isExpired aborts payments that could pass on Stripe

mhawwari → changed the visibility of the branch 3444153-isexpired-aborts-payments to hidden.

mhawwari → changed the visibility of the branch 3444153-isexpired-aborts-payments to active.

This closely relates to #3171270: Support 'smarter saved cards' → with same proposed solution.

This is reasonable.

In the past, sites were expected to not submit expired cards for payment, as it appeared as suspicious activity. Fraud prevention measures have evolved.

Even if the expired date is "valid", the card could have been reported lost/stolen and the card would still not work anyway.

Thanks for the MR!

The fix may be wrong.

PaymentGatewayBase has this:

  protected function assertPaymentMethod(PaymentMethodInterface $payment_method = NULL) {
    if (empty($payment_method)) {
      throw new \InvalidArgumentException('The provided payment has no payment method referenced.');
    }
    if ($payment_method->isExpired()) {
      throw HardDeclineException::createForPayment($payment_method, 'The provided payment method has expired');
    }
  }

Wouldn't the correct solution be to keep the calls to assertPaymenMethod() but to override and simplify the method:

  /**
   * {@inheritdoc}
   */
  protected function assertPaymentMethod(PaymentMethodInterface $payment_method = NULL) {
    if (empty($payment_method)) {
      throw new \InvalidArgumentException('The provided payment has no payment method referenced.');
    }
  }

Hi @jonathanshaw,

That would seem so, except the preceding line in both classes was already doing:

    assert($payment_method instanceof PaymentMethodInterface);
    $this->assertPaymentMethod($payment_method);

Because of the assert, payment_method would already be checked for existence, so that would be a redundant check that would never be true.

One could discuss whether assert() should be used at all, but it has been there for ~5 years, and would be more appropriate for another issue to discuss assert() usage.

Automatically closed - issue fixed for 2 weeks with no activity.