Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(payments): Add platform merchant account checks for payment intent #7204

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

ThisIsMani
Copy link
Contributor

Type of Change

  • Bugfix
  • New feature
  • Enhancement
  • Refactoring
  • Dependency updates
  • Documentation
  • CI/CD

Description

Currently payment_intent stores platform_merchant_id. This can be used to identify if the payment was created by platform merchant.

If the payment was initialized by platform merchant, the merchant who is the owner of the payment should not be able to do any operations on the payment and vice versa.

So, we need those validations on payment intents to check if the current merchant can be allowed to perform those operations even if the authentication module allows it.

These payment ops are modified in the process.

Operation Validation Added Auth Used
Payment Approve Yes JWT + API Key
Payment Cancel Yes API Key
Payment Capture Yes API Key
Complete Authorize No Client Secret + API Key
Payment Confirm No Client Secret + API Key
Payment Reject Yes API Key
Payment Post Session Tokens No Publishable Key Auth
Payment Session No Publishable Key Auth
Payment Start No Merchant ID Auth
Payment Status No Client Secret + API Key + JWT
Payment Update No Publishable Key Auth + API Key
Payment Update Intent Yes API Key
Payment Incremental Authorization Yes API Key
Payment Session Update / Tax Calculation No Publishable Key Auth
Payment Create No API Key + JWT
Payment Intent Create No API Key + JWT
Payment Session Intent No Publishable Key Auth
Payment Get Intent Yes API Key
Payment Confirm Intent No Publishable Key Auth
Payment Get Yes API Key + JWT
Payment Capture V2 Yes API Key + JWT
Payment Get Intent Yes API Key

Additional Changes

  • This PR modifies the API contract
  • This PR modifies the database schema
  • This PR modifies application configuration/environment variables

Motivation and Context

Closes #7203.

How did you test it?

todo!()

Checklist

  • I formatted the code cargo +nightly fmt --all
  • I addressed lints thrown by cargo clippy
  • I reviewed the submitted code
  • I added unit tests for my changes where possible

@ThisIsMani ThisIsMani added A-core Area: Core flows S-waiting-on-review Status: This PR has been implemented and needs to be reviewed C-refactor Category: Refactor labels Feb 6, 2025
@ThisIsMani ThisIsMani self-assigned this Feb 6, 2025
@ThisIsMani ThisIsMani requested review from a team as code owners February 6, 2025 13:49
Copy link

semanticdiff-com bot commented Feb 6, 2025

Review changes with  SemanticDiff

Changed Files
File Status
  crates/router/src/core/payments/operations/payment_capture_v2.rs  39% smaller
  crates/router/src/core/payments/operations/payment_get.rs  39% smaller
  crates/router/src/core/payments/operations/payment_session_intent.rs  2% smaller
  crates/router/src/core/payments/operations/payment_update_intent.rs  1% smaller
  crates/router/src/core/payments/helpers.rs  0% smaller
  crates/router/src/core/payments/operations/payment_approve.rs  0% smaller
  crates/router/src/core/payments/operations/payment_cancel.rs  0% smaller
  crates/router/src/core/payments/operations/payment_capture.rs  0% smaller
  crates/router/src/core/payments/operations/payment_complete_authorize.rs  0% smaller
  crates/router/src/core/payments/operations/payment_confirm.rs  0% smaller
  crates/router/src/core/payments/operations/payment_confirm_intent.rs  0% smaller
  crates/router/src/core/payments/operations/payment_get_intent.rs  0% smaller
  crates/router/src/core/payments/operations/payment_post_session_tokens.rs  0% smaller
  crates/router/src/core/payments/operations/payment_reject.rs  0% smaller
  crates/router/src/core/payments/operations/payment_session.rs  0% smaller
  crates/router/src/core/payments/operations/payment_start.rs  0% smaller
  crates/router/src/core/payments/operations/payment_status.rs  0% smaller
  crates/router/src/core/payments/operations/payment_update.rs  0% smaller
  crates/router/src/core/payments/operations/payments_incremental_authorization.rs  0% smaller
  crates/router/src/core/payments/operations/tax_calculation.rs  0% smaller
  crates/router/src/routes/payment_methods.rs  0% smaller

@@ -3419,6 +3419,27 @@ pub(crate) fn validate_payment_status_against_not_allowed_statuses(
})
}

pub fn validate_platform_merchant(
data_platform_merchant_id: Option<&id_type::MerchantId>,
auth_platform_merchant_id: Option<&id_type::MerchantId>,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can add a trait function to get the platform merchant id and then any generic that implements this trait can be passed to this function

) -> CustomResult<(), errors::ApiErrorResponse> {
match (data_platform_merchant_id, auth_platform_merchant_id) {
(Some(data_platform_merchant_id), Some(auth_platform_merchant_id)) => {
if data_platform_merchant_id != auth_platform_merchant_id {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: you can use fp_utils::when

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-core Area: Core flows C-refactor Category: Refactor S-waiting-on-review Status: This PR has been implemented and needs to be reviewed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feat(vsass): Add platform merchant validations for payment intent
2 participants