Incomplete order created and payment succeeds despite errors in cart

[vicgeralds]

If one or more items become unavailable after initiating checkout, it's still possible to complete the order and any exception thrown while creating the order in Magento is ignored. The push order endpoint will first respond with 404 and when retried will create the order after the missing items have been removed from the quote.

This has happened to us several times. We became aware of the problem because customers contacted us when their order confirmation and amount invoiced or charged didn't match, sometimes after placing another order under the impression that their first was cancelled/unsuccessful.

This is quite likely to happen when promoting a few products at a specific time so that they quickly run out of stock.

Steps to reproduce

1. Go to checkout
2. In admin, set one of the products in cart as out of stock (to simulate another customer buying the last one)
3. Proceed to complete purchase

Expected result

No order placed. Friendly error message that helps customer understand what went wrong and how to proceed.

Actual result

Svea order created with total amount including unavailable item.
Incomplete order created in Magento (if there are other items in cart).

[vicgeralds]

I'm amazed that you still haven't done anything to address this, from what I can see. 😞

We have a workaround, checking that cart items are still available every 5 seconds while on the checkout page, but this still happened to us a few days ago:

[2023-12-26T07:29:47.954589+00:00] svea.ERROR: Push Order: Could not place order. Svea Order ID: XXXXXXXX... Error message:Några av produkterna är slut i lager. [] []
[2023-12-26T07:29:47.954895+00:00] svea.ERROR: Push Controller exception when creating Magento order: [] []
[2023-12-26T07:29:47.954954+00:00] svea.ERROR: Svea\Checkout\Model\CheckoutException: Kunde ej lägga ordern. in .../vendor/sveawebpay/nwt-magento2-checkout/Controller/Order/Push.php:208
Stack trace:
#0 .../vendor/sveawebpay/nwt-magento2-checkout/Controller/Order/Push.php(186): Svea\Checkout\Controller\Order\Push->placeOrder()
#1 .../vendor/sveawebpay/nwt-magento2-checkout/Controller/Order/Push.php(107): Svea\Checkout\Controller\Order\Push->createMagentoOrder()
#2 .../generated/code/Svea/Checkout/Controller/Order/Push/Interceptor.php(32): Svea\Checkout\Controller\Order\Push->tryToCreateOrder()
#3 .../vendor/sveawebpay/nwt-magento2-checkout/Controller/Order/Push.php(43): Svea\Checkout\Controller\Order\Push\Interceptor->tryToCreateOrder()
#4 .../vendor/magento/framework/Interception/Interceptor.php(58): Svea\Checkout\Controller\Order\Push->execute()

Another order was placed at 07:29:02 UTC (almost 2 minutes earlier), ordering the last available item.