Skip to content

Fraud Protection: Add event dispatching for pay-for-order page#35

Merged
leonardola merged 4 commits intotrunkfrom
add/WOOSUBS-1387-pay-for-order-tracking
Mar 18, 2026
Merged

Fraud Protection: Add event dispatching for pay-for-order page#35
leonardola merged 4 commits intotrunkfrom
add/WOOSUBS-1387-pay-for-order-tracking

Conversation

@leonardola
Copy link
Contributor

Summary

Adds event tracking to CheckoutEventTracker for the pay-for-order flow (WOOSUBS-1387):

  • pay_for_order_page_loaded event — dispatched via template_redirect when is_checkout_pay_page() is true. The regular checkout_page_loaded event is now excluded from pay-for-order pages to avoid duplicate/misleading signals.
  • order_placed event on successful payment — hooks into woocommerce_before_pay_action to register a woocommerce_payment_complete listener scoped to the pay-for-order flow. This is needed because the regular checkout order_placed tracking (via woocommerce_checkout_order_processed) doesn't fire in the pay-for-order path.

Why this approach

The pay-for-order flow in WooCommerce (WC_Form_Handler::pay_action()) doesn't fire woocommerce_checkout_order_processed, so the existing checkout event tracking misses it entirely. We use woocommerce_before_pay_action as a trigger to conditionally register the woocommerce_payment_complete listener — this way the listener is only active during pay-for-order requests, not globally.

Test plan

Pay-for-order page load event

  1. Create a WooCommerce order with status "pending payment" (e.g., place an order with "Check payments" gateway)
  2. Navigate to the pay-for-order page: /checkout/order-pay/<order_id>/?pay_for_order=true&key=<order_key>
  3. Verify in WooCommerce logs (woo-fraud-protection source) that a pay_for_order_page_loaded event is collected
  4. Verify that checkout_page_loaded is not collected on this page

Regular checkout unaffected

  1. Navigate to the regular checkout page
  2. Verify checkout_page_loaded is still collected as before
  3. Verify pay_for_order_page_loaded is not collected on regular checkout

Payment completion tracking

  1. Go to the pay-for-order page for a pending order
  2. Complete payment with a test gateway (e.g., Stripe test mode)
  3. Verify an order_placed event is collected with the correct order details (order_id, payment_method, total, currency, customer_id, status)

Failed payment

  1. Go to the pay-for-order page for a pending order
  2. Attempt payment with a card that will be declined
  3. Verify no order_placed event is collected (since woocommerce_payment_complete doesn't fire on failure)

🤖 Generated with Claude Code

@leonardola leonardola requested a review from luizreis March 12, 2026 12:52
Copy link
Contributor

@luizreis luizreis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's drop the payment completion tracking (track_order_paid_via_pay_for_order, track_payment_complete, the woocommerce_before_pay_action hook, and their tests) from this PR.

  • order_placed and payment completion are different events. In this case, the order was placed (created) before the user reached the pay-for-order page. However, the code on this PR tracks payment, not placement. If we need payment completion tracking later, it should be a distinct event name.
  • The verify call happens before payment, so this event doesn't inform the blocking decision, and it would only appear in a future verify call's collected_events.
  • It might not work for async/redirect gateways since payment_complete fires in a different request where the listener isn't registered.

IMO, the page load tracking with a proper event name is the valuable part and stands well on its own.

Enhance the CheckoutEventTracker to collect an event when the pay-for-order page is loaded. This change includes a new conditional check for the pay-for-order page and updates the corresponding unit tests to verify that the event is correctly collected during the checkout process.
Enhance the CheckoutEventTracker by introducing hooks to track payment completion during the pay-for-order process. This includes registering a listener for the `woocommerce_payment_complete` event and updating the checkout page loaded logic to exclude the pay-for-order page. Corresponding unit tests have been added to ensure proper functionality and event collection.
…d woocommerce_before_pay_action events hooking
@leonardola leonardola force-pushed the add/WOOSUBS-1387-pay-for-order-tracking branch from c385abf to cb3583e Compare March 16, 2026 17:24
Co-authored-by: Luiz Reis <luiz.reis@automattic.com>
@leonardola leonardola force-pushed the add/WOOSUBS-1387-pay-for-order-tracking branch from cb3583e to bec74d9 Compare March 16, 2026 17:27
@leonardola leonardola requested a review from luizreis March 16, 2026 17:30
Copy link
Contributor

@luizreis luizreis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for addressing the comments :shipit:

@leonardola leonardola merged commit d7c70de into trunk Mar 18, 2026
18 checks passed
@leonardola leonardola deleted the add/WOOSUBS-1387-pay-for-order-tracking branch March 18, 2026 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants