Adyen notifications possibly updating wrong payment in multisite

[rvdsteege]

We use the merchant reference in an Adyen payment to find the associated Pronamic Pay payment within WordPress. In for example a multisite, the merchant reference is not always unique. This can result in notification updating payments in one of the other sites.

Possible solutions:

• using multiple merchant accounts at Adyen with webhook notifications configured correctly for each merchant/site;
• we could check if the payment transaction ID matches the Adyen payment pspReference, but this way only the last payment will be able to update the payment status, I'm not 100% sure if that is always desired? Thoughts @remcotolsma?
• checking both merchant reference and merchant order reference before updating the payment status (unfortunately, the merchant order reference is not available in an Adyen notification and it seems it is also not possible to get this included);

Internal Help Scout ticket: https://secure.helpscout.net/conversation/1707408960/23069

[rvdsteege]

Discussed with @remcotolsma and decided to improve on this in https://github.com/pronamic/wp-pronamic-pay/issues/277.