 #******************************************************************************
-# PAYMENT BTCPAY FOR ODOO
+# PAYMENT BTCPAY SERVER FOR ODOO
 #
-# Copyright (C) 2023 Susanna Fort <susannafm@gmail.com>
+# Copyright (C) 2024 Susanna Fort <susannafm@gmail.com>, ndeet
 #
 #******************************************************************************
 #
@@ -20,26 +20,30 @@
 #******************************************************************************
 {
-    'name': 'Payment Provider: BTCPay',
+    'name': 'Payment Provider: BTCPay Server',
-    'summary': 'This module integrates BTCPAY - pay with Bitcoin - with Odoo v16.0',
+    'summary': 'This module integrates BTCPAY - pay with Bitcoin - with Odoo v19.0',
-    'author': 'Vandekul',
+    'author': 'BTCPay Server team and contributors',
    'website': 'https://github.com/btcpayserver/odoo',
    'category': 'Accounting/Payment Providers',
-    'version': '16.0.1.0',
+    'version': '19.0.1.1',
    'license': 'GPL-3',
    'currency': 'USD',
    'application': False,
    'installable': True,
    'auto_install': False,
    'depends': ['base', 'account', 'payment'],
    'data': [
-        'views/payment_btcpay_templates.xml',
+        'views/payment_btcpayserver_templates.xml',
        'views/payment_provider_views.xml',
        'views/payment_transaction_views.xml',
        'data/payment_provider_data.xml',
    ],
    'images':  ['static/description/BTCPay-Odoo-17-featured.png'],
    # The BTCPay client (legacy BitPay API) is vendored in models/libs and
    # only requires 'ecdsa' (plus 'requests', shipped with Odoo).
    'external_dependencies': {
-        'python': ['btcpay-python']
+        'python': ['ecdsa']
    },
    'post_init_hook': 'post_init_hook',
    'uninstall_hook': 'uninstall_hook',
-}
+}
@@ -0,0 +1,309 @@
 # ******************************************************************************
 # PAYMENT BTCPAY FOR ODOO
 #
 # Copyright (C) 2020 Susanna Fort <susannafm@gmail.com>
 #
 # ******************************************************************************
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License as
 # published by the Free Software Foundation; either version 2 of
 # the License, or any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # For a full copy of the GNU General Public License see the LICENSE.txt file.
 #
 # ******************************************************************************
 import json
 from werkzeug import urls
 from odoo import _, http
 from odoo.exceptions import ValidationError
 from odoo.http import request
 from odoo.addons.payment.logging import get_payment_logger
 from ..models.libs.client import BTCPayClient
 _logger = get_payment_logger(__name__)
 class BTCPayController(http.Controller):
    _checkout_url = '/btcpay/checkout'
    _notify_url = '/payment/btcpay/ipn'
    _return_url = '/payment/btcpay/return'
    @staticmethod
    def _btcpay_client(provider):
        return BTCPayClient(
            host=provider.btcpay_location,
            pem=provider.btcpay_privateKey,
            tokens={provider.btcpay_facade: provider.btcpay_token},
        )
    @staticmethod
    def _find_transaction(reference):
        return request.env['payment.transaction'].sudo().search([
            ('reference', '=', reference),
            ('provider_code', '=', 'btcpayserver'),
        ], limit=1)
    @staticmethod
    def _lock_transaction(tx_sudo):
        """Lock a transaction until the current database transaction ends.
        Checkout and IPN requests can arrive concurrently. Serializing them on
        the payment transaction prevents two checkout requests from creating
        separate invoices and makes an IPN re-check the invoice ID after a
        checkout replaces an expired invoice.
        """
        tx_sudo.ensure_one()
        tx_sudo.flush_recordset()
        tx_sudo.env.cr.execute(
            "SELECT id FROM payment_transaction WHERE id = %s FOR UPDATE",
            [tx_sudo.id],
        )
        tx_sudo.invalidate_recordset([
            'state', 'btcpay_invoiceId', 'provider_reference',
        ])
    @staticmethod
    def _ensure_invoice_id_is_unique(tx_sudo, invoice_id):
        """Reject an invoice ID already linked to another transaction."""
        other_tx = tx_sudo.env['payment.transaction'].sudo().search([
            ('id', '!=', tx_sudo.id),
            ('provider_code', '=', 'btcpayserver'),
            '|',
            ('btcpay_invoiceId', '=', invoice_id),
            ('provider_reference', '=', invoice_id),
        ], limit=1)
        if other_tx:
            raise ValidationError(_(
                "BTCPay: The invoice is already linked to another transaction."
            ))
    @classmethod
    def _validate_invoice_binding(
            cls, tx_sudo, incoming_invoice_id, incoming_order_id, fetched_invoice):
        """Bind the untrusted IPN payload to one authenticated invoice and transaction."""
        if not isinstance(fetched_invoice, dict):
            raise ValidationError(_("BTCPay: Received an invalid invoice response."))
        fetched_invoice_id = fetched_invoice.get('id')
        fetched_order_id = fetched_invoice.get('orderId')
        if not (
            incoming_invoice_id
            and incoming_invoice_id == fetched_invoice_id
            and incoming_invoice_id == tx_sudo.btcpay_invoiceId
            and incoming_invoice_id == tx_sudo.provider_reference
        ):
            raise ValidationError(_(
                "BTCPay: The notification invoice does not match the transaction."
            ))
        if not (
            incoming_order_id
            and incoming_order_id == fetched_order_id
            and incoming_order_id == tx_sudo.reference
        ):
            raise ValidationError(_(
                "BTCPay: The notification order does not match the transaction."
            ))
        cls._ensure_invoice_id_is_unique(tx_sudo, incoming_invoice_id)
    @classmethod
    def _find_transaction_by_invoice_id(cls, invoice_id):
        """Find exactly one BTCPay transaction from its stored invoice ID."""
        if not isinstance(invoice_id, str) or not invoice_id:
            raise ValidationError(_("BTCPay: Missing invoice ID in notification data."))
        txs_sudo = request.env['payment.transaction'].sudo().search([
            ('provider_code', '=', 'btcpayserver'),
            ('btcpay_invoiceId', '=', invoice_id),
        ], limit=2)
        if len(txs_sudo) != 1:
            raise ValidationError(_(
                "BTCPay: No unique transaction found matching the invoice ID."
            ))
        return txs_sudo
    @staticmethod
    def _validate_invoice_amount(tx_sudo, invoice):
        """Reject reuse of an invoice with a different amount or currency."""
        try:
            amount = float(invoice.get('price'))
        except (AttributeError, TypeError, ValueError):
            amount = None
        if (
            amount is None
            or invoice.get('currency') != tx_sudo.currency_id.name
            or tx_sudo.currency_id.compare_amounts(amount, tx_sudo.amount) != 0
        ):
            raise ValidationError(_(
                "BTCPay: The existing invoice amount or currency does not match the transaction."
            ))
    @classmethod
    def _validate_existing_invoice(cls, tx_sudo, invoice_id, invoice):
        """Validate a stored invoice before redirecting the customer to it."""
        cls._validate_invoice_binding(
            tx_sudo, invoice_id, tx_sudo.reference, invoice,
        )
        if not isinstance(invoice.get('status'), str) or not invoice['status']:
            raise ValidationError(_("BTCPay: The existing invoice response is incomplete."))
    @classmethod
    def _validate_created_invoice(cls, tx_sudo, invoice):
        """Validate a newly created invoice before storing its identity."""
        if not isinstance(invoice, dict):
            raise ValidationError(_("BTCPay: Received an invalid invoice response."))
        invoice_id = invoice.get('id')
        if (
            not isinstance(invoice_id, str)
            or not invoice_id
            or not isinstance(invoice.get('url'), str)
            or not invoice['url']
            or invoice.get('orderId') not in (None, tx_sudo.reference)
        ):
            raise ValidationError(_("BTCPay: The created invoice response is incomplete."))
        cls._ensure_invoice_id_is_unique(tx_sudo, invoice_id)
    @http.route(_checkout_url, type='http', auth='public', methods=['POST'],
                csrf=False, website=True)
    def checkout(self, **data):
        """ Create the BTCPay invoice and redirect the buyer to it.
        The redirect form only carries the transaction reference. The invoice
        price, currency and buyer details are read from the transaction
        server-side and are never taken from the (client-controlled) request
        data, so a buyer cannot have an invoice created for a tampered amount.
        """
        _logger.info("BTCPay: checkout request for transaction %s", data.get('reference'))
        reference = data.get('reference')
        tx_sudo = self._find_transaction(reference)
        if not tx_sudo:
            raise ValidationError(
                _("BTCPay: No transaction found matching reference %s.", reference))
        self._lock_transaction(tx_sudo)
        if tx_sudo.state != 'draft':
            # Already processed (e.g. double submission): fall back to the
            # generic payment status page.
            return request.redirect('/payment/status')
        provider = tx_sudo.provider_id
        base_url = provider.get_base_url()
        client = self._btcpay_client(provider)
        # A browser retry must not create a second payable invoice. Reuse the
        # stored invoice while it remains payable. If it expired, the new ID is
        # stored before the lock is released, so late notifications for the old
        # invoice can no longer select this transaction.
        if tx_sudo.btcpay_invoiceId:
            existing_invoice = client.get_invoice(tx_sudo.btcpay_invoiceId)
            self._validate_existing_invoice(
                tx_sudo, tx_sudo.btcpay_invoiceId, existing_invoice,
            )
            if existing_invoice['status'].lower() != 'expired':
                self._validate_invoice_amount(tx_sudo, existing_invoice)
                if (
                    not isinstance(existing_invoice.get('url'), str)
                    or not existing_invoice['url']
                ):
                    raise ValidationError(_(
                        "BTCPay: The existing invoice response is incomplete."
                    ))
                _logger.info(
                    "BTCPay: reusing invoice %s for transaction %s",
                    tx_sudo.btcpay_invoiceId, tx_sudo.reference,
                )
                return request.redirect(existing_invoice['url'], local=False)
        invoice = client.create_invoice({
            "price": tx_sudo.amount,
            "currency": tx_sudo.currency_id.name,
            "orderId": tx_sudo.reference,
            "token": provider.btcpay_token,
            "redirectURL": urls.url_join(base_url, self._return_url),
            "notificationURL": urls.url_join(base_url, self._notify_url),
            "extendedNotifications": True,
            "buyer": {
                "email": tx_sudo.partner_email or 'noemailavailable@example.com',
                "name": tx_sudo.partner_name,
                "address1": tx_sudo.partner_address,
                "locality": tx_sudo.partner_city,
                "postalCode": tx_sudo.partner_zip,
                "country": tx_sudo.partner_country_id.code,
                "notify": False,
            },
        })
        self._validate_created_invoice(tx_sudo, invoice)
        tx_sudo.write({
            'btcpay_invoiceId': invoice['id'],
            'provider_reference': invoice['id'],
        })
        _logger.info("BTCPay: created invoice %s for transaction %s",
                     invoice['id'], tx_sudo.reference)
        return request.redirect(invoice['url'], local=False)
    @http.route(_notify_url, type='jsonrpc', auth='public', methods=['POST'], csrf=False)
    def btcpay_ipn(self, **post):
        """ BTCPay IPN. """
        _logger.info('BTCPay: IPN received')
        try:
            data = json.loads(request.httprequest.data)
        except (json.JSONDecodeError, TypeError, UnicodeDecodeError):
            _logger.warning("BTCPay: received malformed JSON notification data")
            return ''
        try:
            ipn_data = data.get('data') if isinstance(data, dict) else None
            if not isinstance(ipn_data, dict):
                raise ValidationError(_("BTCPay: Invalid notification data."))
            incoming_invoice_id = ipn_data.get('id')
            incoming_order_id = ipn_data.get('orderId')
            # Never use the untrusted order ID to select a transaction. The
            # stored invoice ID is the lookup key.
            tx_sudo = self._find_transaction_by_invoice_id(incoming_invoice_id)
            client = self._btcpay_client(tx_sudo.provider_id)
            # Fetching through the authenticated API establishes the invoice's
            # current state. Lock afterwards and re-check the stored ID so a
            # concurrent checkout cannot replace it between lookup and use.
            fetched_invoice = client.get_invoice(incoming_invoice_id)
            self._lock_transaction(tx_sudo)
            self._validate_invoice_binding(
                tx_sudo, incoming_invoice_id, incoming_order_id, fetched_invoice,
            )
            _logger.info(
                "BTCPay: verified invoice %s with status %s for transaction %s",
                fetched_invoice.get('id'), fetched_invoice.get('status'), tx_sudo.reference,
            )
            payment_data = {
                "reference": tx_sudo.reference,
                "status": fetched_invoice.get('status'),
                "invoiceID": incoming_invoice_id,
                "txid": fetched_invoice.get('url'),
                # Settled amount and currency, validated against the transaction
                # by the payment framework before it is set done.
                "amount": fetched_invoice.get('price'),
                "currency": fetched_invoice.get('currency'),
            }
            tx_sudo._process('btcpayserver', payment_data)
        except ValidationError as error:
            _logger.warning("BTCPay: rejected notification: %s", error)
        return ''
    @http.route(_return_url, type='http', auth="public", methods=['GET'],
                csrf=False, save_session=False)
    def btcpay_return_from_redirect(self, **data):
        """ BTCPay return """
        _logger.info("BTCPay: user returned to shop after payment")
        return request.redirect('/payment/status')
@@ -0,0 +1,26 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo noupdate="1">
    <record id="payment_method_btcpayserver" model="payment.method">
        <field name="name">Pay with Bitcoin / Lightning Network</field>
        <field name="code">btcpayserver</field>
        <field name="active">True</field>
        <field name="image" type="base64" file="payment_btcpayserver/static/description/icon.png"/>
        <field name="support_tokenization">False</field>
        <field name="support_express_checkout">False</field>
    </record>
    <record id="payment_provider_btcpayserver" model="payment.provider">
        <field name="name">BTCPay Server payments</field>
        <field name="code">btcpayserver</field>
        <field name="image_128" type="base64" file="payment_btcpayserver/static/description/icon.png"/>
        <field name="redirect_form_view_id" ref="redirect_form"/>
        <field name="module_id" ref="base.module_payment_btcpayserver"/>
        <field name="payment_method_ids"
               eval="[Command.set([
                         ref('payment_btcpayserver.payment_method_btcpayserver'),
                     ])]"
        />
    </record>
 </odoo>
@@ -1,17 +1,18 @@
-import logging
+from odoo import api, fields, models
 from odoo import _, api, fields, models
 from .libs.client import BTCPayClient
 from .libs import crypto
-_logger = logging.getLogger(__name__)
+from odoo.addons.payment.logging import get_payment_logger
 _logger = get_payment_logger(__name__)
 class PaymentProvider(models.Model):
    _inherit = 'payment.provider'
    code = fields.Selection(
-        selection_add=[('btcpay', "BTCPay")], ondelete={'btcpay': 'set default'})
+        selection_add=[('btcpayserver', "BTCPay")], ondelete={'btcpayserver': 'set default'})
    btcpay_location = fields.Char(string='BTCPay Server URL', size=64, help='URL where your BTCPay Server instance is reachable (where you log into your BTCPay Server).', default='https://testnet.demo.btcpayserver.org')
    btcpay_pairingCode = fields.Char(string='Pairing Code', help='Create paring Code in your BTCPay server and put here')
@@ -20,16 +21,9 @@ class PaymentProvider(models.Model):
    btcpay_privateKey = fields.Text(string='Private Key', help='Private Key for BTCPay Client. Leave empty, will be autogenerated during pairing.')
    btcpay_facade = fields.Char(string='Facade', help='Token facade type: merchant/pos/payroll. Keep merchant', default='merchant')
    def create(self, values_list):
        if self.code == 'btcpay':
            values_list['btcpay_privateKey'] = crypto.generate_privakey()
        return super(PaymentProvider, self).create(values_list)
    @api.onchange('btcpay_pairingCode')
    def _onchange_pairingCode(self):
-        if not self.btcpay_token and self.code == 'btcpay' and not self.btcpay_pairingCode == '':
+        if not self.btcpay_token and self.code == 'btcpayserver' and self.btcpay_pairingCode:
            #_logger.info("ONCHANGE PAIRING CODE***SELF:  %s %s %s", self.btcpay_location, self.btcpay_privateKey, self.btcpay_pairingCode)
            self.btcpay_privateKey = crypto.generate_privkey()
            client = BTCPayClient(host=self.btcpay_location, pem=self.btcpay_privateKey)
            token = client.pair_client(self.btcpay_pairingCode)
@@ -37,15 +31,12 @@ class PaymentProvider(models.Model):
    @api.onchange('btcpay_token')
    def _onchange_token(self):
-        if self.code == 'btcpay':
+        if self.code == 'btcpayserver':
            self.btcpay_pairingCode = ''
            #_logger.info("ONCHANGE TOKEN")
    @api.onchange('btcpay_location')
    def _onchange_location(self):
-        if self.code == 'btcpay':
+        if self.code == 'btcpayserver':
            self.btcpay_token = ''
            #_logger.info("ONCHANGE LOCATION ***SELF:  %s %s %s", self.btcpay_location, self.btcpay_privateKey, self.btcpay_pairingCode)
            self.btcpay_privateKey = ''
-            self.btcpay_pairingCode = ''
+            self.btcpay_pairingCode = ''
@@ -0,0 +1,136 @@
 import pprint
 from odoo import _, api, fields, models
 from odoo.exceptions import ValidationError
 from odoo.addons.payment.logging import get_payment_logger
 _logger = get_payment_logger(__name__)
 class PaymentTransaction(models.Model):
    _inherit = 'payment.transaction'
    btcpay_invoiceId = fields.Char("Invoice Id")
    btcpay_txid = fields.Char("Transaction Id")
    btcpay_status = fields.Char("Transaction Status")
    def _get_specific_rendering_values(self, processing_values):
        """ Override of payment to return BTCPay-specific rendering values.
        The redirect form only needs to carry the transaction reference: the
        BTCPay invoice is built server-side (see the checkout controller) from
        the transaction, so no amount, currency or buyer data is sent through
        the browser.
        Note: self.ensure_one() from `_get_processing_values`
        :param dict processing_values: The generic and specific processing values of the transaction
        :return: The dict of provider-specific processing values
        :rtype: dict
        """
        res = super()._get_specific_rendering_values(processing_values)
        if self.provider_code != 'btcpayserver':
            return res
        return {
            'api_url': '/btcpay/checkout',
            'reference': self.reference,
            # Keep the pre-19.0.1.1 key during rolling deployments. QWeb
            # templates live in the database, so an instance restarted before
            # the module is upgraded can still render the previous template.
            'item_number': self.reference,
        }
    @api.model
    def _extract_reference(self, provider_code, payment_data):
        """ Override of payment to extract the transaction reference from BTCPay data.
        :param str provider_code: The code of the provider handling the transaction.
        :param dict payment_data: The payment data sent by the provider.
        :return: The transaction reference.
        :rtype: str
        """
        if provider_code != 'btcpayserver':
            return super()._extract_reference(provider_code, payment_data)
        return payment_data.get('reference')
    def _extract_amount_data(self, payment_data):
        """ Override of payment to return the settled amount and currency.
        The amount and currency are read back from BTCPay on notification and
        returned here so that the generic amount validation compares them
        against the transaction. This prevents a tampered or mismatched invoice
        from confirming the transaction (and thus the order).
        :param dict payment_data: The payment data sent by the provider.
        :return: The settled amount data, or ``None`` for other providers.
        :rtype: dict|None
        """
        if self.provider_code != 'btcpayserver':
            return super()._extract_amount_data(payment_data)
        try:
            amount = float(payment_data.get('amount'))
        except (TypeError, ValueError):
            amount = None
        return {
            'amount': amount,
            'currency_code': payment_data.get('currency'),
        }
    def _apply_updates(self, payment_data):
        """ Override of payment to process the transaction based on BTCPay data.
        Note: self.ensure_one() from `_process`
        :param dict payment_data: The payment data sent by the provider.
        :return: None
        """
        if self.provider_code != 'btcpayserver':
            return super()._apply_updates(payment_data)
        _logger.info("BTCPay _apply_updates: %s", pprint.pformat(payment_data))
        if not payment_data.get('reference'):
            raise ValidationError(
                "BTCPay: " + _("Received payment data with missing reference."))
        # Keep both external-reference fields bound to the authenticated
        # BTCPay invoice. The controller validates this identity before
        # entering `_process`.
        if invoice_id := payment_data.get('invoiceID'):
            self.btcpay_invoiceId = invoice_id
            self.provider_reference = invoice_id
        if payment_data.get('txid'):
            self.btcpay_txid = payment_data['txid']
        status = payment_data.get('status')
        self.btcpay_status = status
        if status in ('paid', 'processing'):
            self._set_pending(state_message=payment_data.get('pending_reason'))
        elif status in ('confirmed', 'complete'):
            self._set_done()
        elif status == 'new':
            pass  # Invoice created on BTCPay, waiting for the buyer to pay.
        elif status in ('expired', 'cancel', 'cancelled'):
            self._set_canceled(
                state_message="BTCPay: " + _("Invoice status: %s.", status))
        elif status == 'invalid':
            _logger.warning(
                "Received data with invalid payment status (%s) for transaction with reference %s",
                status, self.reference
            )
            self._set_error(
                "BTCPay: " + _("Received data with invalid payment status: %s.", status)
            )
        else:
            _logger.warning(
                "Received data with unknown payment status (%s) for transaction with reference %s",
                status, self.reference
            )
            self._set_error(
                "BTCPay: " + _("Received data with unknown payment status: %s.", status)
            )
@@ -0,0 +1 @@
 ecdsa
@@ -0,0 +1,194 @@
 <html xmlns="http://www.w3.org/1999/html">
 <body>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">BTCPay Server Gateway</h2>
        <h3 class="oe_slogan">This module allows you to accept Bitcoin / Lightning Network (and other cryptocurrency) payments in your Odoo e-commerce store.</h3>
        <div class="oe_span12">
            <div class="oe_bg_img">
                <img src="BTCPay-Odoo-17-featured.png" class="oe_picture oe_screenshot">
            </div>
        </div>
    </div>
    <div class="oe_row oe_spaced">
        <p class="oe_mt32">
            BTCPay Server for Odoo is a revolutionary, self-hosted, open-source payment gateway to accept Bitcoin payments. Our seamless integration with Odoo allows you to connect your self-hosted BTCPay Server and start accepting Bitcoin payments in just a few simple steps.
        </p>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Features</h2>
        <div class="oe_span12">
            <p class="oe_mt32">
                <ul>
                <li><strong>Zero fees</strong>: Enjoy a payment gateway with no fees. Yes, really!</li>
                <li><strong>Fully automated system</strong>: BTCPay takes care of payments, invoice management and refunds automatically.</li>
                <li><strong>Display Bitcoin QR code at checkout</strong>: Enhance customer experience with an easy and secure payment option.</li>
                <li><strong>No middlemen or KYC</strong>:
                <ul>
                <li>Direct, P2P payments (going directly to your wallet)</li>
                <li>Say goodbye to intermediaries and tedious paperwork</li>
                <li>Transaction information is only shared between you and your customer</li>
                </ul>
                </li>
                <li><strong>Self-hosted infrastructure</strong>: Maintain full control over your payment gateway.</li>
                <li><strong>Direct wallet payments</strong>: Be your own bank with a self-custodial service.</li>
                <li><strong>Lightning Network</strong> integrated out of the box – instant, fast and low cost payments and payouts</li>
                <li><strong>Reporting and accounting</strong> – CSV exports</li>
                <li><strong>Advanced invoice managemen</strong>t and refunding integrated in the WooCommerce UI</li>
                <li><strong>Real-time exchange price tracking</strong> for correct payment amounts</li>
                <li><strong>Versatile plugin system</strong>:
                <ul>
                <li>Extend functionality according to your needs</li>
                <li>Accept payments in altcoins through various plugins</li>
                </ul>
                </li>
                <li><strong>Elegant checkout design</strong>: Compatible with all Bitcoin wallets and enhanced with your store’s logo and branding for a unique UX.</li>
                <li><strong>Point-of-sale</strong> integration – Accept payments in your physical shops</li>
                <li><strong>Multilingual ready</strong>: Serve a global audience right out of the box.</li>
                <li><strong>Top-notch privacy and security</strong>: Protect your and your customers’ data.</li>
                <li><strong>Community-driven support</strong>: Get responsive assistance from our dedicated community (<a href="http://chat.btcpayserver.org" rel="nofollow ugc">Mattermost</a> or <a href="https://t.me/btcpayserver" rel="nofollow ugc">Telegram</a>).</li>
                </ul>
            </p>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Requirements</h2>
        <div class="oe_span12">
            <p class="oe_mt32">
                <ul>
                    <li>Odoo 17 running</li> 
                    <li>eCommerce module enabled</li>
                    <li>You have a BTCPay Server version 1.10.0 or later, either <a href="https://docs.btcpayserver.org/Deployment/">self-hosted</a> or <a href="https://docs.btcpayserver.org/Deployment/ThirdPartyHosting/">hosted by a third-party</a></li>
                    <li><a href="https://docs.btcpayserver.org/RegisterAccount/" class="">You've a registered account on the instance</a></li> 
                    <li><a href="https://docs.btcpayserver.org/CreateStore/" class="">You've a BTCPay store on the instance</a></li> 
                    <li><a href="https://docs.btcpayserver.org/WalletSetup/" class="">You've a wallet connected to your store</a></li>
                </ul>
            </p>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Install the module</h2>
        <div class="oe_span12">
            <p class="oe_mt32">
                <ul>
                    <li>Clone our [repository](https://github.com/btcpayserver/odoo) or download the .zip from the [releases page](https://github.com/btcpayserver/odoo/releases)
                    <li>Make sure you are on branch `17.0` or downloaded a release tagged with version v17.x
                    <li>Place the `payment_btcpayserver` directory in your Odoo addons directory
                    <li>Install dependencies by running `pip install -r requirements.txt` (from inside the `payment_btcpayserver` directory)
                    <li>Restart Odoo
                    <li>Go to Apps -> Update Apps List
                    <li>Remove the "Apps" filter and search for "btcpay"
                    <li>Click **Activate** button
                </ul>
            </p>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Configure BTCPay as payment provider</h2>
        <div class="oe_span6">
            <p class="oe_mt32">
                <ul>
                    <li>Go to <strong>Website</strong> -> <strong>Configuration</strong> -> <strong>Payment Providers</strong></li>
                    <li>Search for BTCPay and click on button <strong>Activate</strong></li>
                </ul>
                <p>In the BTCPay settings form, tab "Credentials":</p>
                <ul>
                    <li>Set field "State" to enabled</li>
                    <li>Set field "BTCPay Server URL" as test or live URL including https://. Example URL: <a href="https://testnet.demo.btcpayserver.org">https://testnet.demo.btcpayserver.org</a></li>
                    <li>Get a pairing code from your BTCPay Server store: Settings -> Access Tokens
                        <ul>
                            <li>Click on "Create Token" button</li>
                            <li>Label: enter e.g. "My odoo store"</li>
                            <li>Public Key: leave empty</li>
                            <li>Click on "Request Pairing" button, on next page click "Approve" button</li>
                            <li>At the top copy the code next to "Server initiated pairing code", e.g. "hg7z8wN"</li>
                        </ul>
                    </li>
                    <li>Back in Odoo, paste the code into "Pairing Code" field</li>
                    <li>Hit Tab key on your keyboard (or click on another field) and the pairing process will start automatically</li>
                    <li>When the pairing is successful the "Token" and "Private Key" field will be filled automatically</li>
                    <li>Field Facade, keep default 'merchant'.</li>
                </ul>
                <p>On the tab "Configuration":</p>
                <ul>
                    <li>Make sure field "Payment Journal" is set to "Bank", otherwise you can click the dropdown and click on the suggestion "Bank"</li>
                    <li>Now you can <strong>save</strong> the settings</li>
                </ul>
                <p>Check the payment method is enabled:</p>
                <ul>
                    <li>Go to <strong>Website</strong> -> <strong>Configuration</strong> -> <strong>Payment Methods</strong></li>
                    <li>Make sure "Pay with Bitcoin / Lightning Network" is active</li>
                </ul>
                <p>Congrats, all done. Do some testing to be sure all works.</p>
            </p>
        </div>
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BTCPayPaymentSettings.png" class="oe_picture oe_screenshot">
            </div>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">How it looks like?</h2>  
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BTCPayLooksLike.png" class="oe_picture oe_screenshot">
            </div>
        </div>
        <div class="oe_span6">
            <p class="oe_mt32">
                <ul>
                    In payment webpage where payment methods appear, you will find new payment method called BTCPay.
                    If you click on it you will be redirect to the server that you indicate in location field.
                </ul>
            </p>
        </div>
    </div>
 </section>
 <section class="oe_container">
    <div class="oe_row oe_spaced">
        <h2 class="oe_slogan">Transaction BTCPay Details</h2>  
        <div class="oe_span6">
            <p class="oe_mt32">
                <ul>
                    In transaction object, you will find more technical information about this method of payment:
                    <li>Transaction Id: cryptocurrency transaction hash for the executed payout.</li>
                    <li>Invoice Id: the id of the invoice for which you want to fetch an event token</li>
                    <li>Transaction Status: That indicates state of transaction</li>
                </ul>
            </p>
        </div>
        <div class="oe_span6">
            <div class="oe_bg_img">
                <img src="BtcpayTxDetails.png" class="oe_picture oe_screenshot">
            </div>
        </div>
    </div>
 </section>
 </body>
 </html>
@@ -0,0 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
    <!-- The redirect form is auto-submitted by the payment framework. It only
         carries the transaction reference; the BTCPay invoice is built
         server-side from the transaction (amount and currency cannot be
         tampered with from the browser). -->
    <template id="redirect_form">
        <form t-att-action="api_url" method="post">
            <input type="hidden" name="reference" t-att-value="reference"/>
        </form>
    </template>
 </odoo>
@@ -7,11 +7,11 @@
        <field name="inherit_id" ref="payment.payment_provider_form"/>
        <field name="arch" type="xml">
            <group name="provider_credentials" position='inside'>
-                <group attrs="{'invisible': [('code', '!=', 'btcpay')]}">
+                <group invisible="code != 'btcpayserver'">
                    <field name="btcpay_location"/>
                    <field name="btcpay_pairingCode"/>
                </group>
-                <group attrs="{'invisible': [('code', '!=', 'btcpay')]}">
+                <group invisible="code != 'btcpayserver'">
                    <field name="btcpay_token"/>
                    <field name="btcpay_privateKey"/>
                    <field name="btcpay_facade"/>
Author	SHA1	Message	Date
ndeet	457455edf0	Backward compatibilty fix.	2026-08-12 22:15:19 +02:00
ndeet	c3d32a04ce	Merge pull request #19 from SatoDri/19.0-fix-security-and-ipn Fix amount tampering, broken IPN URL and invoice status handling (19.0)	2026-08-12 22:11:31 +02:00
Sato DRI	2a470afc5d	Merge pull request #2 from ndeet/satodri-19-fixes Make sure changes from 18.0 are also here:	2026-08-12 09:52:27 +02:00
ndeet	cab44f0847	Make sure changes from 18.0 are also here: * Strict invoice and order identity binding. * IPN lookup by stored invoice ID instead of untrusted order ID. * Invoice ID stored as provider_reference and checked for reuse. * Transaction row locking prevents concurrent duplicate checkouts. * Existing invoices are reused; expired ones are replaced safely. * Late notifications for replaced invoices are ignored. * Reduced sensitive webhook logging and restricted IPN to POST.	2026-08-07 20:22:15 +02:00
SatoDri	303bfce067	Build the BTCPay invoice server-side and validate the settled amount Security: the checkout controller built the BTCPay invoice from the POSTed redirect-form data (price, currency, orderId), and _extract_amount_data returned None to opt out of amount validation, so the settled amount was never checked against the transaction. A buyer could therefore submit an arbitrary price and confirm an order after paying far less. The invoice is now built server-side from the transaction, the redirect form only carries the reference, and _extract_amount_data returns the amount and currency settled on BTCPay (read back from the invoice in the IPN) so the framework validates them against the transaction before it is set done. Other fixes in the notification path: - Fix the IPN notification URL: it was concatenated without a leading slash (base_url + "payment/btcpay/ipn"), producing an unreachable host so notifications never arrived. It is now built with urls.url_join. - Handle the "expired" invoice status (cancel the transaction) instead of leaving it pending forever, and set an error on unknown statuses.	2026-07-20 00:06:39 +02:00
SatoDri	023e4060c5	Remove dead payment.provider create() override The override guarded on self.code, which is empty on the model-level recordset passed to create(), so the branch never ran. The private key is generated during pairing (in the onchange) instead, so the override is dead code; removing it also keeps copying a provider from regenerating (and thus invalidating) an already paired key.	2026-07-20 00:06:39 +02:00
SatoDri	9f3f702c9f	Declare ecdsa as the module Python dependency The bundled BTCPay client (models/libs) imports ecdsa, while the manifest and requirements only listed btcpay-python, which is not used (the client is vendored). Installations that did not already have ecdsa available failed the external-dependency check. Declare ecdsa instead and bump the module version.	2026-07-20 00:06:39 +02:00
ndeet	94eab634ca	Update Readme.	2026-03-30 16:45:20 +02:00
ndeet	225d4c33c5	Odoo 19 compatibilty (#16 ) * Odoo 19 compatibilty. * Update docs.	2026-03-30 16:36:20 +02:00
ndeet	b935000fda	Odoo 18.0 compatibility.	2025-01-27 14:50:53 +01:00
ndeet	dec467e55b	Add troubleshooting to readme.	2024-10-17 13:39:19 +02:00
ndeet	a6b435d7e2	Marketplace: make banner work, updating description.	2024-08-12 16:35:47 +02:00
ndeet	706860e35f	Rename the module for publish on odoo marketplace. (#12 ) * Rename the module for publish on odoo marketplace. * More renaming needed.	2024-08-12 15:33:59 +02:00
ndeet	25b06ab911	Preparing module for app store submission.	2024-08-12 13:30:34 +02:00
ndeet	7994834151	Bumping version.	2024-07-31 14:21:48 +02:00
ndeet	6042284704	Make sure email is passed, also if used in PoS context.	2024-07-31 14:19:23 +02:00
ndeet	848b1f5e30	Updating teaser image also on primary README	2024-07-17 16:55:25 +02:00
ndeet	d3f8e2a60c	Updating teaser image.	2024-07-17 16:51:55 +02:00
ndeet	43920ce700	Replace relative links with full github url.	2024-07-16 15:00:55 +02:00
ndeet	7cb3ee2400	Link to Odoo 16 documentation.	2024-07-16 14:50:30 +02:00
ndeet	8cb6afd918	Fix image for btcpayserver docs embedding.	2024-07-09 11:52:14 +02:00
ndeet	86cf5af6fa	Adding general readme linking to both versions installation instructions.	2024-07-09 11:11:50 +02:00
ndeet	0742b68e48	Update docs to latest changes. (cherry picked from commit `9e2475f415`)	2024-07-09 10:26:33 +02:00
ndeet	0aa893767d	Merge pull request #10 from ndeet/redirect Simplify setup by removing confirmationURL parameter	2024-07-08 16:38:46 +02:00
ndeet	6a22f82a73	Remove customizable return url and redirect the user to order confirmation / payment status page as it would be expected.	2024-07-08 16:37:32 +02:00
ndeet	17cb4f7814	Fix IPN processing to cover additional invoice states.	2024-07-08 11:12:29 +02:00
ndeet	c469a3b4c1	Fix typo.	2024-07-08 09:18:47 +02:00
ndeet	cfbee77a5b	Porting module to work with Odoo 17.0 (#9 )	2024-07-08 09:10:22 +02:00