Paypal Express - Payment Captured without corresponding SFCC order

[KennethRobbeFrucon]

Describe the bug
The Paypal Express-flow sometimes results in captured payments inside Adyen without a corresponding order inside SFCC. This is due to the following:

• The flow doesn't validate the contents of the basket like it is normally done inside the checkout flow (i.e. inside Checkout-PlaceOrder through the use of basketValidationHelpers). This allows customers to checkout with products that went offline or out of stock since they started the Paypal Express session.
• The flow just saves the shopper details once the customer clicks "Pay" in the pop-up (onShopperDetails-callback). It doesn't do any additional validation that the order can be placed successfully.
• It is only when the pop-up closes (onAdditionalDetails-callback) that the PaymentDetails-call is made and order creation is attempted (logic in src\cartridges\int_adyen_SFRA\cartridge\adyen\scripts\expressPayments\paypal\makeExpressPaymentDetailsCall.js)
• The PaymentDetails-call towards Adyen is done first, which results in the payment being registered / captured inside Adyen.
• Order creation inside SFCC is only attempted afterwards. This order creation can fail when no inventory is available for the order (which can happen because it wasn't validated first). This triggers a database rollback, so no order is actually created at the side of SFCC (not even a failed one).
• The customer does see an error, but the payment still went through. As no order exists at the side of SFCC, this makes it harder to follow up.

To Reproduce
Steps to reproduce the behavior:

1. Start a payment express session from Cart.
2. Adapt product inventory while the session is ongoing
3. You can still place an order through the PPE-flow.

Expected behavior
Basket should be validated before the customer can place an order through the Paypal Express-flow. Ideally, any issues should be communicated to the customer inside the pop-up, so they can still make modifications. The PaymentDetails-call towards Adyen should be prevented, so no payment is actually captured.

[amihajlovski]

Hello @KennethRobbeFrucon

Thanks for raising this.
We opened a ticket internally for this scenario and will do an investigation about whats the best way to approach it.

Kind Regards
Aleksandar
Adyen