Refunds: When a refund is issued call CyberSource and issue a refund of the payment

[rhysyngsun]

This will build on the work from #572, which ports the Google Sheets app.

The API for this appears to be here.

Acceptance Criteria

• [ ] When a refund is issued via Google Sheets, within a transaction:
• [ ] Mark the order as refunded
• [ ] Make an API call to CyberSource to refund the payment
  • [ ] Handle failure states of the API request:
  • [ ] If CyberSource indicates that this is a duplicate request, this means we already issued the refund and that we can treat this as a success
  • [ ] If the call to CyberSource fails:
  • [ ] No changes in state should be made (i.e. the learner should not be unenrolled and the spreadsheet should not be updated).
  • [ ] An error should be logged

[rhysyngsun]

@arslanashraf7 If you're looking for the next bit of work to do you could probably implement the CyberSource API call wrappers in a smaller PR before #572 is done.

[arslanashraf7]

@rhysyngsun I was looking through the existing usage of CyberSource in MItxOnline and xPRO and there are a few things I wanted to confirm on this:

• Is it fine to use RC's CyberSource keys for testing this? I also created a test account of my own but I'm confused about the key generation steps (Specifically the error I see says that there is no Security profile which I couldn't find a way to create).
• MITxOnline has been migrated to use the PaymentGateway from ol-django which is not the case for xPRO
  • As of now, the CyberSource gateways have the make payment functionality, Do you think a refund is something that should also go into the ol-django's payment_gateway?
• We also have refunds in xPRO are we porting them over? I suppose currently they don't call CyberSouce refund API?

[rhysyngsun]

@rhysyngsun I was looking through the existing usage of CyberSource in MItxOnline and xPRO and there are a few things I wanted to confirm on this:

* Is it fine to use RC's CyberSource keys for testing this? I also created a test account of my own but I'm confused about the key generation steps (Specifically the error I see says that there is no Security profile which I couldn't find a way to create).

* MITxOnline has been migrated to use the [PaymentGateway from ol-django](https://github.com/mitodl/ol-django/tree/main/src/mitol/payment_gateway) which is not the case for xPRO

Yes that's fine.

  * As of now, the CyberSource gateways have the make payment functionality, Do you think a refund is something that should also go into the `ol-django`'s payment_gateway?

Yes, that makes sense.

* We also have refunds in xPRO are we porting them over? I suppose currently they don't call CyberSouce refund API?

They don't, but we want to add that in MITx Online. Currently it's on the Finance Team to manually enter the refund in CyberSource and we want to automate that so they don't have to deal with it.

[arslanashraf7]

Update:

Looks like there is an existing API client that we might be able to use for the refunds.

In addition, unlike the payment/order with the secure acceptance, we will be using the rest API as mentioned in the ticket and for that, we will need to generate REST keys to be used for the API. Those keys can be created under (Left Menu) -> Payment Configuration -> Key Management.

So, specifically, we will need the values for merchant id, rest secret keys from our RC CyberSource instance.

[rhysyngsun]

@arslanashraf7 since that's maintained by CyberSource that'd definitely be preferred. Given that, use your judgement on whether that warrants being added in ol-django or whether that's not worth the overhead.

Make sure to leave a note for devops to generate the rest keys for RC, they may need to reach out to someone else to get them generated.

[arslanashraf7]

@rhysyngsun Thanks for your opinion. It makes sense to use that client and it's actively maintained so any future updates in their REST APIs will also be catered to that. The client also handles the authentication and all the existing APIs and is lightweight. So using the client is a better option instead of writing our own wrapper over their REST APIs.

@mitodl/devops Can anyone look at this comment for the creation of required values on RC CyberSource.

[jkachel]

FYI: Worked with @shaidar a bit to test out REST API keys, and we now have a set of them for test and production CyberSource instances. The environment variables need to be added in here: https://github.com/mitodl/salt-ops/blob/main/pillar/heroku/mitxonline.sls

[arslanashraf7]

Posting update:

I noticed that we have a refund path from fulfilled orders from django admin as well. Which means as of now there would be two paths to perform a refund: 1- Through google refund sheets 2- Through Django admin (Reference)

So i refactored things in https://github.com/mitodl/mitxonline/pull/599 to atleast handle the refund through Django admin until the sheets are integrated into MITxOnline, so what will happen now is that when we click the Refund Order button from Django Admin's Fulfilled Orders it will hit the refund API and do the local changes to mark an order refunded.

If my assumption about performing the Refund API call from Django Admin is correct the scope of the ticket would need to be updated.

SS from Django Admin:

FYI, @rhysyngsun

[pdpinch]

This worked in my test on RC. Do you think we can close it?

[arslanashraf7]

Great! Yes, Closing it.