adyen-magento2: Customer's get payment methods endpoint shouldn't require Adyen_Payment::paymentMethods

Describe the bug It is impossible to fetch available payment methods as a customer via Rest API if the customer signed in via GQL.

To Reproduce Steps to reproduce the behavior:

  1. Sign in via GQL
  2. Use received token in the request to the /V1/carts/mine/retrieve-adyen-payment-methods
  3. It tells the customer is not authorized to access this source.

Expected behavior Resource should be anonymous or maybe(?) self. Here. The customer is able to use native endpoints like GET /V1/customers/me or GET /V1/carts/mine with GQL token so they should be able to use POST /V1/carts/mine/retrieve-adyen-payment-methods too.

Magento version 2.4.3

Plugin version 8.2.5

Additional context I am conscious there is GQL approach for Adyen M2 integration but I don’t want to be one of their early adapters.

My temporary solution I am sending cartId (as hash) and customerToken from the frontend to my middleware. There I compare if the customer is owner of the cart if so - I am fetching unmasked cart ID and sending it to the endpoint but I am using newly generated integration token instead of customer token. Is it fine in your opinion?

About this issue

  • Original URL
  • State: open
  • Created 2 years ago
  • Comments: 16 (13 by maintainers)

Most upvoted comments

Hi guys,

Based on your feedback we will be reviewing the access rights of these endpoints. However these changes may only be added on our next major release which for now is scheduled for Q1 2023. They cannot be done on the current v8, since they would be breaking for any merchants that have followed our suggestion and implemented an oath integration.

Thanks, Jean Adyen

Updated proposal:

Requests that will be done while cart is active:

Resource Permission Additional info
/V1/guest-carts/:maskedCartId/retrieve-adyen-payment-methods anonymous
/V1/carts/mine/retrieve-adyen-payment-methods self
/V1/adyen/guest-carts/:maskedCartId/payment-details anonymous
/V1/adyen/carts/mine/payment-details self
/V1/adyen/guest-carts/:maskedCartId/state-data anonymous
/V1/adyen/carts/mine/state-data self

Requests that will be done while cart is inactive:

Resource Permission Additional info
/V1/adyen/orders/carts/:maskedCartId/donations anonymous Require the order to be in specific states
/V1/adyen/orders/carts/:maskedCartId/payment-status anonymous Require the order to be in specific states

Terminal requests:

Resource Permission Additional info
/V1/adyen/initiate-terminal anonymous