fix(fraud-protection): also enqueue reCAPTCHA when a protected gateway is available regardless of smart-button location

should_enqueue_for_current_location() only checked the merchant's Smart Button Location
setting, but that setting solely controls the wallet button. ACDC, AXO, and the card
button gateway are independent WC_Payment_Gateway entries that can be selectable at
checkout (or the My Account "Add payment method" page) even when the wallet button is
disabled for that location — and reCAPTCHA protects exactly those gateways via
$payment_methods. Add has_protected_gateway_on_current_page(), checking WC's own
available-gateways list against the protected set, and OR it into the enqueue decision
so reCAPTCHA isn't skipped while ACDC/AXO/card-button remain reachable.

Author: Narek13

modules/ppcp-fraud-protection/src/Recaptcha/Recaptcha.php

@@ -200,9 +200,11 @@ private function current_smart_button_location(): ?string {
 	private function should_enqueue_for_current_location(): bool {
 		$location = $this->current_smart_button_location();
 
-		$should_enqueue = null !== $location
+		$enabled_for_location = null !== $location
 			&& $this->settings_status->is_smart_button_enabled_for_location( $location );
 
+		$should_enqueue = $enabled_for_location || $this->has_protected_gateway_on_current_page();
+
 		/**
 		 * Filters whether reCAPTCHA assets and markup should be enqueued or
 		 * rendered for the current request.
@@ -217,6 +219,26 @@ private function should_enqueue_for_current_location(): bool {
 		);
 	}
 
+	/**
+	 * True when a reCAPTCHA-protected gateway (ACDC card fields, AXO, card button,
+	 * standard PayPal) is available on a checkout / order-pay / add-payment-method
+	 * page — surfaces whose availability is independent of the smart-button location.
+	 */
+	private function has_protected_gateway_on_current_page(): bool {
+		if ( ! is_checkout() && ! is_add_payment_method_page() ) {
+			return false;
+		}
+
+		$available = WC()->payment_gateways->get_available_payment_gateways();
+		foreach ( $this->payment_methods as $id ) {
+			if ( isset( $available[ $id ] ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	public function intercept_paypal_ajax( array $request_data ): void {
 		if ( ! $this->should_use_recaptcha() ) {
 			return;

tests/PHPUnit/FraudProtection/Recaptcha/RecaptchaTest.php

@@ -30,14 +30,18 @@ public function setUp(): void {
 
 		when( 'is_user_logged_in' )->justReturn( false );
 		when( 'has_block' )->justReturn( false );
+		when( 'is_add_payment_method_page' )->justReturn( false );
 	}
 
 	/**
 	 * Builds a Recaptcha instance configured so should_use_recaptcha() is true
 	 * (valid v2/v3 keys, integration enabled), so tests only need to control
 	 * the location-gating logic under test.
+	 *
+	 * @param string[] $payment_methods The gateway IDs reCAPTCHA protects, mirroring the
+	 *                                  `fraud-protection.recaptcha.payment-methods` service.
 	 */
-	private function make_testee( SettingsStatus $settings_status ): Recaptcha {
+	private function make_testee( SettingsStatus $settings_status, array $payment_methods = array() ): Recaptcha {
 		$integration = Mockery::mock( RecaptchaIntegration::class );
 		$integration->enabled = 'yes';
 		$integration->shouldReceive( 'get_option' )->andReturnUsing(
@@ -54,7 +58,7 @@ function ( string $key, $default = false ) {
 
 		return new Recaptcha(
 			$integration,
-			array(),
+			$payment_methods,
 			$asset_getter,
 			'1.0.0',
 			$logger,
@@ -63,6 +67,24 @@ function ( string $key, $default = false ) {
 		);
 	}
 
+	/**
+	 * Stubs WC()->payment_gateways->get_available_payment_gateways() to return the given
+	 * gateway IDs as available, for has_protected_gateway_on_current_page() to check against.
+	 *
+	 * @param string[] $available_gateway_ids
+	 */
+	private function stub_available_gateways( array $available_gateway_ids = array() ): void {
+		$payment_gateways = Mockery::mock();
+		$payment_gateways->shouldReceive( 'get_available_payment_gateways' )->andReturn(
+			array_fill_keys( $available_gateway_ids, true )
+		);
+
+		$woocommerce = Mockery::mock();
+		$woocommerce->payment_gateways = $payment_gateways;
+
+		when( 'WC' )->justReturn( $woocommerce );
+	}
+
 	public function test_enqueue_scripts_skips_on_unsupported_page(): void {
 		when( 'is_product' )->justReturn( false );
 		when( 'is_cart' )->justReturn( false );
@@ -125,6 +147,8 @@ public function test_enqueue_scripts_checks_block_express_location_on_block_chec
 		when( 'is_checkout' )->justReturn( true );
 		when( 'has_block' )->justReturn( true );
 
+		$this->stub_available_gateways();
+
 		$settings_status = Mockery::mock( SettingsStatus::class );
 		$settings_status->shouldReceive( 'is_smart_button_enabled_for_location' )
 			->with( 'checkout-block-express' )