Split Payment

Other changes

• Works next to PayPal and Adobe Payment Services. Tested on the same checkout as PayPal Express Checkout, PayPal Braintree and Adobe Payment Services (PayPal smart buttons, card fields, Apple Pay, Google Pay), on Magento's checkout and One Step Checkout, on Magento Open Source 2.4.9 and on Adobe Commerce 2.4.8 with Payment Services 2.17: switching between the methods and paying in full or across two cards with Split Payment.
• Card holds are released when another method pays the cart. A shopper who authorized cards with Split Payment and then places the order with PayPal, Adobe Payment Services, Braintree or any other method no longer keeps the holds until the abandoned-hold cron: they are canceled in Stripe right after the other order is saved. A Stripe error never affects that order; the cron releases what is left.
• Fixed: a hold left from a split attempt could be linked to an order of the same cart that was paid with another method (the cart keeps its reserved order number), so it was never released. Only Split Payment orders are matched now; the abandoned-hold cron releases such holds.
• Fixed: *"Your session expired. Reload checkout."* when placing an order on Magento's checkout after the form key cookie changed (for example on a shopper's first page view). The checkout and the payment status page now send the key of the form_key cookie, which Magento copies into the session on every request.
• Adobe Commerce 2.4.8 and 2.4.9. magento/framework 103.0.8 or later (was 103.0.9), symfony/console 6.4 or 7.4. Installed, compiled and tested on Adobe Commerce 2.4.8-p5.
• Adobe Commerce Marketplace requirements: the Magento coding standard reports no errors or warnings at any severity (173 warnings before), Magento's ESLint rules no findings, PHPCompatibility no findings for PHP 8.3 and later, and every XML file validates against its schema. Deprecated load() calls on models were replaced with the resource model, empty catch blocks were removed, and a static helper became an instance method. No behavior change.
• magento/module-downloadable is listed under suggest: the links of orders held for Stripe Radar stay unavailable when it is installed.
• After updating: setup:upgrade, setup:di:compile (production mode) and setup:static-content:deploy. No database changes.

Other changes

• Ask for customer consent now shows the save option in carts with a subscription too (with Techimprovement Subscriptions Split Payment 1.1.1). Before, the card of a subscription cart was always saved and the checkout only showed *This card will be saved securely in your account for the payments of your subscription.*, whatever the setting. The option reads *Save this card securely in my account and use it to renew my subscription automatically.* and follows Save Option Checked by Default. A checked card is saved for the renewals (Stripe off-session setup and subscription consent, so renewals are charged automatically); an unchecked card is not saved, the checkout says *Without a saved card, we will email you a link to pay each renewal of your subscription.*, and the subscription renews from an email payment link. Save without asking keeps saving the card of a subscription cart without the option. Magento's standard checkout and One Step Checkout behave the same.

Other changes

• The payment method is no longer offered when the cart total is zero (free products, a 100% discount), in Magento's checkout, One Step Checkout and the checkout APIs. Stripe cannot charge a zero amount, so before, choosing it on a free cart ended in an error at Place Order. When a coupon brings the total to zero on the checkout page, the method disappears from the list, and it comes back when the coupon is removed. Free orders are placed with No Payment Information Required (Stores › Configuration › Sales › Payment Methods › Zero Subtotal Checkout), which Techimprovement Free Products also offers for carts with a free product.

Other changes

• Save customer payment method replaces *Allow Customers to Save Stripe Cards*, with three choices like the official Stripe module: Disabled, Ask for customer consent (the former *Yes*) and Save without asking. Existing settings keep their meaning: *Yes* is *Ask for customer consent*, *No* is *Disabled*.
• Ask for customer consent: the option *Save this card securely in my account for future purchases.* now starts checked for signed-in customers, for pay in full and every card of a split payment, also after adding a card or switching between pay in full and split. The new setting Save Option Checked by Default (default Yes) brings back the unchecked option where customers must opt in actively.
• Save without asking: every new card a signed-in customer pays with is saved, and the checkout shows *This card will be saved securely in your account for future purchases.* instead of the option. The server saves the card for the signed-in owner of the cart whatever the browser sends; guests are never saved and never get an error. The saved-cards page in the customer account says that cards are saved automatically.
• Carts with a subscription (Techimprovement Subscriptions Split Payment): the card is always saved for the renewals, so signed-in customers see *This card will be saved securely in your account for the payments of your subscription.* instead of the option, in every mode. The browser now tells Stripe the same off-session saving the server uses; before, a checked option on a subscription cart made Stripe refuse the payment.
• With Save without asking, a new card paid on the payment status page (after a failed or abandoned payment) is saved too.
• The same card saved more than once (same card number and expiry) is listed once, in the customer account and at checkout. Removing it removes all its copies.
• Card CVC code: Collect only for new cards (default, as before) or Collect for new and saved cards. The latter shows a *Security code (CVC)* field under a chosen saved card, in split payments and when paying in full (Magento checkout and One Step Checkout, Luma and Hyvä). Place Order waits until it is filled in, and Stripe checks the code with the payment. Every full payment asks Stripe to require the code of saved cards, so a saved card cannot be charged without it even by a modified browser. A checkout page opened before the setting was switched on is refused with *Reload checkout to enter the security code (CVC) of the saved card.* before an order is created. Subscription renewals never ask for it.
• Fraud via Stripe Radar: new group with Hold elevated risk orders (default Enabled). When Stripe Radar rates a card of an order as elevated or highest risk, or places the payment in review, the order is put on hold with the new status Manual Review Required and a comment with the card, risk level, score and what to do. Split orders are held at Place Order, orders paid in full once Stripe confirms the payment. Approving the review in Stripe releases the order (webhook event review.closed); refunded, disputed or canceled reviews keep it on hold with a comment. Orders held by an admin are never released by Stripe, and any Unhold ends the Radar hold, so a later manual hold is never released by Stripe either. Downloadable links of a held order stay unavailable until it is released. The admin order view shows the Radar result of each card (never shown to customers, in emails or PDFs). Renewals of Techimprovement Subscriptions are never held. If a held order that started a subscription is refused (Unhold, then Cancel), Techimprovement Subscriptions 1.6.0 cancels that subscription; for a refused paid order (Credit Memo) the comment reminds you to cancel the subscription.
• The Stripe webhook now also subscribes to review.opened and review.closed. After updating, select Generate Stripe Webhook once per store view (test and live), or add the two events to a destination you created by hand. A restricted secret key needs read access to Charges (risk level at Place Order) and Reviews (release on approval).
• Pay in full: a card the customer chooses to save is now saved through the card's own options, so payment methods that cannot be saved (for example some pay-later methods) stay available in the form while the save option is checked. Before, the checked option could hide them.
• With Techimprovement Subscriptions Split Payment 1.1.0, the payment method's settings also contain a Subscriptions group (see that module).
• Database: new status ti_split_manual_review (state On Hold, visible on the storefront) and Radar columns on the card table. Run bin/magento setup:upgrade.
• Tested against a local fake of the Stripe API and Stripe.js, not against Stripe. Check in Stripe test mode before going live:
• Pay in full and split with a new card and the save option checked, unchecked and with Save without asking; the card appears in My Account › Saved Cards only when it should.
• A subscription cart paid in full and split (cards saved off-session, renewal charged).
• With Collect for new and saved cards: a saved card with the right CVC (paid), a wrong CVC (declined, with a message), and a new card and a wallet (still paid).
• Radar: test card 4000 0000 0000 9235 (elevated risk) holds the order; with a Radar review rule, approving the review in Stripe releases it.