Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions assets/js/gateways/stripe.js
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,7 @@ const stripeElements = function (publicKey) {
// Build elements options based on mode
const elementsOptions = {
currency: wu_stripe.currency || 'usd',
excludedPaymentMethodTypes: wu_stripe.excluded_payment_method_types || ['klarna'],
appearance: {
theme: 'stripe',
},
Expand Down
2 changes: 1 addition & 1 deletion composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@
"berlindb/core": "^2.0.1",
"mexitek/phpcolors": "^1.0.4",
"phpdocumentor/reflection-docblock": "^5.3.0",
"stripe/stripe-php": "^17.4.0",
"stripe/stripe-php": "^21.0.0",
"rakit/validation": "dev-master#ff003a35cdf5030a5f2482299f4c93f344a35b29",
"ifsnop/mysqldump-php": "^2.12",
"mpdf/mpdf": "^8.2.0",
Expand Down
23 changes: 13 additions & 10 deletions composer.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

40 changes: 28 additions & 12 deletions inc/gateways/class-base-stripe-gateway.php
Original file line number Diff line number Diff line change
Expand Up @@ -919,13 +919,14 @@ public function maybe_redirect_to_portal(): void {
$subscription_data = apply_filters(
'wu_stripe_checkout_subscription_data',
[
'payment_method_types' => $allowed_payment_method_types,
'mode' => 'setup',
'success_url' => $return_url,
'cancel_url' => wu_get_current_url(),
'billing_address_collection' => 'required',
'client_reference_id' => $customer_id,
'customer' => $s_customer_id,
'payment_method_types' => $allowed_payment_method_types,
'excluded_payment_method_types' => $this->get_excluded_payment_method_types(),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Resolve exclusions from the membership gateway instance.

The allowed list is resolved from $gateway, but the new exclusion list is resolved from $this. If this handler runs on a different Stripe gateway instance than the membership’s gateway, gateway-specific filters receive the wrong object. Use $gateway->get_excluded_payment_method_types() here.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@inc/gateways/class-base-stripe-gateway.php` at line 923, Update the
excluded_payment_method_types assignment in the relevant Stripe gateway handler
to call get_excluded_payment_method_types() on the membership’s $gateway
instance instead of $this, matching how the allowed list is resolved and
preserving gateway-specific filter context.

'mode' => 'setup',
'success_url' => $return_url,
'cancel_url' => wu_get_current_url(),
'billing_address_collection' => 'required',
'client_reference_id' => $customer_id,
'customer' => $s_customer_id,
],
$gateway
);
Expand Down Expand Up @@ -3448,6 +3449,20 @@ public function update_card_fields(): void { // phpcs:disable ?>
<?php // phpcs:enable
}

/**
* Returns payment method types excluded from Stripe payment flows.
*
* @since 2.6.0
* @return string[] The excluded Stripe payment method types.
*/
public function get_excluded_payment_method_types() {
return apply_filters(
'wu_stripe_excluded_payment_method_types',
['klarna'],
$this
);
}

/**
* Register stripe scripts.
*
Expand All @@ -3474,11 +3489,12 @@ public function register_scripts(): void {
"wu-{$this->get_id()}",
$obj_name,
[
'pk_key' => $this->publishable_key,
'request_billing_address' => $this->request_billing_address,
'add_new_card' => empty($saved_cards),
'payment_method' => empty($saved_cards) ? 'add-new' : current(array_keys($saved_cards)),
'currency' => strtolower((string) wu_get_setting('currency_symbol', 'USD')),
'pk_key' => $this->publishable_key,
'request_billing_address' => $this->request_billing_address,
'add_new_card' => empty($saved_cards),
'payment_method' => empty($saved_cards) ? 'add-new' : current(array_keys($saved_cards)),
'excluded_payment_method_types' => $this->get_excluded_payment_method_types(),
'currency' => strtolower((string) wu_get_setting('currency_symbol', 'USD')),
]
);

Expand Down
15 changes: 8 additions & 7 deletions inc/gateways/class-stripe-checkout-gateway.php
Original file line number Diff line number Diff line change
Expand Up @@ -306,13 +306,14 @@ public function run_preflight() {
}

$subscription_data = [
'payment_method_types' => $allowed_payment_method_types,
'success_url' => $redirect_url,
'cancel_url' => $this->get_cancel_url(),
'billing_address_collection' => 'required',
'client_reference_id' => $this->customer->get_id(),
'customer' => $s_customer->id,
'metadata' => $metadata,
'payment_method_types' => $allowed_payment_method_types,
'excluded_payment_method_types' => $this->get_excluded_payment_method_types(),
Comment on lines +309 to +310

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
curl -fsSL 'https://docs.stripe.com/api/checkout/sessions/create' |
  grep -Fq 'This should only be used when payment methods for this Checkout Session are managed through the Stripe Dashboard.'

Repository: Ultimate-Multisite/ultimate-multisite

Length of output: 175


🌐 Web query:

Stripe Checkout sessions create payment_method_types excluded_payment_method_types documentation

💡 Result:

In the Stripe Checkout API, payment_method_types and excluded_payment_method_types are distinct parameters used to control which payment methods are presented to the customer. payment_method_types This parameter is used to explicitly define the list of payment method types (e.g., ['card', 'acss_debit']) to be accepted for a specific Checkout Session [1][2]. If you provide this parameter, Stripe will only offer the payment methods explicitly listed, overriding your default settings in the Stripe Dashboard [3]. If you prefer to manage your payment methods centrally via the Stripe Dashboard (Dynamic Payment Methods), you should omit this parameter [3]. excluded_payment_method_types This parameter is an optional array of payment method types that should be excluded from a Checkout Session [1][4]. It is intended to be used in conjunction with dynamic payment method management [3][5]. When you use this parameter, you can dynamically remove specific methods for a single transaction without having to update your global dashboard settings [3][5]. Key considerations: - Use cases: excluded_payment_method_types is useful when you need granular, per-transaction control that is impractical to manage via global configurations (e.g., excluding certain methods based on the specific items in a cart) [5]. - Exclusions limitations: You cannot use excluded_payment_method_types to hide wallets such as Apple Pay, Google Pay, or Link [3][5]. To control the visibility of these specific methods on a per-transaction basis, you must use the appropriate wallets hash parameters for your integration [3][5]. - Interaction: You can use excluded_payment_method_types alongside your configured payment methods to further refine availability on a case-by-case basis [5].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Relevant source snippets:\n'
for f in \
  inc/gateways/class-stripe-checkout-gateway.php \
  inc/gateways/class-base-stripe-gateway.php \
  tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php
do
  echo "--- $f"
  rg -n "payment_method_types|excluded_payment_method_types|create_checkout_session|get_excluded_payment_method_types|get_allowed_payment_method" "$f" || true
done

printf '\nSurrounding contexts:\n'
sed -n '280,325p' inc/gateways/class-stripe-checkout-gateway.php
printf '\n---\n'
sed -n '880,945p' inc/gateways/class-base-stripe-gateway.php
printf '\n---\n'
sed -n '420,458p' tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php

Repository: Ultimate-Multisite/ultimate-multisite

Length of output: 6181


🌐 Web query:

Stripe API Checkout Session excluded_payment_method_types payment_method_types relationship

💡 Result:

In the Stripe API for Checkout Sessions, payment_method_types and excluded_payment_method_types serve different purposes and operate under different management models [1][2][3]. payment_method_types This parameter is used to explicitly define which payment methods to accept for a Checkout Session [2]. When you provide this list, you are manually controlling the availability of payment methods [1][4]. If you choose to manage your payment methods dynamically through the Stripe Dashboard (the recommended approach for most modern integrations), you should avoid passing this parameter in your integration code, as it overrides the dynamic settings [1][4]. excluded_payment_method_types This parameter is used to remove specific payment methods from a transaction on a per-session basis [2][3]. It is intended for use when you are otherwise managing your payment methods dynamically through the Stripe Dashboard [2][5][3]. By using this parameter, you can exclude specific methods (e.g., "affirm" or "acss_debit") while allowing the Dashboard settings to continue determining the availability of all other enabled methods [1][3]. Key Distinctions and Usage: - Relationship: They are largely mutually exclusive in terms of best practices. You should generally rely on either manual specification (payment_method_types) or dynamic dashboard management combined with per-transaction exclusions (excluded_payment_method_types) [1][2][3]. - Exclusions: The excluded_payment_method_types parameter cannot be used to exclude certain wallet-based payment methods such as Apple Pay, Google Pay, or Link [4][3]. To control the visibility of these specific methods for an individual transaction, you must use the appropriate wallets hash parameters within your integration [4][3]. - Flexibility: Using excluded_payment_method_types offers more granular control than simple dashboard configuration, allowing you to tailor payment options based on specific transaction attributes like the items being purchased [3].

Citations:


Don’t send explicit payment_method_types together with exclusions.

Stripe treats payment_method_types as an explicit allow-list and excluded_payment_method_types as a refinement for dynamically configured Checkout methods. Sending both makes the exclusions unreliable. Reconcile this at both Checkout session sites, or drop excluded_payment_method_types from this test and update the assertion.

📍 Affects 3 files
  • inc/gateways/class-stripe-checkout-gateway.php#L309-L310 (this comment)
  • inc/gateways/class-base-stripe-gateway.php#L922-L923
  • tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php#L442-L451
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@inc/gateways/class-stripe-checkout-gateway.php` around lines 309 - 310,
Remove the explicit payment_method_types array when
excluded_payment_method_types is supplied at both Checkout session sites:
inc/gateways/class-stripe-checkout-gateway.php lines 309-310 and
inc/gateways/class-base-stripe-gateway.php lines 922-923, preserving the dynamic
exclusion behavior. In
tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php lines
442-451, drop excluded_payment_method_types or update the assertion to match the
reconciled session parameters.

'success_url' => $redirect_url,
'cancel_url' => $this->get_cancel_url(),
'billing_address_collection' => 'required',
'client_reference_id' => $this->customer->get_id(),
'customer' => $s_customer->id,
'metadata' => $metadata,
];

if ($this->order->should_auto_renew() && $this->order->has_recurring()) {
Expand Down
14 changes: 8 additions & 6 deletions inc/gateways/class-stripe-gateway.php
Original file line number Diff line number Diff line change
Expand Up @@ -452,11 +452,12 @@ public function run_preflight() {
$intent_args = wp_parse_args(
$intent_args,
[
'amount' => $this->order->get_total() * wu_stripe_get_currency_multiplier(),
'confirmation_method' => 'automatic',
'setup_future_usage' => 'off_session',
'currency' => strtolower((string) wu_get_setting('currency_symbol', 'USD')),
'confirm' => false,
'amount' => $this->order->get_total() * wu_stripe_get_currency_multiplier(),
'confirmation_method' => 'automatic',
'setup_future_usage' => 'off_session',
'excluded_payment_method_types' => $this->get_excluded_payment_method_types(),
'currency' => strtolower((string) wu_get_setting('currency_symbol', 'USD')),
'confirm' => false,
]
);

Expand Down Expand Up @@ -518,7 +519,8 @@ public function run_preflight() {
$intent_args = wp_parse_args(
$intent_args,
[
'usage' => 'off_session',
'usage' => 'off_session',
'excluded_payment_method_types' => $this->get_excluded_payment_method_types(),
]
);

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -439,6 +439,16 @@ public function test_run_preflight_subscription_mode_uses_price_ids(): void {
$this->captured_session_args['mode'],
'Recurring checkout must use subscription mode'
);
$this->assertSame(
['card'],
$this->captured_session_args['payment_method_types'],
'Stripe Checkout must preserve its card-only default'
);
$this->assertSame(
['klarna'],
$this->captured_session_args['excluded_payment_method_types'],
'Stripe Checkout must exclude Klarna'
);
Comment on lines +442 to +451

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Align this assertion with the supported Checkout contract.

The test currently requires both payment_method_types and excluded_payment_method_types. Update it after the production payload is reconciled so it verifies either the filtered explicit allow-list or the Dashboard-managed dynamic-method path; the mock cannot catch this API contract issue.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php`
around lines 442 - 451, Update the assertions in the Stripe Checkout preflight
test around captured_session_args to match the supported Checkout contract:
verify either the filtered explicit payment_method_types allow-list or the
Dashboard-managed dynamic payment-method path, rather than requiring both
payment_method_types and excluded_payment_method_types. Reconcile the production
payload first, then adjust the test and mock expectations so they validate the
chosen contract.


// Verify line_items exist and use price IDs (not deprecated format)
$this->assertArrayHasKey(
Expand Down
46 changes: 43 additions & 3 deletions tests/WP_Ultimo/Gateways/Stripe_Gateway_Test.php
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,26 @@ public function setUp(): void {
$this->gateway->set_stripe_client($this->stripe_client_mock);
}

public function test_excluded_payment_method_types_include_klarna(): void {
$this->assertSame(['klarna'], $this->gateway->get_excluded_payment_method_types());
}

public function test_excluded_payment_method_types_can_be_customized(): void {
$filter = static function ($payment_method_types) {
$payment_method_types[] = 'paypal';

return $payment_method_types;
};

add_filter('wu_stripe_excluded_payment_method_types', $filter);

try {
$this->assertSame(['klarna', 'paypal'], $this->gateway->get_excluded_payment_method_types());
} finally {
remove_filter('wu_stripe_excluded_payment_method_types', $filter);
}
}

// -------------------------------------------------------------------------
// Helper: build a fully-wired Stripe client mock
// -------------------------------------------------------------------------
Expand Down Expand Up @@ -432,6 +452,7 @@ function ($fields) use (&$registered_field_ids) {
*/
public function test_run_preflight_creates_payment_intent_for_paid_order(): void {
// Build a payment intent mock that expects create() to be called.
$created_args = null;
$payment_intent = \Stripe\PaymentIntent::constructFrom([
'id' => 'pi_new123',
'object' => 'payment_intent',
Expand All @@ -444,7 +465,13 @@ public function test_run_preflight_creates_payment_intent_for_paid_order(): void
->getMock();
$payment_intents_mock->expects($this->once())
->method('create')
->willReturn($payment_intent);
->willReturnCallback(
static function ($args) use (&$created_args, $payment_intent) {
$created_args = $args;

return $payment_intent;
}
);
$payment_intents_mock->method('retrieve')->willReturn($payment_intent);

$client = $this->build_stripe_client_mock(['paymentIntents' => $payment_intents_mock]);
Expand All @@ -462,6 +489,8 @@ public function test_run_preflight_creates_payment_intent_for_paid_order(): void
$this->assertArrayHasKey('stripe_client_secret', $result, 'Result must include stripe_client_secret');
$this->assertArrayHasKey('stripe_intent_type', $result, 'Result must include stripe_intent_type');
$this->assertSame('payment_intent', $result['stripe_intent_type']);
$this->assertSame(['klarna'], $created_args['excluded_payment_method_types']);
$this->assertArrayNotHasKey('payment_method_types', $created_args);

// Cleanup.
$context['payment']->delete();
Expand All @@ -475,6 +504,7 @@ public function test_run_preflight_creates_payment_intent_for_paid_order(): void
* @return void
*/
public function test_run_preflight_creates_setup_intent_for_trial_order(): void {
$created_args = null;
$setup_intent = \Stripe\SetupIntent::constructFrom([
'id' => 'seti_new123',
'object' => 'setup_intent',
Expand All @@ -487,7 +517,13 @@ public function test_run_preflight_creates_setup_intent_for_trial_order(): void
->getMock();
$setup_intents_mock->expects($this->once())
->method('create')
->willReturn($setup_intent);
->willReturnCallback(
static function ($args) use (&$created_args, $setup_intent) {
$created_args = $args;

return $setup_intent;
}
);
$setup_intents_mock->method('retrieve')->willReturn($setup_intent);

$client = $this->build_stripe_client_mock(['setupIntents' => $setup_intents_mock]);
Expand All @@ -505,6 +541,8 @@ public function test_run_preflight_creates_setup_intent_for_trial_order(): void
$this->assertArrayHasKey('stripe_client_secret', $result);
$this->assertArrayHasKey('stripe_intent_type', $result);
$this->assertSame('setup_intent', $result['stripe_intent_type']);
$this->assertSame(['klarna'], $created_args['excluded_payment_method_types']);
$this->assertArrayNotHasKey('payment_method_types', $created_args);

// Cleanup.
$context['payment']->delete();
Expand Down Expand Up @@ -1015,7 +1053,7 @@ public function test_run_preflight_handles_exception_with_empty_error_code(): vo
public function test_run_preflight_applies_payment_intent_args_filter(): void {
$captured_args = null;

add_filter('wu_stripe_create_payment_intent_args', function ($args, $gateway) use (&$captured_args) {
add_filter('wu_stripe_create_payment_intent_args', function ($args) use (&$captured_args) {
$captured_args = $args;
return $args;
}, 10, 2);
Expand Down Expand Up @@ -1049,6 +1087,8 @@ public function test_run_preflight_applies_payment_intent_args_filter(): void {
$this->assertNotNull($captured_args, 'wu_stripe_create_payment_intent_args filter must be applied');
$this->assertArrayHasKey('amount', $captured_args, 'Filter args must include amount');
$this->assertArrayHasKey('currency', $captured_args, 'Filter args must include currency');
$this->assertSame(['klarna'], $captured_args['excluded_payment_method_types']);
$this->assertArrayNotHasKey('payment_method_types', $captured_args);

// Cleanup.
$context['payment']->delete();
Expand Down
Loading