Fix phantom payment bugs in Stripe payment type

packages/stripe/src/Events/OrphanedPaymentIntentDetected.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Lunar\Stripe\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class OrphanedPaymentIntentDetected
+{
+    use Dispatchable, SerializesModels;
+
+    public function __construct(
+        public string $paymentIntentId,
+        public ?int $cartId,
+        public ?string $reason = null,
+    ) {
+        //
+    }
+}

packages/stripe/src/Managers/StripeManager.php

@@ -33,7 +33,7 @@ public function getClient(): StripeClient
 
     public function getCartIntentId(CartContract $cart): ?string
     {
-        return $cartModel->meta['payment_intent'] ?? $cart->paymentIntents()->active()->first()?->intent_id;
+        return $cart->meta['payment_intent'] ?? $cart->paymentIntents()->active()->first()?->intent_id;
     }
 
     public function fetchOrCreateIntent(CartContract $cart, array $createOptions = []): PaymentIntent

packages/stripe/src/StripePaymentType.php

@@ -14,6 +14,7 @@
 use Lunar\Models\Transaction;
 use Lunar\PaymentTypes\AbstractPayment;
 use Lunar\Stripe\Actions\UpdateOrderFromIntent;
+use Lunar\Stripe\Events\OrphanedPaymentIntentDetected;
 use Lunar\Stripe\Facades\Stripe;
 use Lunar\Stripe\Models\StripePaymentIntent;
 use Stripe\Exception\InvalidRequestException;
@@ -97,23 +98,6 @@ final public function authorize(): ?PaymentAuthorize
             'processing_at' => now(),
         ]);
 
-        if (! $this->order) {
-            try {
-                $this->order = $this->cart->createOrder();
-                $paymentIntentModel->order_id = $this->order->id;
-            } catch (DisallowMultipleCartOrdersException|CartException $e) {
-                $failure = new PaymentAuthorize(
-                    success: false,
-                    message: $e->getMessage(),
-                    orderId: $this->order?->id,
-                    paymentType: 'stripe'
-                );
-                PaymentAttemptEvent::dispatch($failure);
-
-                return $failure;
-            }
-        }
-
         $this->paymentIntent = $this->stripe->paymentIntents->retrieve(
             $paymentIntentId
         );
@@ -122,7 +106,7 @@ final public function authorize(): ?PaymentAuthorize
             $failure = new PaymentAuthorize(
                 success: false,
                 message: 'Unable to locate payment intent',
-                orderId: $this->order->id,
+                orderId: $this->order?->id,
                 paymentType: 'stripe',
             );
 
@@ -137,7 +121,39 @@ final public function authorize(): ?PaymentAuthorize
             );
         }
 
+        // Sync the Stripe-side status before any local order work so the row
+        // never disagrees with reality even when downstream steps throw.
         $paymentIntentModel->status = $this->paymentIntent->status;
+        $paymentIntentModel->save();
+
+        if (! $this->order) {
+            try {
+                $this->order = $this->cart->createOrder();
+                $paymentIntentModel->order_id = $this->order->id;
+                $paymentIntentModel->save();
+            } catch (DisallowMultipleCartOrdersException|CartException $e) {
+                if ($this->paymentIntent->status === PaymentIntent::STATUS_SUCCEEDED) {
+                    $paymentIntentModel->processed_at = now();
+                    $paymentIntentModel->save();
+
+                    OrphanedPaymentIntentDetected::dispatch(
+                        $paymentIntentId,
+                        $this->cart?->id,
+                        $e->getMessage(),
+                    );
+                }
+
+                $failure = new PaymentAuthorize(
+                    success: false,
+                    message: $e->getMessage(),
+                    orderId: $this->order?->id,
+                    paymentType: 'stripe'
+                );
+                PaymentAttemptEvent::dispatch($failure);
+
+                return $failure;
+            }
+        }
 
         $order = (new UpdateOrderFromIntent)->execute(
             $this->order,

tests/stripe/Unit/Managers/StripeManagerTest.php

@@ -20,3 +20,39 @@
         'status' => $intent->status,
     ]);
 });
+
+it('returns legacy payment intent id stored in cart meta', function () {
+    $cart = CartBuilder::build([
+        'meta' => [
+            'payment_intent' => 'PI_LEGACY_META',
+        ],
+    ]);
+
+    expect(Stripe::getCartIntentId($cart))->toBe('PI_LEGACY_META');
+});
+
+it('prefers legacy meta payment intent over active relation', function () {
+    $cart = CartBuilder::build([
+        'meta' => [
+            'payment_intent' => 'PI_LEGACY_META',
+        ],
+    ]);
+
+    $cart->paymentIntents()->create([
+        'intent_id' => 'PI_RELATION',
+        'status' => 'requires_payment_method',
+    ]);
+
+    expect(Stripe::getCartIntentId($cart))->toBe('PI_LEGACY_META');
+});
+
+it('falls back to active payment intent when no legacy meta', function () {
+    $cart = CartBuilder::build();
+
+    $cart->paymentIntents()->create([
+        'intent_id' => 'PI_RELATION',
+        'status' => 'requires_payment_method',
+    ]);
+
+    expect(Stripe::getCartIntentId($cart))->toBe('PI_RELATION');
+});

tests/stripe/Unit/Models/StripePaymentIntentTest.php

@@ -0,0 +1,49 @@
+<?php
+
+use Lunar\Stripe\Facades\Stripe;
+use Lunar\Stripe\Models\StripePaymentIntent;
+use Lunar\Tests\Stripe\Unit\TestCase;
+use Lunar\Tests\Stripe\Utils\CartBuilder;
+
+uses(TestCase::class);
+
+it('excludes succeeded intents from the active scope', function () {
+    $cart = CartBuilder::build();
+
+    $cart->paymentIntents()->create([
+        'intent_id' => 'PI_PENDING',
+        'status' => 'requires_payment_method',
+    ]);
+
+    $cart->paymentIntents()->create([
+        'intent_id' => 'PI_DONE',
+        'status' => 'succeeded',
+    ]);
+
+    $cart->paymentIntents()->create([
+        'intent_id' => 'PI_CANCELLED',
+        'status' => 'canceled',
+    ]);
+
+    $active = $cart->paymentIntents()->active()->pluck('intent_id')->all();
+
+    expect($active)->toBe(['PI_PENDING']);
+});
+
+it('does not return a succeeded payment intent from getCartIntentId', function () {
+    $cart = CartBuilder::build();
+
+    $cart->paymentIntents()->create([
+        'intent_id' => 'PI_DONE',
+        'status' => 'succeeded',
+    ]);
+
+    expect(Stripe::getCartIntentId($cart))->toBeNull();
+});
+
+it('treats a succeeded intent row as inactive via isActive()', function () {
+    $intent = new StripePaymentIntent;
+    $intent->status = 'succeeded';
+
+    expect($intent->isActive())->toBeFalse();
+});

tests/stripe/Unit/StripePaymentTypeTest.php

@@ -1,9 +1,12 @@
 <?php
 
+use Illuminate\Support\Facades\Event;
 use Lunar\Base\DataTransferObjects\PaymentAuthorize;
 use Lunar\Models\Currency;
 use Lunar\Models\Transaction;
+use Lunar\Stripe\Events\OrphanedPaymentIntentDetected;
 use Lunar\Stripe\Facades\Stripe;
+use Lunar\Stripe\Models\StripePaymentIntent;
 use Lunar\Stripe\StripePaymentType;
 use Lunar\Tests\Stripe\Unit\TestCase;
 use Lunar\Tests\Stripe\Utils\CartBuilder;
@@ -172,6 +175,64 @@
     expect($cart->refresh()->completedOrder)->toBeNull();
 });
 
+it('syncs payment intent status when order creation fails on a succeeded stripe intent', function () {
+    Event::fake([OrphanedPaymentIntentDetected::class]);
+
+    $cart = CartBuilder::build();
+
+    // Force createOrder to throw a CartException — strip the addresses
+    $cart->addresses()->delete();
+    $cart->refresh();
+
+    $payment = new StripePaymentType;
+
+    $response = $payment->cart($cart)->withData([
+        'payment_intent' => 'PI_CAPTURE',
+    ])->authorize();
+
+    expect($response)->toBeInstanceOf(PaymentAuthorize::class)
+        ->and($response->success)->toBeFalse();
+
+    // Status must be synced from Stripe so the row is no longer "active"
+    assertDatabaseHas(StripePaymentIntent::class, [
+        'intent_id' => 'PI_CAPTURE',
+        'cart_id' => $cart->id,
+        'status' => 'succeeded',
+    ]);
+
+    $intentRow = StripePaymentIntent::where('intent_id', 'PI_CAPTURE')->first();
+    expect($intentRow->processed_at)->not()->toBeNull();
+
+    Event::assertDispatched(OrphanedPaymentIntentDetected::class, function ($event) use ($cart) {
+        return $event->paymentIntentId === 'PI_CAPTURE'
+            && $event->cartId === $cart->id;
+    });
+});
+
+it('syncs payment intent status when order creation fails on a non-succeeded stripe intent', function () {
+    Event::fake([OrphanedPaymentIntentDetected::class]);
+
+    $cart = CartBuilder::build();
+    $cart->addresses()->delete();
+    $cart->refresh();
+
+    $payment = new StripePaymentType;
+
+    $response = $payment->cart($cart)->withData([
+        'payment_intent' => 'PI_FAIL',
+    ])->authorize();
+
+    expect($response->success)->toBeFalse();
+
+    assertDatabaseHas(StripePaymentIntent::class, [
+        'intent_id' => 'PI_FAIL',
+        'cart_id' => $cart->id,
+        'status' => 'requires_payment_method',
+    ]);
+
+    Event::assertNotDispatched(OrphanedPaymentIntentDetected::class);
+});
+
 it('can return correct payment checks', function () {
     Currency::factory()->create();