solidusio / solidus_stripe

💳 Integrate Solidus with Stripe
https://stripe.com
BSD 3-Clause "New" or "Revised" License
37 stars 61 forks source link

Removing the confirm step causes stripe failed payments (due to 3DS) to show up as paid #313

Open ulysses-bull opened 1 year ago

ulysses-bull commented 1 year ago

If you remove the checkout confirmation step and a 3D secure is needed, the order will be completed with payment status "paid" without the 3D secure popup appearing, but in Stripe dashboard the payment will have the status "requires_action".

Solidus Version: 4.0.0

To Reproduce

  1. Setup a new store with the starter front end and stripe
  2. Remove the confirmation step from the checkout flow, as suggested in the guides
    
    #app/overrides/my_app/spree/order/remove_checkout_step.rb
    # frozen_string_literal: true

module MyApp module Spree module Order module RemoveCheckoutStep def self.prepended(base) base.remove_checkout_step :confirm end

    ::Spree::Order.prepend self
  end
end

end end


3. Create an order and pay using a stripe [test card](https://stripe.com/docs/testing?testing-method=card-numbers#regulatory-cards) that requires a 3DS Challenge.

**Current behavior**
The order will be completed with payment status "paid" even if the 3D secure challenge has never been presented.

**Expected behavior**
Ideally, a 3DS pop-up should appear when the users tries to advance from the payment step. Since removing the confirm step could be considered a significant modification of the default/supported checkout flow, it might be reasonable to expect developers to handle presenting the 3DS challenge themselves, but, displaying a payment as paid when this was never the case on stripe's side is probably a bug.

**Screenshots**
Screenshot of expected pop-up:
![Captura de tela 2023-08-11 141651](https://github.com/solidusio/solidus_stripe/assets/69528786/90d6f63d-4b18-43e1-ab61-508ff9fdc079)

**Additional context**
Currently, due to the acceptable transitions in the order state machine, removing the confirmation step will also raise an exception if a payment fails, as the order will attempt to transition from payment to payment_failed, which is not currently allowed.