Fraud Protection: Add event dispatching for pay-for-order page#35
Merged
leonardola merged 4 commits intotrunkfrom Mar 18, 2026
Merged
Fraud Protection: Add event dispatching for pay-for-order page#35leonardola merged 4 commits intotrunkfrom
leonardola merged 4 commits intotrunkfrom
Conversation
luizreis
requested changes
Mar 13, 2026
Contributor
luizreis
left a comment
There was a problem hiding this comment.
Let's drop the payment completion tracking (track_order_paid_via_pay_for_order, track_payment_complete, the woocommerce_before_pay_action hook, and their tests) from this PR.
order_placedand payment completion are different events. In this case, the order was placed (created) before the user reached the pay-for-order page. However, the code on this PR tracks payment, not placement. If we need payment completion tracking later, it should be a distinct event name.- The
verifycall happens before payment, so this event doesn't inform the blocking decision, and it would only appear in a future verify call'scollected_events. - It might not work for async/redirect gateways since
payment_completefires in a different request where the listener isn't registered.
IMO, the page load tracking with a proper event name is the valuable part and stands well on its own.
Enhance the CheckoutEventTracker to collect an event when the pay-for-order page is loaded. This change includes a new conditional check for the pay-for-order page and updates the corresponding unit tests to verify that the event is correctly collected during the checkout process.
Enhance the CheckoutEventTracker by introducing hooks to track payment completion during the pay-for-order process. This includes registering a listener for the `woocommerce_payment_complete` event and updating the checkout page loaded logic to exclude the pay-for-order page. Corresponding unit tests have been added to ensure proper functionality and event collection.
…d woocommerce_before_pay_action events hooking
c385abf to
cb3583e
Compare
Co-authored-by: Luiz Reis <luiz.reis@automattic.com>
cb3583e to
bec74d9
Compare
luizreis
approved these changes
Mar 18, 2026
Contributor
luizreis
left a comment
There was a problem hiding this comment.
LGTM! Thanks for addressing the comments ![]()
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds event tracking to
CheckoutEventTrackerfor the pay-for-order flow (WOOSUBS-1387):pay_for_order_page_loadedevent — dispatched viatemplate_redirectwhenis_checkout_pay_page()is true. The regularcheckout_page_loadedevent is now excluded from pay-for-order pages to avoid duplicate/misleading signals.order_placedevent on successful payment — hooks intowoocommerce_before_pay_actionto register awoocommerce_payment_completelistener scoped to the pay-for-order flow. This is needed because the regular checkoutorder_placedtracking (viawoocommerce_checkout_order_processed) doesn't fire in the pay-for-order path.Why this approach
The pay-for-order flow in WooCommerce (
WC_Form_Handler::pay_action()) doesn't firewoocommerce_checkout_order_processed, so the existing checkout event tracking misses it entirely. We usewoocommerce_before_pay_actionas a trigger to conditionally register thewoocommerce_payment_completelistener — this way the listener is only active during pay-for-order requests, not globally.Test plan
Pay-for-order page load event
/checkout/order-pay/<order_id>/?pay_for_order=true&key=<order_key>woo-fraud-protectionsource) that apay_for_order_page_loadedevent is collectedcheckout_page_loadedis not collected on this pageRegular checkout unaffected
checkout_page_loadedis still collected as beforepay_for_order_page_loadedis not collected on regular checkoutPayment completion tracking
order_placedevent is collected with the correct order details (order_id, payment_method, total, currency, customer_id, status)Failed payment
order_placedevent is collected (sincewoocommerce_payment_completedoesn't fire on failure)🤖 Generated with Claude Code