Cart contents lost before Paypal completion

hehe No worries, you're right. This is in fact the way we designed it to work, even though it may not be optimal. The problem is we have no way of knowing if the customer left PayPal or just opened the commerce store in another tab. As such, we don't want them coming back to fiddle with the cart contents after redirecting to PayPal. The way this happens behind the scenes is that once you go to the payment page, your order status gets updated to Checkout: Payment, indicating the order is awaiting payment and should not be modifiable (i.e. should no longer be a cart).

Again, this isn't ideal, but it seems to be the best case for avoiding potential fraud by default. I'm open to ideas on how to avoid the situation you're encountering. It's worth noting that as long as the customer uses the "back" or "cancel" links provided by PayPal, they will not experience cart loss.

I've been using ATOS sandbox module by jsacksick (http://drupal.org/sandbox/jsacksick/1254362) which seems to work properly.
However I am experiencing the same type of problem, when the user goes to the payment page the cart is no longer available.

I understand the point in #1, but with jsacksick module, even when i click on "cancel, go to back to shop" when on the bank payment page, the cart is still set to Checkout : Payment. Hence, if the customer decides to go back to another product page to add it to the cart before checking out, he will have a new cart, and lose his previous cart forever.

Maybe an alternative would be "freeze" the order content at this point, not allowing users to add product in it, unless they manually "unfreeze" it (Rules integrations for custom messages). A little bit like Views is doing by locking the view edition if it's already been edited by another user - I do think it might be a little bit complex for a user, but still less confusing than losing his cart / losing a client.

@liupascal - it seems that perhaps the ATOS module just doesn't use the proper cancel URL (or that ATOS doesn't support it - but I doubt that).

Apologies, it seems that the "Return to shop" button works properly :/

@rszrama : What about the order "locking" feature, would this be acceptable ?

I'm tempted to close this as "works as designed", but maybe locking the order could be taken into consideration for 2.x? @Anyone, feel free to overrule me if you think we can/should do this in 1.x :)

From #1:

It's worth noting that as long as the customer uses the "back" or "cancel" links provided by PayPal, they will not experience cart loss.

However, I am experiencing the situation where I cancel the Paypal payment and click Paypal link to return to the website, then remove an item from the cart, but the order status stays on Payment and I keep being redirected to Paypal.

More in detail: I have a rule that enables Paypal payments only for order totals > 0 (I have a few free products also).

But if I, say, add a priced product and a free product to the cart, then proceed to the Paypal site, then cancel payment and return to my site, then go back to the cart and remove the priced product, then move on again to the review status, I would expect to skip the payment status and complete the checkout. But instead, I keep being redirected to Paypal.

It looks like once the payment method is enabled for an order, it stays enabled even after modifiyng the cart , and the condition Total > 0 does not get re-evaluated.

@tuccio: what you're experiencing (about the condition that the total must be > 0) is actually a separate issue, which you can see here: #1852370: Payment method remains attached to order even after order total changes to $0.00

A possible approach: rather than "locking" the order from adding contents to it (since users may want to do that), how about this: any time an order with a "checkout_payment" status is modified (i.e., contents are added to/removed from it), it's status is reset to "cart." Then, if the buyer returns to /checkout/[order-id]/payment/return/[payment-redirect-key] from an offsite payment page like PayPal, the status of the order is checked. Since the order no longer has a status of "checkout_payment," the completion is rejected and the order remains in cart status.

Of course, the payment method module would still have to respond to the fact that a payment was made. Perhaps, for example, the module could immediately cancel the payment with the payment processor when it detects that a payment was made for an order with a status of "cart."

Thoughts?

In my setup I have some products that the user can add some modifications through line-item fields.

It is important for us that this issue get resolved because we expect users to be able to come back from payment, for any reason, and still have their "modifications" not lost.

What would you suggest as a possible workaround for this ?

This is not a nice behaviour in Commerce and works very well in Ubercart, never had a problem that the customers edited the order. The cancel button on Paypal brings the user to the completed page and the cart content is lost.

tnfno, I believe you're experiencing some different behavior. The Cancel button at PayPal also brings the customer back to the checkout form in Commerce and will not result in cart contents being lost. Are you sure they aren't using the browser back button or some other behavior?

I'm in the same situation with having a customer gone through an order using paypal as payment, and return to the site using the browser's back button.
Since the order is in payment status, it looks like the customer has an empty cart.

Is there any workaround for this issue?

Would the following work?
Before redirect to PayPal and only for this type of payment, set the status order to review.
If the user goes back with black button then the user will see the cart.
Otherwise update order status according to PayPal action.
Is this something that can be done?

It's a bit simplistic, but you could add a check to commerce_paypal_ec_redirect_form so that if the user isn't coming from the /review page, assume they've come from somewhere else and cancel the paypal checkout process.

A hackish attempt:

    if (strpos($_SERVER['HTTP_REFERER'], '/review') > 1) {
      // only proceed if the user is coming from the review page
      drupal_goto(commerce_paypal_ec_checkout_url($payment_method['settings']['server'], $order->data['commerce_paypal_ec']['token']));
    } else {
      // cancel order if user is not coming from the review page
      commerce_paypal_ec_redirect_form_back($order, $payment_method);
    }