Payment taken if authorized after order cycle closes

[andrewpbrett]

Description

If a customer authorizes a payment after an order cycle closes, the payment is processed on Stripe but not marked as paid in OFN

Expected Behavior

The payment should be refunded and the order canceled

Actual Behaviour

The payment is taken and the order remains in the payment state

Steps to Reproduce

See also #7692 (comment)

1. Place an order using a card that always requires SCA authorization
2. While on the SCA authorization page, in another window, close the order cycle
3. Authorize payment
4. Get redirected to OFN and then the shop page, get notified that the order cycle has closed

Animated Gif/Screenshot

See #7692 (comment)

Workaround

Severity

bug-s3: a feature is broken but there is a workaround

Your Environment

• Version used:
• Browser name and version:
• Operating System and version (desktop or mobile):

Possible Fix

[andrewpbrett]

This does have to do with payments, which would normally be an S2+, however, I don't think there's any reason to think that this has ever happened in production. @filipefurtad0 noticed that it was possible while testing another PR. Given that, I'm marking it an S3. Others feel free to weigh in/escalate though.

[filipefurtad0]

Thanks for opening this issue @andrewpbrett 👍

An additional note: payments are marked as authorized but not captured - so they are not really taken.

As of now, I have no evidence that the payment is captured after a week; At least in testing, these seem to be cancelled automatically - such authorized payments from previous tests got cancelled automatically (pic below taken from this comment):

[andrewpbrett]

I have no evidence that the payment is captured after a week

I agree, I think that was lost in translation. The Stripe docs indicate that any payment that's not captured after a week will be canceled.

[filipefurtad0]

The steps to reproduce now trigger the warning introduced here:
#6755 🎉

But the payment seems not to be created at all, and as such does not appear on Stripe dashboard as uncaptured, which is good 👍

I'd close this issue as the #7692 (comment) seems not to create a bug anymore.