Payments are authorized and captured on order placement

[aadmathijssen]

When a customer places an order in the checkout for the iDEAL payment method, the order is immediately marked as authorized and captured. As a result the order is automatically invoiced and marked as paid. This all happens before the customer actually finishes (or declines!) his/her payment.

This issue has multiple serious consequences: an order that is not paid yet cannot be distinguished from orders that are correctly paid; when certain actions jobs are triggered on invoice generation / order payment, they will be executed even though the payment might never be actually fulfilled.

The problem seems to originate from the following lines of code:

namespace Stripeofficial\IDeal\Model;
class Adapter extends \Magento\Payment\Model\Method\Adapter
{
    public function getConfigPaymentAction()
    {
        return 'authorize_capture';
    }
}

This is incorrect. First of all, the <payment_action> config setting should have been respected (which is the default behaviour of the getConfigPaymentAction method).

This setting is currently set to authorize:

<payment_action>authorize</payment_action>

This is still incorrect, as the payment is not yet authorized after pressing the place order button.

The value should be order.

See for instance the corresponding setting in the following Magento 2 PSP plugins that support iDEAL:

• Mollie: https://github.com/mollie/magento2/blob/v1.5.0/etc/config.xml#L71
• Buckaroo: https://github.com/tig-nl/buckaroo-magento2/blob/v1.9.1/etc/config.xml#L69
• Pay.nl: https://github.com/paynl/magento2-plugin/blob/v1.4.10/etc/config.xml#L251

These modules also set the order status to pending (or pending_payment), and not to processing, which also adds up the confusion.

Could you please have a look at this?

Thanks.

[vphat28]

Hi, should be fixed in new version, keep me posted

[aadmathijssen]

Hi,

Thanks for the fix.

I do have two questions/remarks:

1. The order state/status is set to new/pending. Please use pending_payment/pending_payment; this better represents the actual state the order is in.
2. The payment action is still authorize where I would have expected order. The concept of authorization does not really exists for iDEAL payments (only capturing). Or is it that the Stripe platform requires an authorization directly after order placement?

Could you please have a look at this?

Thanks.

Aad