Merge pull request #4356 from woocommerce/dev/PCP-5866-update-ec_token

Allow ReplaceCart endpoint to (re)create token (5866)

Author: stracker-phil

modules/ppcp-store-sync/src/Endpoint/AgenticRestEndpoint.php

@@ -207,8 +207,8 @@ protected function create_local_cart( PayPalCart $cart, string $ec_token ): stri
 		return $this->session_handler->create_cart_session( $cart, $ec_token );
 	}
 
-	protected function store_local_cart( string $cart_id, PayPalCart $cart ): bool {
-		return $this->session_handler->update_cart_session( $cart_id, $cart );
+	protected function store_local_cart( string $cart_id, PayPalCart $cart, ?string $ec_token = null ): bool {
+		return $this->session_handler->update_cart_session( $cart_id, $cart, $ec_token );
 	}
 
 	protected function flush_local_cart( string $cart_id ): bool {

modules/ppcp-store-sync/src/Endpoint/ReplaceCartEndpoint.php

@@ -56,13 +56,17 @@ public function register_routes(): void {
 	/**
 	 * Replace an existing cart with new data.
 	 *
+	 * Per PayPal specs, the PUT endpoint may create a new PayPal order when:
+	 * - The cart doesn't have an ec_token yet (POST validation failed)
+	 * - The existing ec_token has expired
+	 *
 	 * @param WP_REST_Request $request The REST request.
 	 * @return WP_REST_Response The REST response.
 	 */
 	public function replace_cart( WP_REST_Request $request ): WP_REST_Response {
 		$cart_id = $request->get_param( 'cart_id' );
 
-		// Verify cart exists.
+		// Verify cart exists and get current session data.
 		$session = $this->get_stored_cart( $cart_id );
 
 		if ( $session instanceof AgenticError ) {
@@ -75,8 +79,24 @@ public function replace_cart( WP_REST_Request $request ): WP_REST_Response {
 			return $this->error( $store_cart );
 		}
 
-		// Replace the cart session (preserving ec_token).
-		$update_result = $this->store_local_cart( $cart_id, $store_cart->paypal_cart() );
+		// Determine if we need to create a new PayPal order.
+		$existing_token = $session['ec_token'] ?? '';
+		$new_token      = null;
+
+		if ( empty( $existing_token ) && $store_cart->validation()->is_empty() ) {
+			$new_token = $this->order_manager->create_order( $store_cart->paypal_cart() ) ?: null;
+
+			$this->logger->info(
+				'[REST] PUT created new PayPal order',
+				array(
+					'cart_id'   => $cart_id,
+					'new_token' => $new_token ?? '(none - order creation failed)',
+				)
+			);
+		}
+
+		// Update the cart session, passing new token when one was created.
+		$update_result = $this->store_local_cart( $cart_id, $store_cart->paypal_cart(), $new_token );
 
 		if ( ! $update_result ) {
 			return $this->error_not_found(
@@ -88,7 +108,11 @@ public function replace_cart( WP_REST_Request $request ): WP_REST_Response {
 			);
 		}
 
-		$store_cart->set_paypal_order( $session['ec_token'] );
+		// Only inject the token into the response when a new one was created.
+		if ( $new_token ) {
+			$store_cart->set_paypal_order( $new_token );
+		}
+
 		$response = $this->response_factory->from_cart( $store_cart, $cart_id );
 
 		return $this->cart_details( $response, 200 );

modules/ppcp-store-sync/src/Session/AgenticSessionHandler.php

@@ -108,11 +108,12 @@ public function load_cart_session( string $session_id ): ?array {
 	/**
 	 * Update an existing cart session.
 	 *
-	 * @param string     $session_id The session ID.
-	 * @param PayPalCart $cart       The updated cart.
+	 * @param string      $session_id The session ID.
+	 * @param PayPalCart  $cart       The updated cart.
+	 * @param string|null $ec_token   Optional new token; when omitted the existing token is kept.
 	 * @return bool True on success.
 	 */
-	public function update_cart_session( string $session_id, PayPalCart $cart ): bool {
+	public function update_cart_session( string $session_id, PayPalCart $cart, ?string $ec_token = null ): bool {
 		// Load the session first.
 		$existing = $this->load_cart_session( $session_id );
 		if ( ! $existing ) {
@@ -121,7 +122,7 @@ public function update_cart_session( string $session_id, PayPalCart $cart ): boo
 
 		$data = array(
 			'cart'     => $cart->to_array(),
-			'ec_token' => $existing['ec_token'],
+			'ec_token' => $ec_token ?? $existing['ec_token'],
 			'created'  => $existing['created'],
 			'modified' => time(),
 		);