Urgent! Double invoice created using delayed capture

[sergiuec]

Specs: Adobe Commerce Cloud 2.4.5-p3 PHP 8.1 Worldline_Connect 3.0.2 Configuration: Grouped Cards on Hosted Checkout and delayed capture.

1. Order with an authorization transaction is created

2. When a invoice is created manually from magento backend with online capture two invoices are created and total paid amount is double.

The issue is reproducible in all environments (staging, production, local docker) using either worldline preprod or production mode.

*note: order from screenshots is created in local env in preproduction mode.

[bertterheide]

@sergiuec, I've tried to reproduce this issue on our testing environment, but so far no luck. I do see a difference in order status though. When I place an order with Grouped Cards on the hosted checkout using delayed capture, the order gets the status "Payment Review" (which is what I would expect). I also see a single authorization transaction at that point. After accepting the payment from the admin, a new capture transaction is added.

There was a lot of refactoring done between version 2.7 and 3.0. We did not provide a migration script between these versions, but maybe some configuration was left behind that could cause this behaviour?

[sergiuec]

The module has been reconfigured from scratch. I'm still working on it, meantime there is another warning: Warning: Undefined property: Worldline\Connect\Gateway\Command\ApiErrorHandler::$messageManager in /var/www/html/vendor/ingenico-epayments/connect-extension-magento2/Gateway/Command/ApiErrorHandler.php on line 48

[sergiuec]

Unfortunately I did not have enough time to analyze and fully understand the logic behind but i used to fix the issue by creating a small patch on Magento\Sales\Model\Order\Invoice:register method.

--- a/vendor/magento/module-sales/Model/Order/Invoice.php   
+++ b/vendor/magento/module-sales/Model/Order/Invoice.php
@@ -617,6 +617,9 @@

         $order = $this->getOrder();
         $captureCase = $this->getRequestedCaptureCase();
+        if (null === $this->getState()) {
+            $this->setState(\Magento\Sales\Model\Order\Invoice::STATE_OPEN);
+        }

Basically the method \Magento\Sales\Model\Order\Payment\Operations\AbstractOperation::getInvoiceForTransactionId returns false as the $invoice->getTransactionId() and $invoice->getState() both are null and this is why \Magento\Sales\Model\Order\Payment\Operations\RegisterCaptureNotificationOperation::registerCaptureNotification prepares and register a new invoice object even another one is already prepared and registered. Looks like this class which extends \Magento\Sales\Model\Order\Payment\Operations\AbstractOperation is created in order to be rewritten by the 3rd party pgw modules in case is necessary to implement custom logic for registerCaptureNotification() or getInvoiceForTransactionId() methods.

[sergiuec]

Hello, I used to do a test of the module on vanilla Magento 2.4.5-p3. If the default module flow is used then the issue is not reproducible, but this flow is unusual as it puts the order in "Payment Review" status and state "payment_review" which practically locks the order and no movements cand be made on it until the payment is accepted which means that capture is made which for example for us is not acceptable. We must process it, export it somewhere, create shipment and then capture the money. In fact the issue occurs because we have a module which after order is placed exports it to external system and moves the order in a custom status (in our case "Exported") and state "processing" (which is usual and absolutely normal flow in magento. e.g. stripe, nexi, paypal respects this flow and there are no problems with those pgw's).

To replicate the issue is enough to change the status from "payment_review" to "processing" (it doesn't matter how, even directly from db) and then create the invoice.

So, for me the issue is clear now. Sorry but i have to say that and that's valid for all the developers: please keep in mind that when you develop an extension/module for any custom platform/framework that platform/framework is the "master", NOT YOUR EXTENSION. You must respect all other developers and keep in mind the recommended best practices and extensibility. The issue can be closed.

[bertterheide]

@sergiuec thank you for your elaborate comment and for your time on reproducing the issue. FWIW: I do not have inside knowledge about the OMS in play, but it’s very common to export an order to it after it has been paid (e.g. has the status Processing) because an order could also get canceled (and as such would have no need for shipments). I’m not sure if this would be applicable to your situation though.

[sergiuec]

Sorry, but I think you don't understand how logicly "Payment review", "Suspected Fraud" statuses, which are both associated with the "payment_review" state, are used in magento. Just take a look at klarna or paypal modules. This status is used to block the OMS automatic flow when a payment needs additional human verification. Payment authorization can be used in thousands of different ways to manage order and create a custom flow, e.g. in our case, which is a full outsourcing management we can't capture money before the order is processed and set for shipping, or at least we must ship the order immediately after it was captured. The client, legally, can't capture and create the invoice today and ship the order in 3 days, which often happens when the order is placed on the weekend. So, legally, they must accept the order, check the availability if necessary, prepare it for shipping and then capture the money and ship it. The point here is that following all other pgw's logics and magneto logic we associated all our custom statuses like "ready to be exported", "Exported", "In OMS", "Ready for ship" and so on, to the state "processing" and it's automatically processed without any human intervention. We expect to see "Payment review" status when there are doubts with payment, and it must be checked in the ingenico console before moving it forward. I'm not sure you understand what i'm talking about but what i'm trying to say is that now we are forced to implement a custom flow for worldline and find a way to manage "suspected fraud", "payment review" differently than other gateways.

P.S. Please take a look also at credit memos because the status is not updated and all credit memos remain in "pending" status forever, even the credit memo was manually accepted. In my case I have already created a cron which checks the credit memo status and updates it accordingly.

On Thu, Jul 20, 2023 at 3:25 PM ekupa @.***> wrote:

@sergiuec https://github.com/sergiuec, the PAYMENT_REVIEW is logically tied to delayed capture payment action (configurable per payment method) ; in case it's set to direct capture, the status is PROCESSING (in case of successful transaction). Can you please check this setup under the Configuration of the plugin?

— Reply to this email directly, view it on GitHub https://github.com/Ingenico-ePayments/connect-extension-magento2/issues/30#issuecomment-1643923281, or unsubscribe https://github.com/notifications/unsubscribe-auth/ARDAE25CPJOJWERMYJ55FBDXREWUXANCNFSM6AAAAAAZ6ENL5M . You are receiving this because you were mentioned.Message ID: @.*** .com>

--

Sergiu RoMagento Developer

Eurostep Commerce Srl Tel. +39 0423 23917 | Fax +39 0423 1912062 https://www.eurostep.it

Le informazioni trasmesse sono destinate esclusivamente alla persona o alla società in indirizzo e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a persone o società differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. Information contained and transmitted by this e-mail is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged and confidential. Each transmission or diffusion of these information to different Person or society is forbidden. If you have received this communication in error, please delete this e-mail from any others computer and contact the sender.

[sergiuec]

Another issue which derives from your logic and implemented flow, at least for us it's a big issue: the partial capture is not working anymore. If payment is in "Payment review" status you can or "Accept payment" or "Deny Payment" you can't capture only a part of total amount and if we move the status to "processing" and create a partial invoice this will capture the entire amount. The partial capture was available in the version 2.x of the module.

On Thu, Jul 20, 2023 at 5:14 PM Sergiu Ropot @.***> wrote:

Sorry, but I think you don't understand how logicly "Payment review", "Suspected Fraud" statuses, which are both associated with the "payment_review" state, are used in magento. Just take a look at klarna or paypal modules. This status is used to block the OMS automatic flow when a payment needs additional human verification. Payment authorization can be used in thousands of different ways to manage order and create a custom flow, e.g. in our case, which is a full outsourcing management we can't capture money before the order is processed and set for shipping, or at least we must ship the order immediately after it was captured. The client, legally, can't capture and create the invoice today and ship the order in 3 days, which often happens when the order is placed on the weekend. So, legally, they must accept the order, check the availability if necessary, prepare it for shipping and then capture the money and ship it. The point here is that following all other pgw's logics and magneto logic we associated all our custom statuses like "ready to be exported", "Exported", "In OMS", "Ready for ship" and so on, to the state "processing" and it's automatically processed without any human intervention. We expect to see "Payment review" status when there are doubts with payment, and it must be checked in the ingenico console before moving it forward. I'm not sure you understand what i'm talking about but what i'm trying to say is that now we are forced to implement a custom flow for worldline and find a way to manage "suspected fraud", "payment review" differently than other gateways.

P.S. Please take a look also at credit memos because the status is not updated and all credit memos remain in "pending" status forever, even the credit memo was manually accepted. In my case I have already created a cron which checks the credit memo status and updates it accordingly.

On Thu, Jul 20, 2023 at 3:25 PM ekupa @.***> wrote:

@sergiuec https://github.com/sergiuec, the PAYMENT_REVIEW is logically tied to delayed capture payment action (configurable per payment method) ; in case it's set to direct capture, the status is PROCESSING (in case of successful transaction). Can you please check this setup under the Configuration of the plugin?

— Reply to this email directly, view it on GitHub https://github.com/Ingenico-ePayments/connect-extension-magento2/issues/30#issuecomment-1643923281, or unsubscribe https://github.com/notifications/unsubscribe-auth/ARDAE25CPJOJWERMYJ55FBDXREWUXANCNFSM6AAAAAAZ6ENL5M . You are receiving this because you were mentioned.Message ID: <Ingenico-ePayments/connect-extension-magento2/issues/30/1643923281@ github.com>

--

Sergiu RoMagento Developer

Eurostep Commerce Srl Tel. +39 0423 23917 | Fax +39 0423 1912062 https://www.eurostep.it

Le informazioni trasmesse sono destinate esclusivamente alla persona o alla società in indirizzo e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a persone o società differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. Information contained and transmitted by this e-mail is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged and confidential. Each transmission or diffusion of these information to different Person or society is forbidden. If you have received this communication in error, please delete this e-mail from any others computer and contact the sender.

--

Sergiu RoMagento Developer

Eurostep Commerce Srl Tel. +39 0423 23917 | Fax +39 0423 1912062 https://www.eurostep.it

Le informazioni trasmesse sono destinate esclusivamente alla persona o alla società in indirizzo e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a persone o società differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. Information contained and transmitted by this e-mail is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged and confidential. Each transmission or diffusion of these information to different Person or society is forbidden. If you have received this communication in error, please delete this e-mail from any others computer and contact the sender.

[bertterheide]

@sergiuec, we've adjusted the module to support the capture flow instead of the accept / deny payment. You should now be able to do a partial capture.

[sergiuec]

now i'm getting the following errors on checkout page: GET ..../Worldline_Connect/js/build/connectsdk.noEncrypt.min.js 404 (Not Found) ..../it-it/checkout/#payment:1 Refused to execute script from .../Worldline_Connect/js/build/connectsdk.noEncrypt.min.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled. Failed to load the "Worldline_Connect/js/view/payment/method-renderer/cards" component.

and the module doesn't work.

On Wed, Aug 2, 2023 at 4:29 PM Bert ter Heide @.***> wrote:

@sergiuec https://github.com/sergiuec, we've adjusted the module to support the capture flow instead of the accept / deny payment. You should now be able to do a partial capture.

— Reply to this email directly, view it on GitHub https://github.com/Ingenico-ePayments/connect-extension-magento2/issues/30#issuecomment-1662317413, or unsubscribe https://github.com/notifications/unsubscribe-auth/ARDAE2YECVTJDIDKZZC3IBDXTJP27ANCNFSM6AAAAAAZ6ENL5M . You are receiving this because you were mentioned.Message ID: @.*** .com>

--

Sergiu RoMagento Developer

Eurostep Commerce Srl Tel. +39 0423 23917 | Fax +39 0423 1912062 https://www.eurostep.it

Le informazioni trasmesse sono destinate esclusivamente alla persona o alla società in indirizzo e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a persone o società differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. Information contained and transmitted by this e-mail is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged and confidential. Each transmission or diffusion of these information to different Person or society is forbidden. If you have received this communication in error, please delete this e-mail from any others computer and contact the sender.

[sergiuec]

OK, so I found this new line in the readme file npm install --prefix vendor/ingenico-epayments/connect-extension-magento2. Let's say I will manage somehow to install npm in Adobe commerce Cloud, there is pwa and hyva which also requires npm and hope I'll find some documentation. But there comes another problem: with "direct payment", in pre-production mode all the orders are set in "Suspected fraud" status and when Accept payment button is clicked the following error is thrown:

HTTP: 400 Message: PAYMENT IS NOT CHALLENGED. MERCHANTID xxxxx, ORDERID xxxxxxxx, EFFORTID 1 The server returned an error. We can't update the payment right now.

Two transactions are created [image: image.png] and later when you click "Get payment update" you get the message "Transaction has been approved." and order goes to "Processing" status.

Of course I can't go with all those problems in production and test it.

On Thu, Aug 3, 2023 at 11:41 AM Sergiu Ropot @.***> wrote:

now i'm getting the following errors on checkout page: GET ..../Worldline_Connect/js/build/connectsdk.noEncrypt.min.js 404 (Not Found) ..../it-it/checkout/#payment:1 Refused to execute script from .../Worldline_Connect/js/build/connectsdk.noEncrypt.min.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled. Failed to load the "Worldline_Connect/js/view/payment/method-renderer/cards" component.

and the module doesn't work.

On Wed, Aug 2, 2023 at 4:29 PM Bert ter Heide @.***> wrote:

@sergiuec https://github.com/sergiuec, we've adjusted the module to support the capture flow instead of the accept / deny payment. You should now be able to do a partial capture.

— Reply to this email directly, view it on GitHub https://github.com/Ingenico-ePayments/connect-extension-magento2/issues/30#issuecomment-1662317413, or unsubscribe https://github.com/notifications/unsubscribe-auth/ARDAE2YECVTJDIDKZZC3IBDXTJP27ANCNFSM6AAAAAAZ6ENL5M . You are receiving this because you were mentioned.Message ID: <Ingenico-ePayments/connect-extension-magento2/issues/30/1662317413@ github.com>

--

Sergiu RoMagento Developer

Eurostep Commerce Srl Tel. +39 0423 23917 | Fax +39 0423 1912062 https://www.eurostep.it

Le informazioni trasmesse sono destinate esclusivamente alla persona o alla società in indirizzo e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a persone o società differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. Information contained and transmitted by this e-mail is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged and confidential. Each transmission or diffusion of these information to different Person or society is forbidden. If you have received this communication in error, please delete this e-mail from any others computer and contact the sender.

--

Sergiu RoMagento Developer

Eurostep Commerce Srl Tel. +39 0423 23917 | Fax +39 0423 1912062 https://www.eurostep.it

Le informazioni trasmesse sono destinate esclusivamente alla persona o alla società in indirizzo e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a persone o società differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. Information contained and transmitted by this e-mail is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged and confidential. Each transmission or diffusion of these information to different Person or society is forbidden. If you have received this communication in error, please delete this e-mail from any others computer and contact the sender.