Merge pull request #4476 from woocommerce/trunk

Update dev/develop with the changes in trunk

Author: Dinamiko

.gitignore

@@ -1,28 +1,34 @@
+# Do not track private authentication details
+auth.json
+.npmrc
+.env*
+
+# Exclude runtime artifacts by file types
+*.cache
+*.bak
+*.log
+*.zip
+.DS_Store
+
+# Ignore IDE settings
+/.idea/
+.vscode
+
 /vendor/
 /build/
-/.idea/
 node_modules
-.phpunit.result.cache
-phpunit.xml.dist.bak
-yarn-error.log
 modules/*/vendor/*
 modules/*/assets/*
 !modules/ppcp-wc-gateway/assets/images
-*.zip
 !tests/qa/resources/files/*.zip
 !tests/qa-legacy-ui/resources/files/*.zip
-.env*
 !.env.example*
-auth.json
-.DS_Store
-tests/.DS_Store
 .composer_compiled_assets
 /coverage/
 /assets
 !modules/ppcp-local-alternative-payment-methods/assets/images
 tests/inc/inpsyde/
 
-.vscode
 playwright-utils
 playwright-report*
 snapshots

changelog.txt

@@ -1,5 +1,33 @@
 *** Changelog ***
 
+= 4.1.0 - 2026-06-23 =
+* Enhancement - New Vault Management Component for buyers with saved PayPal accounts to update funding instrument #4421
+* Enhancement - Pay upon Invoice support for Block Checkout #4405
+* Enhancement - OXXO support for Block Checkout #4381
+* Enhancement - Show PayPal account or last card digits in payment method on order confirmation page & emails #4427
+* Enhancement - Disable legacy "PayPal Standard" gateway when merchant account is connected to PayPal Payments #4463
+* Fix - Third-party plugin gift cards not calculated on PayPal payment modal #4422
+* Fix - Fix PayPal amount mismatch from inclusive-tax rounding #4425
+* Fix - Negative fee calculation may result in a mismatch PayPal between the WooCommerce order total and the total amount paid via PayPal #4409
+* Fix - Unsuccessful payment for vaulting subscription with ACDC from Block Checkout #4437
+* Fix - Unsuccessful payment for vaulting subscriptions with 100% discount coupons (CANNOT_BE_ZERO_OR_NEGATIVE) #4452
+* Fix - Unsuccessful payment for free trial vaulting subscription with acdc and PayPal #4439
+* Fix - Vaulted ACDC saved-card checkout stuck in "payment pending" #4431
+* Fix - PartnersEndpoint::seller_status() floods PayPal merchant-integrations endpoint with 403s #4430
+* Fix - Avoid spamming OAuth requests when auth fails #4414
+* Fix - Google Pay not rendered on variable product page #4433
+* Fix - Simplify manual client ID validation to accommodate new Client ID format #4397
+* Fix - Mismatch line item not delivered to PayPal overview transaction page #4426
+* Fix - APM transaction links open paypal.com instead of sandbox.paypal.com in Sandbox mode #4418
+* Fix - Coerce stored values in typed-bool getters and vault_enabled migration #4393
+* Fix - Fix type casting for customer unique ID in session MD5 hash #4333
+* Fix - Apple Pay fails on single product page when no shipping option is available #4375
+* Fix - Settings notifications do not display on the PayPal Payments settings pages #4034
+* Fix - Add missing "Show logos of supported cards" setting in the ACDC options #4380
+* Fix - Phone number verification may fail #4448
+* Fix - Saved payment methods display in continuation mode #4457
+* Fix - Card payments with saved cards may fail in certain cases #4450
+
 = 4.0.4 - 2026-05-19 =
 * Enhancement - WooCommerce Blueprints integration to import & export the PayPal Payments configuration #4363
 * Enhancement - PayPal redirect gateway now appears on Block checkout for Subscription-type products #4338

docs/testing-card-vaulting.md

@@ -0,0 +1,66 @@
+# Card vaulting & vaulted checkout: testing notes
+
+Vaulting tests need PayPal's "**save payment methods**" test cards, which are **not
+interchangeable** with the "purchase flow" cards. Using the wrong table is the most common mistake
+here.
+
+## Sandbox setup
+
+To exercise the 3DS path at all, set the plugin's **3D Secure** option to **ALWAYS**. The sandbox
+does not require 3DS by default, so with any other setting the test cards below authenticate without
+triggering the flow you want to test.
+
+## 3DS modes
+
+3D Secure authentication has two possible behaviors. Both must work identically; the only difference
+is whether the shopper has to enter an OTP.
+
+|                  | Frictionless ("no challenge")             | Step-up ("challenge")                |
+|------------------|-------------------------------------------|--------------------------------------|
+| **What it is**   | No user input; the bank approves silently | A manual OTP step is required        |
+| **New card**     | Overlay closes itself after a few seconds | Overlay expands into an OTP form     |
+| **Vaulted card** | Redirects out, then back to the shop      | Redirects out, returns after the OTP |
+
+- "New card" = entering card details at checkout or adding one in My Account.
+- "Vaulted card" = paying with a saved card at checkout.
+- "Checkout" = Block checkout or Classic checkout, both are identical in this aspect.
+
+## Cards to use for vaulting tests
+
+Current "Save payment methods" table (expiry = `01/current year + 3`).
+
+| Network    | Frictionless       | Step-up            |
+|------------|--------------------|--------------------|
+| Visa       | `4000000000002701` | `4000000000002503` |
+| Mastercard | `5200000000002235` | `5200000000002151` |
+
+Do **not** use purchase-flow cards (e.g. `4868719196829038`, `4868719166101368`,
+`5329879707824603`) for vaulting. They mint a token that looks valid (every request returns `2xx`),
+but the later charge fails with a very visible `403 PERMISSION_DENIED`.
+
+## References
+
+- [Cards for "Save payment methods"](https://developer.paypal.com/docs/checkout/advanced/customize/3d-secure/test/#test-cases-and-card-details-for-save-payment-methods) ←
+  *what we need for vaulting!*
+- [Cards for "Purchase flow"](https://developer.paypal.com/docs/checkout/advanced/customize/3d-secure/test/#test-cases-and-card-details-for-purchase-flows) -
+  *not usable for vaulting, added for distinction*
+
+## Test coverage
+
+The 3DS authentication itself runs in the browser SDK and on PayPal's servers, so the end-to-end
+save + 3DS + charge flow can only be verified **manually** (real browser, with the sandbox setup and
+save-flow cards above). A live-API integration test would be non-deterministic.
+
+The surrounding plugin logic is covered by automated tests that mock the PayPal HTTP boundary and
+assert what our code sends and does with responses:
+
+- [Integration: VaultedCard3dsTransactionTest.php](../tests/integration/PHPUnit/Transaction/VaultedCard3dsTransactionTest.php):
+  resume-nonce / capture / authorize state machine (uses a `payer-action` link to represent
+  "3DS required").
+- [Integration: WooCommercePaymentTokensTest.php](../tests/integration/PHPUnit/Vaulting/WooCommercePaymentTokensTest.php):
+  response → `WC_Payment_Token_CC` persistence.
+- [Unit: CaptureCardPaymentTest.php](../tests/PHPUnit/WcGateway/Endpoint/CaptureCardPaymentTest.php):
+  vaulted-charge order-body construction.
+- [Unit: CreateSetupTokenTest.php](../tests/PHPUnit/SavePaymentMethods/Endpoint/CreateSetupTokenTest.php)
+  and [Unit: CreatePaymentTokenTest.php](../tests/PHPUnit/SavePaymentMethods/Endpoint/CreatePaymentTokenTest.php):
+  vault-token setup-request body and exchange-response handling.

modules/ppcp-api-client/src/Authentication/PayPalBearer.php

@@ -189,11 +189,17 @@ private function newBearer(): Token {
 			$status_code = is_wp_error( $response ) ? 0 : (int) wp_remote_retrieve_response_code( $response );
 			$this->rate_limiter->register_failure( self::RATE_LIMIT_SCOPE, $status_code, $response );
 
-			$error = new RuntimeException( 'Could not create token.' );
+			$error    = new RuntimeException( 'Could not create token.' );
+			$log_args = $args;
+			foreach ( array_keys( $log_args['headers'] ) as $header_name ) {
+				if ( preg_match( '/authorization|signature/i', $header_name ) ) {
+					$log_args['headers'][ $header_name ] = '[REDACTED]';
+				}
+			}
 			$this->logger->warning(
 				$error->getMessage(),
 				array(
-					'args'     => $args,
+					'args'     => $log_args,
 					'response' => $response,
 				)
 			);

modules/ppcp-api-client/src/Endpoint/LoginSeller.php

@@ -141,8 +141,8 @@ private function generate_token_for(
 		string $seller_nonce
 	): string {
 
-		$url      = trailingslashit( $this->host ) . 'v1/oauth2/token/';
-		$args     = array(
+		$url  = trailingslashit( $this->host ) . 'v1/oauth2/token/';
+		$args = array(
 			'method'  => 'POST',
 			'headers' => array(
 				// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode

modules/ppcp-api-client/src/Factory/PayerFactory.php

@@ -131,7 +131,7 @@ public function from_paypal_response( \stdClass $data ): Payer {
 			isset( $data->name->surname ) ? (string) $data->name->surname : ''
 		);
 		// TODO deal with phones without type instead of passing a invalid type.
-		$phone      = ( isset( $data->phone ) ) ? new PhoneWithType(
+		$phone      = ( isset( $data->phone->phone_number->national_number ) ) ? new PhoneWithType(
 			( isset( $data->phone->phone_type ) ) ? $data->phone->phone_type : 'undefined',
 			new Phone(
 				$data->phone->phone_number->national_number

modules/ppcp-api-client/src/Repository/PartnerReferralsData.php

@@ -30,15 +30,6 @@ public function __construct( DccApplies $dcc_applies, FeaturesDefinition $featur
 		$this->features_definition = $features_definition;
 	}
 
-	/**
-	 * Returns a nonce.
-	 *
-	 * @return string
-	 */
-	public function nonce(): string {
-		return 'a1233wtergfsdt4365tzrshgfbaewa36AGa1233wtergfsdt4365tzrshgfbaewa36AG';
-	}
-
 	/**
 	 * Returns the data.
 	 *
@@ -47,13 +38,15 @@ public function nonce(): string {
 	 * @param string   $onboarding_token  A security token to finalize the onboarding process.
 	 * @param bool     $use_subscriptions If the merchant requires subscription features.
 	 * @param bool     $use_card_payments If the merchant wants to process credit card payments.
+	 * @param string   $seller_nonce      The PKCE code_verifier for the OAuth flow.
 	 * @return array
 	 */
 	public function data(
 		array $products = array(),
 		string $onboarding_token = '',
 		?bool $use_subscriptions = null,
-		bool $use_card_payments = true
+		bool $use_card_payments = true,
+		string $seller_nonce = ''
 	): array {
 		$in_acdc_country = $this->dcc_applies->for_country_currency(); // @phpstan-ignore property.deprecated
 
@@ -129,7 +122,7 @@ public function data(
 							'integration_type'    => 'FIRST_PARTY',
 							'first_party_details' => array(
 								'features'     => $first_party_features,
-								'seller_nonce' => $this->nonce(),
+								'seller_nonce' => $seller_nonce,
 							),
 						),
 					),

modules/ppcp-axo/src/Gateway/AxoGateway.php

@@ -296,6 +296,7 @@ public function process_payment( $order_id ) {
 			}
 		} catch ( Exception $exception ) {
 			$this->logger->error( '[AXO] Payment processing failed: ' . $exception->getMessage() );
+
 			return array(
 				'result'  => 'failure',
 				'message' => $this->get_user_friendly_error_message( $exception ),
@@ -330,6 +331,47 @@ protected function process_3ds_return( WC_Order $wc_order, string $token ): arra
 				);
 			}
 
+			$purchase_units = $paypal_order->purchase_units();
+			$purchase_unit  = $purchase_units[0] ?? null;
+
+			if ( null === $purchase_unit ) {
+				$this->logger->error(
+					sprintf(
+						'[AXO] 3DS return validation failed: PayPal order has no purchase units. WC order ID: %s',
+						$wc_order->get_id(),
+					)
+				);
+
+				return array(
+					'result'  => 'failure',
+					'message' => __( 'Payment validation failed. Please try again.', 'woocommerce-paypal-payments' ),
+				);
+			}
+
+			/*
+			 * If the custom_id === order_id condition is true, we know that the PayPal order
+			 * and our WC order match, and there's no need for other checks.
+			 *
+			 * Specifically, we do not compare the WC_Order total amount against the
+			 * purchase unit's value, as the PU value can deviate from the WC order total, which
+			 * might reject legitimate payments.
+			 */
+			if ( $purchase_unit->custom_id() !== (string) $wc_order->get_id() ) {
+				$this->logger->error(
+					sprintf(
+						'[AXO] 3DS return validation failed: custom_id mismatch. Token: %s, WC order ID: %s, PayPal custom_id: %s',
+						$token,
+						$wc_order->get_id(),
+						$purchase_unit->custom_id()
+					)
+				);
+
+				return array(
+					'result'  => 'failure',
+					'message' => __( 'Payment validation failed. Please try again.', 'woocommerce-paypal-payments' ),
+				);
+			}
+
 			/**
 			 * This filter controls if the method 'process()' from OrderProcessor will be called.
 			 * So you can implement your own for example on subscriptions
@@ -344,6 +386,7 @@ protected function process_3ds_return( WC_Order $wc_order, string $token ): arra
 			}
 		} catch ( Exception $exception ) {
 			$this->logger->error( '[AXO] 3DS return processing failed: ' . $exception->getMessage() );
+
 			return array(
 				'result'  => 'failure',
 				'message' => $this->get_user_friendly_error_message( $exception ),
@@ -453,7 +496,7 @@ protected function build_payment_source_properties( string $payment_token ): obj
 			'single_use_token' => $payment_token,
 		);
 
-			$three_d_secure = $this->settings_model->get_three_d_secure_enum();
+		$three_d_secure = $this->settings_model->get_three_d_secure_enum();
 
 		if ( 'SCA_ALWAYS' === $three_d_secure || 'SCA_WHEN_REQUIRED' === $three_d_secure ) {
 			$properties['attributes'] = array(
@@ -482,7 +525,7 @@ protected function build_order_data(): array {
 
 		$data['experience_context'] = $experience_context->to_array();
 
-			$three_d_secure = $this->settings_model->get_three_d_secure_enum();
+		$three_d_secure = $this->settings_model->get_three_d_secure_enum();
 
 		if ( $three_d_secure === 'SCA_ALWAYS' || $three_d_secure === 'SCA_WHEN_REQUIRED' ) {
 			$data['transaction_context'] = array(

modules/ppcp-blocks/resources/js/Components/paypal-saved-token.js

@@ -38,8 +38,15 @@ export const PayPalSavedToken = ( {
 	const vaultData = config?.scriptData?.vault_component;
 	const isVaultEligible = vaultData?.is_eligible === true;
 	const isSavedTokenSelected = token && token !== '0' && token !== 0;
+	// A zero-total subscription cart (free trial or 100% coupon) must use the
+	// save-without-purchase flow. The Vault Component is order-based and would
+	// create a $0 order, which PayPal rejects with CANNOT_BE_ZERO_OR_NEGATIVE.
+	const isFreeTrial = config?.scriptData?.is_free_trial_cart === true;
 	const shouldShowVaultComponent =
-		isVaultEligible && isSavedTokenSelected && ! vaultRenderFailed;
+		isVaultEligible &&
+		isSavedTokenSelected &&
+		! isFreeTrial &&
+		! vaultRenderFailed;
 
 	const handleVaultRenderError = useCallback( () => {
 		setVaultRenderFailed( true );

modules/ppcp-blocks/resources/js/checkout-block.js

@@ -79,6 +79,11 @@ if ( blockEnabled ) {
 			placeOrderButtonLabel: config.placeOrderButtonText,
 			ariaLabel: config.title,
 			canMakePayment: ( cartData ) => {
+				// Free-trial subscriptions have a $0 total today but still
+				// require a payment method to be vaulted for future renewals.
+				if ( config.scriptData.is_free_trial_cart ) {
+					return true;
+				}
 				const total = cartData?.cartTotals?.total_price;
 				return parseInt( total ) > 0;
 			},