juspay/hyperswitch
在 GitHub 查看[BUG] invalidate `payout_token` once the txn is processed
Open
#6,005 创建于 2024年9月24日
C-bugS-awaiting-triagegood first issue
仓库指标
- Star
- (42,690 star)
- PR 合并指标
- (平均合并 6天 22小时) (30 天内合并 213 个 PR)
描述
Bug Description
payout_token can be used for processing payout txns for saved payout methods. This is a short lived token which is generated by customer's PM list API. These tokens should only be used once. However, these are not being invalidated post usage.
Expected Behavior
Tokens should only be used once per payout request. These must be invalidated after completing the payout txn. Same tokens should not be allowed to be consumed for multiple payouts.
Token generated -> Token attached to a payout
Actual Behavior
Same token is being across multiple payout txns. Moreover, these are not being invalidated once the txn reaches the end of it's lifecycle.
Steps To Reproduce
- Save a payout method
- List customer payment methods for generating
payment_token - Use this
payout_tokenin payout create APIs - Complete the payout txn
- Use this as
payout_tokenagain - should be allowed. Ideal scenario is throwing an error statingInvalid token
Have you spent some time checking if this bug has been raised before?
- I checked and didn't find a similar issue
Have you read the Contributing Guidelines?
- I have read the Contributing Guidelines