Skip to content

Commit c8c7631

Browse files
danieldudzicdanieldudzic
authored
Merge pull request #4537 from woocommerce/dev/PCP-6675-contract-tests-for-shared-order-ajax-endpoints-v-5-v-6-shared-plumbing
Contract tests for shared order WC-AJAX endpoints (v5/v6 shared plumbing) (6675)
2 parents 4e96b7f + 1bdeec9 commit c8c7631

13 files changed

Lines changed: 1600 additions & 3 deletions

‎tests/integration/PHPUnit/Button/Endpoint/ApproveOrderEndpointContractTest.php‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
<?php
2+
declare( strict_types=1 );
3+
4+
namespace WooCommerce\PayPalCommerce\Tests\Integration\Button\Endpoint;
5+
6+
use Mockery;
7+
use WooCommerce\PayPalCommerce\ApiClient\Endpoint\OrderEndpoint;
8+
use WooCommerce\PayPalCommerce\ApiClient\Entity\Order;
9+
use WooCommerce\PayPalCommerce\Tests\Integration\Fixtures\PayPalOrderPresets;
10+
use WooCommerce\PayPalCommerce\Vendor\Psr\Container\ContainerInterface;
11+
12+
/**
13+
* Contract tests for the ppc-approve-order WC-AJAX endpoint, shared by the
14+
* v5 and v6 SDK frontends.
15+
*
16+
* @covers \WooCommerce\PayPalCommerce\Button\Endpoint\ApproveOrderEndpoint
17+
*/
18+
class ApproveOrderEndpointContractTest extends WcAjaxEndpointTestCase {
19+
20+
private const PAYPAL_ORDER_ID = 'TEST-PAYPAL-ORDER-123';
21+
22+
/** @var ContainerInterface */
23+
protected $container;
24+
25+
/**
26+
* Boots the container with a mocked PayPal order API serving an APPROVED
27+
* order (no payment source, so the card/3DS branch is skipped) and the
28+
* follow-up calls the order processor performs on the happy path.
29+
*
30+
* final_review_enabled is forced off so the should_create_wc_order branch
31+
* is deterministic regardless of store settings.
32+
*
33+
* @param string|null $custom_id The purchase unit custom_id of the fetched order,
34+
* null for the session-bound one (computed at call time).
35+
* @return object The ppc-approve-order endpoint.
36+
*/
37+
private function endpointWithApprovedOrder( ?string $custom_id = null ) {
38+
$order_endpoint = Mockery::mock( OrderEndpoint::class );
39+
40+
$container = $this->bootstrapWithOrderApi(
41+
$order_endpoint,
42+
array(
43+
'blocks.settings.final_review_enabled' => static function (): bool {
44+
return false;
45+
},
46+
)
47+
);
48+
49+
$order_factory = $container->get( 'api.factory.order' );
50+
$approved = $order_factory->from_paypal_response(
51+
json_decode(
52+
(string) wp_json_encode(
53+
PayPalOrderPresets::order( self::PAYPAL_ORDER_ID, 'APPROVED', $custom_id ?? $this->sessionCustomId() )
54+
)
55+
)
56+
);
57+
$completed = $order_factory->from_paypal_response(
58+
json_decode(
59+
(string) wp_json_encode(
60+
PayPalOrderPresets::completedWithCapture( self::PAYPAL_ORDER_ID, $custom_id ?? $this->sessionCustomId() )
61+
)
62+
)
63+
);
64+
65+
$order_endpoint->shouldReceive( 'order' )->with( self::PAYPAL_ORDER_ID )->andReturn( $approved );
66+
$order_endpoint->shouldReceive( 'patch_order_with' )->andReturnUsing(
67+
static function ( Order $order_to_update ): Order {
68+
return $order_to_update;
69+
}
70+
)->byDefault();
71+
$order_endpoint->shouldReceive( 'capture' )->andReturn( $completed )->byDefault();
72+
73+
$this->container = $container;
74+
75+
return $container->get( 'button.endpoint.approve-order' );
76+
}
77+
78+
/**
79+
* GIVEN an APPROVED PayPal order owned by the current WC session
80+
* AND a WC cart with a virtual product
81+
* WHEN ppc-approve-order is called with should_create_wc_order: true
82+
* THEN a WC order is created from the cart, paid via the PayPal gateway
83+
* AND the response contains its order-received URL in data.order_received_url
84+
* AND the plugin session is consumed by the successful payment
85+
* (ProcessPaymentTrait destroys the session data on success)
86+
* AND chosen_payment_method is pinned to the PayPal gateway
87+
*/
88+
public function test_creates_wc_order_and_returns_received_url(): void {
89+
$product = $this->addVirtualProductToCart( 10.0 );
90+
$endpoint = $this->endpointWithApprovedOrder();
91+
$order_ids_before = $this->currentWcOrderIds();
92+
93+
$response = $this->dispatchAjaxRequest(
94+
$endpoint,
95+
array(
96+
'order_id' => self::PAYPAL_ORDER_ID,
97+
'funding_source' => 'paypal',
98+
'should_create_wc_order' => true,
99+
)
100+
);
101+
102+
$this->assertTrue( $response['success'], 'ppc-approve-order must succeed: ' . $response['raw'] );
103+
104+
$new_order_ids = array_values( array_diff( $this->currentWcOrderIds(), $order_ids_before ) );
105+
$this->assertCount( 1, $new_order_ids, 'Exactly one WC order must be created' );
106+
107+
$wc_order = wc_get_order( $new_order_ids[0] );
108+
$this->trackWcOrder( $wc_order->get_id() );
109+
110+
$this->assertSame(
111+
$wc_order->get_checkout_order_received_url(),
112+
$response['data']['order_received_url'] ?? null,
113+
'data.order_received_url must be the order-received URL of the created WC order'
114+
);
115+
$this->assertStringContainsString( 'order-received', (string) ( $response['data']['order_received_url'] ?? '' ) );
116+
117+
$this->assertSame( 'ppcp-gateway', $wc_order->get_payment_method() );
118+
$items = array_values( $wc_order->get_items() );
119+
$this->assertCount( 1, $items );
120+
$this->assertSame( $product->get_id(), $items[0]->get_product_id(), 'The WC order line items must match the cart' );
121+
122+
$this->assertContains(
123+
$wc_order->get_status(),
124+
array( 'processing', 'completed' ),
125+
'The happy capture path must complete the payment'
126+
);
127+
128+
$session_handler = $this->container->get( 'session.handler' );
129+
$this->assertNull( $session_handler->order(), 'The successful payment must consume the session order' );
130+
$this->assertSame( 'ppcp-gateway', WC()->session->get( 'chosen_payment_method' ) );
131+
}
132+
133+
/**
134+
* GIVEN an APPROVED PayPal order owned by the current WC session
135+
* WHEN ppc-approve-order is called without should_create_wc_order
136+
* THEN the response is a plain success with no data payload
137+
* AND no WC order is created
138+
* AND the PayPal order and funding source are stored in the plugin session
139+
* and chosen_payment_method is pinned
140+
* (the v5 classic continuation contract: Place Order later processes the
141+
* session order)
142+
*/
143+
public function test_without_should_create_wc_order_stores_session_and_returns_plain_success(): void {
144+
$this->addVirtualProductToCart( 10.0 );
145+
$endpoint = $this->endpointWithApprovedOrder();
146+
$order_ids_before = $this->currentWcOrderIds();
147+
148+
$response = $this->dispatchAjaxRequest(
149+
$endpoint,
150+
array(
151+
'order_id' => self::PAYPAL_ORDER_ID,
152+
'funding_source' => 'paypal',
153+
)
154+
);
155+
156+
$this->assertTrue( $response['success'], 'ppc-approve-order must succeed: ' . $response['raw'] );
157+
$this->assertNull( $response['data'], 'The plain success response must carry no data payload' );
158+
159+
$this->assertSame( array(), array_diff( $this->currentWcOrderIds(), $order_ids_before ), 'No WC order must be created' );
160+
161+
$session_handler = $this->container->get( 'session.handler' );
162+
$this->assertSame( self::PAYPAL_ORDER_ID, $session_handler->order() ? $session_handler->order()->id() : null );
163+
$this->assertSame( 'paypal', $session_handler->funding_source(), 'The funding source must be stored in the plugin session' );
164+
$this->assertSame( 'ppcp-gateway', WC()->session->get( 'chosen_payment_method' ) );
165+
}
166+
167+
/**
168+
* GIVEN a PayPal order whose custom_id binds it to a DIFFERENT WC session
169+
* (pcp_customer_ prefix with a foreign session id)
170+
* WHEN ppc-approve-order is called with that order id
171+
* THEN the request is rejected with message "Order validation failed."
172+
* AND no WC order is created and no order is stored in the session
173+
*/
174+
public function test_session_ownership_mismatch_is_rejected(): void {
175+
$this->addVirtualProductToCart( 10.0 );
176+
$endpoint = $this->endpointWithApprovedOrder( 'pcp_customer_someone-elses-session-id' );
177+
$order_ids_before = $this->currentWcOrderIds();
178+
179+
$response = $this->dispatchAjaxRequest(
180+
$endpoint,
181+
array(
182+
'order_id' => self::PAYPAL_ORDER_ID,
183+
'funding_source' => 'paypal',
184+
'should_create_wc_order' => true,
185+
)
186+
);
187+
188+
$this->assertFalse( $response['success'], 'A foreign session order must be rejected' );
189+
$this->assertSame( 'Order validation failed.', $response['data']['message'] ?? null );
190+
191+
$this->assertSame( array(), array_diff( $this->currentWcOrderIds(), $order_ids_before ), 'No WC order must be created' );
192+
$this->assertNull( $this->container->get( 'session.handler' )->order(), 'No order must be stored in the session' );
193+
}
194+
195+
/**
196+
* GIVEN a PayPal order whose custom_id does NOT start with pcp_customer_
197+
* (e.g. a plain WC order id)
198+
* WHEN ppc-approve-order is called
199+
* THEN the ownership check is skipped and the request succeeds
200+
*/
201+
public function test_non_prefixed_custom_id_skips_ownership_check(): void {
202+
$this->addVirtualProductToCart( 10.0 );
203+
$endpoint = $this->endpointWithApprovedOrder( '123' );
204+
205+
$response = $this->dispatchAjaxRequest(
206+
$endpoint,
207+
array(
208+
'order_id' => self::PAYPAL_ORDER_ID,
209+
'funding_source' => 'paypal',
210+
)
211+
);
212+
213+
$this->assertTrue( $response['success'], 'A non-session custom_id must skip the ownership check: ' . $response['raw'] );
214+
}
215+
216+
/**
217+
* GIVEN a request body without an order_id
218+
* WHEN ppc-approve-order is called with a valid nonce
219+
* THEN the request is rejected with message "No order id given"
220+
* AND no PayPal API call is made
221+
*/
222+
public function test_missing_order_id_returns_error(): void {
223+
$order_endpoint = Mockery::mock( OrderEndpoint::class );
224+
$order_endpoint->shouldNotReceive( 'order' );
225+
226+
$container = $this->bootstrapWithOrderApi( $order_endpoint );
227+
$endpoint = $container->get( 'button.endpoint.approve-order' );
228+
229+
$response = $this->dispatchAjaxRequest( $endpoint, array() );
230+
231+
$this->assertFalse( $response['success'] );
232+
$this->assertSame( 'No order id given', $response['data']['message'] ?? null );
233+
}
234+
}

0 commit comments

Comments
 (0)