From 161a85fbdd263ba6f44e5423a677c4ad1912f2cc Mon Sep 17 00:00:00 2001
From: Leonardo Matos <leomp120894@gmail.com>
Date: Tue, 27 Oct 2026 23:16:13 -0300
Subject: [PATCH] fix(braspag): Send the card security code to the bank on card
 payments

The CVV input never reached Silent Order Post: a missing quote on the
previous hidden input swallowed it, and its class was `bp-sop-cardcvvc`
(typo from Braspag docs) while the official SOP script reads
`.bp-sop-cardcvv`. Card tokens were created without `SecurityCode`.

Both fixed; verified by running the official `silentorderpost-1.0.js`
on the generated form: the POST now includes `SecurityCode`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011YfvCxVikTh42WGmNu6chf
---
 packages/apps/braspag/assets/braspag-card-client.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/apps/braspag/assets/braspag-card-client.js b/packages/apps/braspag/assets/braspag-card-client.js
index b13d05ebf..dac524971 100644
--- a/packages/apps/braspag/assets/braspag-card-client.js
+++ b/packages/apps/braspag/assets/braspag-card-client.js
@@ -238,8 +238,8 @@
     injectClearSaleScript(fingerprintApp, fingerPrintId);
 
     const elementsForm = `
-    <input type="text" class="bp-sop-cardtype" value="creditCard" style="display: none;>
-    <input type="text" class="bp-sop-cardcvvc" value="${cardClient.cvc}" style="display: none;">
+    <input type="text" class="bp-sop-cardtype" value="creditCard" style="display: none;">
+    <input type="text" class="bp-sop-cardcvv" value="${cardClient.cvc}" style="display: none;">
     <input type="text" class="bp-sop-cardnumber" value="${cardClient.number}" style="display: none;">
     <input type="text" class="bp-sop-cardexpirationdate" value="${cardClient.month.toString()}/20${cardClient.year.toString()}" style="display: none;">
     <input type="text" class="bp-sop-cardholdername" value="${cardClient.name}" style="display: none;">