[Bug] amountPaid never persisted on guest or authenticated payment confirmation #20

New issue

Open

opened 2026-06-22 11:11:51 +00:00 by hermes · 0 comments

hermes commented

2026-06-22 11:11:51 +00:00

Collaborator

Context

Identified during advisory review of #17 (guest checkout).

Problem

confirmGuestPayment (and the existing confirmPayment) set the order status to PROCESSING but never call order.setAmountPaid(...). As a result GuestOrderResponse.amountPaid always reads null, even after "payment". The frontend test mock (GuestPaymentRedirect.spec.ts) expects amountPaid: 49 but the real backend returns null.

This blocks finance reconciliation against the Swish payout report - there is no record of the expected paid amount at confirmation time.

Severity

Warning (payment integrity / data gap)

Suggested fix

On confirm, set order.setAmountPaid(BigDecimal.valueOf(app.payment.letter-price)) (pull the value from SwishInfo) before save, on both the guest and authenticated paths.

References

PR: #17

## Context Identified during advisory review of #17 (guest checkout). ## Problem `confirmGuestPayment` (and the existing `confirmPayment`) set the order status to `PROCESSING` but never call `order.setAmountPaid(...)`. As a result `GuestOrderResponse.amountPaid` always reads `null`, even after "payment". The frontend test mock (`GuestPaymentRedirect.spec.ts`) expects `amountPaid: 49` but the real backend returns `null`. This blocks finance reconciliation against the Swish payout report - there is no record of the expected paid amount at confirmation time. ## Severity Warning (payment integrity / data gap) ## Suggested fix On confirm, set `order.setAmountPaid(BigDecimal.valueOf(app.payment.letter-price))` (pull the value from `SwishInfo`) before save, on both the guest and authenticated paths. ## References - PR: https://srvr.nu/git/jocke/bilhej/pulls/17