WPP: Payment to paypal sent before Review is submitted

missed a step

It seems that at some point this issue was almost addressed. There is a rule you can configure to "Capture a payment from a previous authorization" but the rule is empty. In the latest dev version its totally removed. I think this came from this support request:
#1820356: Rule to capture from a previous authorization empty

The WPP module is really not usable on its own if there is no way to authorize payment during checkout, then capture when the order is complete. I will close this as a duplicate of the above issue and continue this thread there.

not a duplicate... this issue seems to be moved out of commerce. I think this is the responsibility of the WPP module to support capture of payment outside of the submit handler for the payment pane.

OK so here's what I've discovered so far.

It seems my original issue could be resolved if on the WPP settings page this is selected: Authorization only (requires manual or automated capture after checkout)

If that's selected, however, there's no way to capture the payment automatically.

You could do it with rules, but there's no rule in commerce or payment or WPP that would allow you to do this. That's where #1820356: Rule to capture from a previous authorization empty comes in.

You could argue that I'm looking for a new feature here, but consider this:

1. The default setting of "Authorization and capture" will result in the buggy, broken process that I detailed in the original issue summary
2. The alternative setting of "Authorization only (requires manual or automated capture after checkout)" will require an administrator to capture payments manually, or custom PHP code in rules to work.

That's why I'm keeping this as a "bug report"

For now I will probably go with a PHP solution in a custom rule, but I feel like this should not be required to make this module work. I will post back my solution here.

I would be willing to post a patch as well if someone could give me some guidance about where this should be fixed:

1. Should the fix be a rule in commerce payment like the one druroot put together in #1820356: Rule to capture from a previous authorization empty
2. Should the fix be a rule in WPP that is similar to druroot's patch, but specific to PayPal?

I'd vote for #1

Attached is a patch that moves the capture functionality from the admin capture screen into a function that can be used from a rule. If the patch I attached to #1820356: Rule to capture from a previous authorization empty is committed, then this will allow an admin to put a rule at checkout that will use the action from the payment module to capture the payment.

So to make this work

1. use patch from #1820356: Rule to capture from a previous authorization empty
2. apply the patch below
3. edit your WPP payment method: set "Default credit card transaction type" to "Authorization only"
4. go to checkout rules, add a new rule
5. call it what you want
6. add an action: "Capture from a prior authorization"
7. profit

forgot to attach

The payment checkout pane needs to be at the last step before completion. It doesn't make a whole lot of sense to collect payment before the review page in most cases, because customers like to see the final order total before giving their payment information.

That seems crazy to me. Isn't that why the first pane on the Checkout page is the cart contents and line items? The user already had to see the cart once to get to checkout, then they see it at the top of the Checkout page. Why would they need a 3rd review before even entering credit card details?

I feel like in most e-commerce websites, I enter payment info on the checkout screen before a final review lets me pull the trigger on the order... I can't think of one time that I ever went from entering my credit card to immediately getting charged.

Anytime I've ever purchased anything online, I get to review my order AFTER I enter my credit card information but BEFORE the order is submitted. With the way you say this module should work, you'd review the order, THEN enter the credit card, and then it's all over without any further review? That seems extremely odd to me.

Doesn't Ubercart collect credit card details on the page before the final review "submit order" action?

Also, if authorization before capture causes credit problems for the user, why even provide that option?

OK...

So I just spent some time on this, talked it over with my boss and did some homework..

My misunderstanding of exactly what "Authorize" involves is the source of my confusion.

Authorization vs. capture

I asked

if authorization before capture causes credit problems for the user, why even provide that option?

I read up on Authorization vs. Capture and found the following :

Capture Within 3 Days

1. Your buyer orders a camera from your website.
2. Your buyer enters payment information and authorizes payment.
3. Send your buyer to PayPal using a hosted flow, specifying the variable paymentaction=authorization
4. PayPal initiates the authorization.
5. On day 3, you ship the camera and capture funds.

So, Authorization should NOT occur when the user simply enters a Credit Card ##

Checkout process with "Review" between CC entry and auth/capture

I defend that it is quite common and often expected that the user get 1 last review before the Payment completes.

See apple.com and amazon.com as examples:

apple.com checkout

Shows 1 more step to review between CC entry and submission

amazon.com checkout

Shows 1 more step to review between CC entry and submission

However, it seems it is not possible to develop this workflow with this WPP Drupal Commerce module because submission of the payment pane seems to send CC data to PayPal immediately, either to authorize or capture. So there is no final review for the user.

Checkout process withOUT "Review" between CC entry and auth/capture

It appears that the only way commerce will work is if the payment executes immediately after CC entry. I suppose that makes sense if there's not a way to interact with PayPal in way that offloads the CC data to be processed at a later stage without actually running an authorization call.

It seems Reebok.com uses this method:

reebok.com checkout

Shows immediate order completion after CC entry

My questions:

1. Is this correct that there's no way to stop the Payment pane from sending payment to PayPal immediately?
2. If so, is it indeed because we can't give CC details to paypal without running auth, and because storing them in $_SESSION or, $form or anywhere in the database is a PCI violation?