taler-android

commit 1c0fa1d08b5384ae0b6c3c25103655c6d1a4a780
parent 811d0db18bc59987368a8a6c0426c2bf01d3b5f7
Author: Iván Ávalos <avalos@disroot.org>
Date:   Tue, 18 Aug 2026 16:23:58 +0200

[pos] do not apply stale order responses to the current payment

stopPaymentChecks() never actually cancelled the check job, so a reply for an
abandoned order could mark an unrelated order claimed or paid.

Diffstat:
M
merchant-terminal/src/main/java/net/taler/merchantpos/payment/PaymentManager.kt
 | 
19
+++++++++++++++----

1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/merchant-terminal/src/main/java/net/taler/merchantpos/payment/PaymentManager.kt b/merchant-terminal/src/main/java/net/taler/merchantpos/payment/PaymentManager.kt
@@ -74,7 +74,8 @@ class PaymentManager(
     @UiThread
     fun createPayment(order: Order, includeProducts: Boolean = true) = scope.launch {
         val merchantConfig = configManager.merchantConfig!!
-        mPayment.value = Payment(order, order.summary, configManager.currency!!)
+        val payment = Payment(order, order.summary, configManager.currency!!)
+        mPayment.value = payment
         val inventoryProducts = if (includeProducts) {
             order.products.mapNotNull { product ->
                 val productId = product.productId ?: return@mapNotNull null
@@ -104,7 +105,13 @@ class PaymentManager(
             onNetworkError(error)
         }) { orderResponse ->
             assertUiThread()
-            mPayment.value = mPayment.value!!.copy(orderId = orderResponse.orderId)
+            if (mPayment.value !== payment) {
+                Log.d(TAG, "Ignoring order ${orderResponse.orderId} for abandoned payment")
+                // cancelPayment() could not delete it yet, it had no order ID back then
+                scope.launch { api.deleteOrder(merchantConfig, orderResponse.orderId) }
+                return@handle
+            }
+            mPayment.value = payment.copy(orderId = orderResponse.orderId)
             checkTimer.start()
         }
     }
@@ -162,7 +169,11 @@ class PaymentManager(
         }) { response ->
             assertUiThread()
             if (!isActive) return@handle // don't continue if job was cancelled
-            val currentValue = requireNotNull(mPayment.value)
+            val currentValue = mPayment.value
+            if (currentValue?.orderId != orderId) {
+                Log.d(TAG, "Ignoring stale check result for order $orderId")
+                return@handle
+            }
             when (response) {
                 is CheckPaymentResponse.Unpaid -> {
                     mPayment.value = currentValue.copy(talerPayUri = response.talerPayUri)
@@ -255,7 +266,7 @@ class PaymentManager(
 
     private fun stopPaymentChecks() {
         checkTimer.cancel()
-        checkJob?.isCancelled
+        checkJob?.cancel()
         checkJob = null
     }
 }