Adyen: Fail unexpected 3DS responses

lib/active_merchant/billing/gateways/adyen.rb

@@ -471,7 +471,7 @@ def commit(action, parameters, options)
           raw_response = e.response.body
           response = parse(raw_response)
         end
-        success = success_from(action, response)
+        success = success_from(action, response, options)
         Response.new(
           success,
           message_from(action, response),
@@ -520,7 +520,12 @@ def request_headers(options)
         headers
       end
 
-      def success_from(action, response)
+      def success_from(action, response, options)
+        if ['RedirectShopper', 'ChallengeShopper'].include?(response.dig('resultCode')) && !options[:execute_threed] && !options[:threed_dynamic]
+          response['refusalReason'] = 'Received unexpected 3DS authentication response. Use the execute_threed and/or threed_dynamic options to initiate a proper 3DS flow.'
+          return false
+        end
+
         case action.to_s
         when 'authorise', 'authorise3d'
           ['Authorised', 'Received', 'RedirectShopper'].include?(response['resultCode'])

test/remote/gateways/remote_adyen_test.rb

@@ -264,6 +264,16 @@ def test_successful_authorize_with_3ds_dynamic_rule_broken
     assert_equal response.params['resultCode'], 'Authorised'
   end
 
+  # Fail in situations where neither execute_threed nor dynamic_threed is
+  # present, but the account is set to dynamic 3ds and it is triggered. This
+  # test assumes a Dynamic 3DS rule set for the Adyen test account to always
+  # perform 3ds auth for an amount of 8484
+  def test_purchase_fails_on_unexpected_3ds_initiation
+    response = @gateway.purchase(8484, @three_ds_enrolled_card, @options)
+    assert_failure response
+    assert_match 'Received unexpected 3DS authentication response', response.message
+  end
+
   def test_successful_purchase_with_auth_data_via_threeds1_standalone
     eci = '05'
     cavv = '3q2+78r+ur7erb7vyv66vv\/\/\/\/8='

test/unit/gateways/adyen_test.rb

@@ -149,6 +149,13 @@ def test_successful_authorize_with_3ds
     refute response.params['paRequest'].blank?
   end
 
+  def test_failed_authorize_with_unexpected_3ds
+    @gateway.expects(:ssl_post).returns(successful_authorize_with_3ds_response)
+    response = @gateway.authorize(@amount, @three_ds_enrolled_card, @options)
+    assert_failure response
+    assert_match 'Received unexpected 3DS authentication response', response.message
+  end
+
   def test_successful_authorize_with_recurring_contract_type
     stub_comms do
       @gateway.authorize(100, @credit_card, @options.merge({recurring_contract_type: 'ONECLICK'}))