fix(core-flows): emit payment.captured event on order payment session authorization

[vjymisal0]

What

Emit payment.captured event during order payment session authorization workflow (�uthorizePaymentSessionForOrderWorkflow) when payment is captured.

Why

When an order payment session is authorized and has existing captures or is marked captured (payment.captures or payment.captured_at), downstream event subscribers (notifications, invoicing, third-party integrations) expecting PaymentEvents.CAPTURED (payment.captured) are not notified.

How

• Add conditional workflow step emit-payment-captured-event in �uthorizePaymentSessionForOrderWorkflow using when(...) to check for payment.captures?.length or payment.captured_at.
• Dispatch PaymentEvents.CAPTURED with { id: payment.id } via emitEventStep.

Testing

• Added unit tests in packages/core/core-flows/src/payment/workflows/tests/authorize-payment-session-for-order.spec.ts verifying workflow definition and structure.

Closes #16727

[changeset-bot]

🦋 Changeset detected

Latest commit: ad919d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 83 packages

Name	Type
@medusajs/core-flows	Patch
@medusajs/medusa	Patch
@medusajs/test-utils	Patch
integration-tests-http	Patch
@medusajs/loyalty-plugin	Patch
@medusajs/medusa-oas-cli	Patch
@medusajs/analytics	Patch
@medusajs/api-key	Patch
@medusajs/auth	Patch
@medusajs/caching	Patch
@medusajs/cart	Patch
@medusajs/currency	Patch
@medusajs/customer	Patch
@medusajs/file	Patch
@medusajs/fulfillment	Patch
@medusajs/index	Patch
@medusajs/inventory	Patch
@medusajs/link-modules	Patch
@medusajs/locking	Patch
@medusajs/notification	Patch
@medusajs/order	Patch
@medusajs/payment	Patch
@medusajs/pricing	Patch
@medusajs/product	Patch
@medusajs/promotion	Patch
@medusajs/rbac	Patch
@medusajs/region	Patch
@medusajs/sales-channel	Patch
@medusajs/search	Patch
@medusajs/settings	Patch
@medusajs/stock-location	Patch
@medusajs/store	Patch
@medusajs/tax	Patch
@medusajs/translation	Patch
@medusajs/user	Patch
@medusajs/workflow-engine-inmemory	Patch
@medusajs/workflow-engine-redis	Patch
@medusajs/search-postgres	Patch
@medusajs/draft-order	Patch
@medusajs/oas-github-ci	Patch
@medusajs/cache-inmemory	Patch
@medusajs/cache-redis	Patch
@medusajs/event-bus-local	Patch
@medusajs/event-bus-redis	Patch
@medusajs/analytics-local	Patch
@medusajs/analytics-posthog	Patch
@medusajs/auth-emailpass	Patch
@medusajs/auth-github	Patch
@medusajs/auth-google	Patch
@medusajs/auth-oidc	Patch
@medusajs/caching-redis	Patch
@medusajs/file-local	Patch
@medusajs/file-s3	Patch
@medusajs/fulfillment-manual	Patch
@medusajs/locking-postgres	Patch
@medusajs/locking-redis	Patch
@medusajs/notification-local	Patch
@medusajs/notification-sendgrid	Patch
@medusajs/payment-stripe	Patch
@medusajs/framework	Patch
@medusajs/instantsearch-adapter	Patch
@medusajs/js-sdk	Patch
@medusajs/modules-sdk	Patch
@medusajs/orchestration	Patch
@medusajs/query	Patch
@medusajs/types	Patch
@medusajs/utils	Patch
@medusajs/workflows-sdk	Patch
create-medusa-app	Patch
@medusajs/http-types-generator	Patch
@medusajs/cli	Patch
@medusajs/deps	Patch
@medusajs/eslint-plugin	Patch
@medusajs/telemetry	Patch
@medusajs/admin-bundler	Patch
@medusajs/admin-sdk	Patch
@medusajs/admin-shared	Patch
@medusajs/admin-vite-plugin	Patch
@medusajs/dashboard	Patch
@medusajs/icons	Patch
@medusajs/toolbox	Patch
@medusajs/ui-preset	Patch
@medusajs/ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[medusa-os-bot]

Thanks for the contribution! We need more information before reviewing this further.

The PR author (vjymisal0) is an external contributor. The PR attempts to fix a missing payment.captured event emission in the order payment session authorization workflow, which corresponds to a valid open bug report. However, the PR body does not follow the required pull request template — the What, Why, How, and Testing sections are all absent. The body instead uses custom 'Problem' and 'Solution' headings and provides no information on how the change can be tested by a reviewer. Heads up: PR #16738 already references issue #16727 and was opened one day earlier (2026-09-05 vs 2026-09-06); if #16738 is merged first, this PR may be closed as a duplicate.

Triggered by: new PR opened

[medusa-os-bot]

Thanks for the contribution! A few items need to be addressed before this can move forward:

The PR template is now complete with all four required sections — the previous review's template compliance issue has been addressed. The workflow change itself is structurally correct: the new when block follows the existing pattern in the file, uses the correct emitEventStep call, and the condition (payment.captures?.length || payment.captured_at) accurately captures the cases where a capture has occurred. No security or performance concerns. The changeset is present and correctly formatted. One required change remains: the added test file imports PaymentEvents and PaymentSessionStatus from @medusajs/framework/utils but neither symbol appears in any test assertion. The two tests only verify that the workflow export exists and has the expected name — they do not exercise the behavioral change this PR introduces. Specifically, there are no tests verifying that the payment.captured event is emitted when payment.captures is non-empty or payment.captured_at is set, nor that the event is not emitted when neither condition holds. The unused imports suggest that event-behavior tests were intended but not finished.

• packages/core/core-flows/src/payment/workflows/tests/authorize-payment-session-for-order.spec.ts: The test file imports PaymentEvents and PaymentSessionStatus but never uses them. The two existing tests only check that the workflow is exported and has the correct name, which does not verify the fix. Add tests that confirm the payment.captured event is emitted when the payment has captures (or captured_at is set) and is not emitted when neither condition is met. Remove the unused imports once the tests are in place.

Triggered by: new commit pushed

[vjymisal0]

Updated this one too. The unused import is gone, and the captured-payment event condition now has direct coverage for both capture paths (captures and captured_at) plus the no-capture case.

[medusa-os-bot]

Thanks for the contribution! Initial automated review looks good.

The PR adds conditional emission of the payment.captured event inside the authorize-payment-session-for-order workflow, to cover the case where the payment provider marks a payment as captured immediately upon authorization. This addresses a real gap: event subscribers for PaymentEvents.CAPTURED were not notified in this flow. All previous review concerns have been addressed: - The PR template now contains all four required sections. - The unused PaymentSessionStatus import has been removed from the test file. - PaymentEvents is now used in test assertions. - Behavioral tests for paymentCapturedEventData cover both capture paths (captures array, captured_at) and the no-capture case (returns null for empty captures and for undefined payment). The implementation is correct. The when().then() block follows the existing pattern in the same file and in capture-payment.ts: the when predicate receives actual resolved payment values (correctly gating on whether captures or captured_at are present), while inside then(), calling paymentCapturedEventData with the WorkflowData proxy at composition time produces {eventName: PaymentEvents.CAPTURED, data: {id: payment.id}} — the same structure used in capture-payment.ts — which the workflow engine resolves at runtime. The changeset is present and correctly scoped to @medusajs/core-flows as a patch.

Triggered by: new commit pushed