search

balanced / balanced-api

Balanced API specification.
220 stars 72 forks source link

Void holds / transactions that return 500s to ensure they do not double-charge #569

Open rserna2010 opened 10 years ago

rserna2010 commented 10 years ago

Last week a brief timeout issue with the processor resulted in a few cases of the API returning 500s when the holds were actually created.

For instance this request returned a 500: /marketplaces/MP5XOMoofNUnxrzFZxUBZPR6/logs/OHMe1bf6a9ec0d211e395cf06429171ffad

But successfully resulted in the creation of the following hold: /marketplaces/MP5XOMoofNUnxrzFZxUBZPR6/holds/HL7AeslA5E2g9MuA21ssPmvF

It has been requested by a customer that if

  1. an API call to create a hold results in a 500
  2. then afterwards the hold goes through then the hold be voided to ensure a 500 means a hold failed. Thereby preventing accidental double charges.
steveklabnik commented 10 years ago

I am very skeptical about this kind of thing, but wanted to get it here for completeness' sake.

jkwade commented 10 years ago

@steveklabnik you're skeptical about the fact that this happened? I'm hearing reports from at least one other MP in addition to the one @rserna2010 mentioned.

@mahmoudimus I'd like to escalate the task of figuring out the scope of the effected transactions to urgent.

mahmoudimus commented 10 years ago

@jkwade ok, @remear @cieplak and @rserna2010 can help you there. TOGETHER - they make up Captain Support Team

jkwade commented 10 years ago

K, @remear @cieplak @rserna2010: Can I get a report of transactions that occurred during the processor timeout and were returned a 500, so we can being investigating which of them resulted in an actual hold?

steveklabnik commented 10 years ago

@jkwade I am skeptical that we can effectively prevent duplicate transactions. That's how the web works.

mahmoudimus commented 10 years ago

@steveklabnik we can do it if we use idempotent request ids

mahmoudimus commented 10 years ago

@steveklabnik instead of issuing a POST, issue a PUT to an appropriate URI

steveklabnik commented 10 years ago

Yes, in theory, that would work.

mjallday commented 10 years ago

@jkwade I am skeptical that we can effectively prevent duplicate transactions. That's how the web works.

this is not the customer doing a double submission, that we cannot (easily) prevent. this is something internal to the Balanced system retrying a failed request. we should be able to prevent our own systems from doing this.

steveklabnik commented 10 years ago

Okay, @mjallday yes, I agree now. I misunderstood what was originally being asked. A 500 where it actually worked successfully shouldn't be a problem to fix.