fix(stripe): exclude Klarna from payment methods - #1680
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughStripe payment flows now exclude configurable payment method types, defaulting to Klarna. The exclusion list is passed through Checkout, PaymentIntent, SetupIntent, Billing Portal, and Payment Element initialization, with tests covering defaults and customization. ChangesStripe payment method exclusions
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: Sequence Diagram(s)sequenceDiagram
participant StripeGateway
participant StripeCheckoutGateway
participant StripeAPI
participant PaymentElement
StripeGateway->>StripeAPI: Create PaymentIntent or SetupIntent with Klarna excluded
StripeCheckoutGateway->>StripeAPI: Create Checkout session with Klarna excluded
StripeGateway->>PaymentElement: Provide excluded payment method types
PaymentElement->>StripeAPI: Initialize with excludedPaymentMethodTypes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@inc/gateways/class-base-stripe-gateway.php`:
- Line 923: Update the excluded_payment_method_types assignment in the relevant
Stripe gateway handler to call get_excluded_payment_method_types() on the
membership’s $gateway instance instead of $this, matching how the allowed list
is resolved and preserving gateway-specific filter context.
In `@inc/gateways/class-stripe-checkout-gateway.php`:
- Around line 309-310: Remove the explicit payment_method_types array when
excluded_payment_method_types is supplied at both Checkout session sites:
inc/gateways/class-stripe-checkout-gateway.php lines 309-310 and
inc/gateways/class-base-stripe-gateway.php lines 922-923, preserving the dynamic
exclusion behavior. In
tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php lines
442-451, drop excluded_payment_method_types or update the assertion to match the
reconciled session parameters.
In `@tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php`:
- Around line 442-451: Update the assertions in the Stripe Checkout preflight
test around captured_session_args to match the supported Checkout contract:
verify either the filtered explicit payment_method_types allow-list or the
Dashboard-managed dynamic payment-method path, rather than requiring both
payment_method_types and excluded_payment_method_types. Reconcile the production
payload first, then adjust the test and mock expectations so they validate the
chosen contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f51b191e-80b8-4d5b-8607-ec1cfb45d303
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (7)
assets/js/gateways/stripe.jscomposer.jsoninc/gateways/class-base-stripe-gateway.phpinc/gateways/class-stripe-checkout-gateway.phpinc/gateways/class-stripe-gateway.phptests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.phptests/WP_Ultimo/Gateways/Stripe_Gateway_Test.php
| 'client_reference_id' => $customer_id, | ||
| 'customer' => $s_customer_id, | ||
| 'payment_method_types' => $allowed_payment_method_types, | ||
| 'excluded_payment_method_types' => $this->get_excluded_payment_method_types(), |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Resolve exclusions from the membership gateway instance.
The allowed list is resolved from $gateway, but the new exclusion list is resolved from $this. If this handler runs on a different Stripe gateway instance than the membership’s gateway, gateway-specific filters receive the wrong object. Use $gateway->get_excluded_payment_method_types() here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@inc/gateways/class-base-stripe-gateway.php` at line 923, Update the
excluded_payment_method_types assignment in the relevant Stripe gateway handler
to call get_excluded_payment_method_types() on the membership’s $gateway
instance instead of $this, matching how the allowed list is resolved and
preserving gateway-specific filter context.
| 'payment_method_types' => $allowed_payment_method_types, | ||
| 'excluded_payment_method_types' => $this->get_excluded_payment_method_types(), |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL 'https://docs.stripe.com/api/checkout/sessions/create' |
grep -Fq 'This should only be used when payment methods for this Checkout Session are managed through the Stripe Dashboard.'Repository: Ultimate-Multisite/ultimate-multisite
Length of output: 175
🌐 Web query:
Stripe Checkout sessions create payment_method_types excluded_payment_method_types documentation
💡 Result:
In the Stripe Checkout API, payment_method_types and excluded_payment_method_types are distinct parameters used to control which payment methods are presented to the customer. payment_method_types This parameter is used to explicitly define the list of payment method types (e.g., ['card', 'acss_debit']) to be accepted for a specific Checkout Session [1][2]. If you provide this parameter, Stripe will only offer the payment methods explicitly listed, overriding your default settings in the Stripe Dashboard [3]. If you prefer to manage your payment methods centrally via the Stripe Dashboard (Dynamic Payment Methods), you should omit this parameter [3]. excluded_payment_method_types This parameter is an optional array of payment method types that should be excluded from a Checkout Session [1][4]. It is intended to be used in conjunction with dynamic payment method management [3][5]. When you use this parameter, you can dynamically remove specific methods for a single transaction without having to update your global dashboard settings [3][5]. Key considerations: - Use cases: excluded_payment_method_types is useful when you need granular, per-transaction control that is impractical to manage via global configurations (e.g., excluding certain methods based on the specific items in a cart) [5]. - Exclusions limitations: You cannot use excluded_payment_method_types to hide wallets such as Apple Pay, Google Pay, or Link [3][5]. To control the visibility of these specific methods on a per-transaction basis, you must use the appropriate wallets hash parameters for your integration [3][5]. - Interaction: You can use excluded_payment_method_types alongside your configured payment methods to further refine availability on a case-by-case basis [5].
Citations:
- 1: https://docs.stripe.com/api/checkout/sessions/create
- 2: https://docs.stripe.com/api/checkout/sessions/object.md
- 3: https://docs.stripe.com/payments/payment-methods/dynamic-payment-methods
- 4: https://docs.stripe.com/api/checkout/sessions/create.md?api-version=2026-03-25.dahlia
- 5: https://docs.stripe.com/payments/payment-method-configurations
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Relevant source snippets:\n'
for f in \
inc/gateways/class-stripe-checkout-gateway.php \
inc/gateways/class-base-stripe-gateway.php \
tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php
do
echo "--- $f"
rg -n "payment_method_types|excluded_payment_method_types|create_checkout_session|get_excluded_payment_method_types|get_allowed_payment_method" "$f" || true
done
printf '\nSurrounding contexts:\n'
sed -n '280,325p' inc/gateways/class-stripe-checkout-gateway.php
printf '\n---\n'
sed -n '880,945p' inc/gateways/class-base-stripe-gateway.php
printf '\n---\n'
sed -n '420,458p' tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.phpRepository: Ultimate-Multisite/ultimate-multisite
Length of output: 6181
🌐 Web query:
Stripe API Checkout Session excluded_payment_method_types payment_method_types relationship
💡 Result:
In the Stripe API for Checkout Sessions, payment_method_types and excluded_payment_method_types serve different purposes and operate under different management models [1][2][3]. payment_method_types This parameter is used to explicitly define which payment methods to accept for a Checkout Session [2]. When you provide this list, you are manually controlling the availability of payment methods [1][4]. If you choose to manage your payment methods dynamically through the Stripe Dashboard (the recommended approach for most modern integrations), you should avoid passing this parameter in your integration code, as it overrides the dynamic settings [1][4]. excluded_payment_method_types This parameter is used to remove specific payment methods from a transaction on a per-session basis [2][3]. It is intended for use when you are otherwise managing your payment methods dynamically through the Stripe Dashboard [2][5][3]. By using this parameter, you can exclude specific methods (e.g., "affirm" or "acss_debit") while allowing the Dashboard settings to continue determining the availability of all other enabled methods [1][3]. Key Distinctions and Usage: - Relationship: They are largely mutually exclusive in terms of best practices. You should generally rely on either manual specification (payment_method_types) or dynamic dashboard management combined with per-transaction exclusions (excluded_payment_method_types) [1][2][3]. - Exclusions: The excluded_payment_method_types parameter cannot be used to exclude certain wallet-based payment methods such as Apple Pay, Google Pay, or Link [4][3]. To control the visibility of these specific methods for an individual transaction, you must use the appropriate wallets hash parameters within your integration [4][3]. - Flexibility: Using excluded_payment_method_types offers more granular control than simple dashboard configuration, allowing you to tailor payment options based on specific transaction attributes like the items being purchased [3].
Citations:
- 1: https://docs.stripe.com/payments/payment-methods/dynamic-payment-methods.md?payment-ui=payment-element
- 2: https://docs.stripe.com/api/checkout/sessions/object.md
- 3: https://docs.stripe.com/payments/payment-method-configurations
- 4: https://docs.stripe.com/payments/payment-methods/dynamic-payment-methods
- 5: https://docs.stripe.com/api/checkout/sessions/create.md?api-version=2026-03-25.dahlia
Don’t send explicit payment_method_types together with exclusions.
Stripe treats payment_method_types as an explicit allow-list and excluded_payment_method_types as a refinement for dynamically configured Checkout methods. Sending both makes the exclusions unreliable. Reconcile this at both Checkout session sites, or drop excluded_payment_method_types from this test and update the assertion.
📍 Affects 3 files
inc/gateways/class-stripe-checkout-gateway.php#L309-L310(this comment)inc/gateways/class-base-stripe-gateway.php#L922-L923tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php#L442-L451
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@inc/gateways/class-stripe-checkout-gateway.php` around lines 309 - 310,
Remove the explicit payment_method_types array when
excluded_payment_method_types is supplied at both Checkout session sites:
inc/gateways/class-stripe-checkout-gateway.php lines 309-310 and
inc/gateways/class-base-stripe-gateway.php lines 922-923, preserving the dynamic
exclusion behavior. In
tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php lines
442-451, drop excluded_payment_method_types or update the assertion to match the
reconciled session parameters.
| $this->assertSame( | ||
| ['card'], | ||
| $this->captured_session_args['payment_method_types'], | ||
| 'Stripe Checkout must preserve its card-only default' | ||
| ); | ||
| $this->assertSame( | ||
| ['klarna'], | ||
| $this->captured_session_args['excluded_payment_method_types'], | ||
| 'Stripe Checkout must exclude Klarna' | ||
| ); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Align this assertion with the supported Checkout contract.
The test currently requires both payment_method_types and excluded_payment_method_types. Update it after the production payload is reconciled so it verifies either the filtered explicit allow-list or the Dashboard-managed dynamic-method path; the mock cannot catch this API contract issue.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.php`
around lines 442 - 451, Update the assertions in the Stripe Checkout preflight
test around captured_session_args to match the supported Checkout contract:
verify either the filtered explicit payment_method_types allow-list or the
Dashboard-managed dynamic payment-method path, rather than requiring both
payment_method_types and excluded_payment_method_types. Reconcile the production
payload first, then adjust the test and mock expectations so they validate the
chosen contract.
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
1 participant
Summary
stripe/stripe-phpto v21 so PaymentIntent and SetupIntent support Klarna exclusions.Verification
vendor/bin/phpunit --filter 'WP_Ultimo\\Gateways\\Stripe_Gateway_Test|WP_Ultimo\\Gateways\\Stripe_Checkout_Gateway_Run_Preflight_Test'vendor/bin/phpcs inc/gateways/class-base-stripe-gateway.php inc/gateways/class-stripe-gateway.php inc/gateways/class-stripe-checkout-gateway.php tests/WP_Ultimo/Gateways/Stripe_Gateway_Test.php tests/WP_Ultimo/Gateways/Stripe_Checkout_Gateway_Run_Preflight_Test.phpnode_modules/.bin/eslint assets/js/gateways/stripe.jscomposer validate --no-check-publish --no-interactionaidevops.sh v3.32.192 plugin for OpenCode v1.18.5 with gpt-5.6-terra
Summary by CodeRabbit
New Features
Bug Fixes
Tests