Abandoned Invoice Stripe Payment Link remains active

[meuchels]

Bug

after generating a replacement invoice the stripe payment link for the abandoned invoice remains active.

Dolibarr Version

23.0.3

Environment PHP

8.3.6

Environment Database

MySQL or MariaDB 8.0.46-0ubuntu0.24.04.3

Steps to reproduce the behavior and expected behavior

Create Replacement Invoice.
Old invoice is marked abandoned.
New Invoice is generated with new Stripe payment Link.
Old Payment Link remains active.

Attached files

There should be a method to deactivate this, especially if the invoice was already written off or sent to collections.

[pixodeo]

Confirmed and sent #39713 against 23.0.

The cause is that the public payment page decides payability from the paye flag alone, newpayment.php around line 2442. Facture::setCanceled() sets fk_statut to STATUS_ABANDONED and leaves paye at 0, so an invoice abandoned after being replaced still renders a working payment form and the Stripe link keeps working, exactly as you describe.

The class itself documents that status as "classified abandoned and no payment done", so the page now refuses the payment for it, using the same pattern already in place for a paid invoice. Validated and draft invoices are unaffected.

On your remark that there should be a way to deactivate it: since STATUS_ABANDONED also covers close codes like a bad debt, where a company may still want to collect, I put the new behaviour behind ONLINE_PAYMENT_ACCEPT_ABANDONED_INVOICE, off by default. So the link stops working by default after a replacement, and an admin who still wants to collect on abandoned invoices can set that constant.

Note this closes the payment page. It does not revoke anything on the Stripe side, the link simply no longer leads to a payable form.

[pixodeo]

#39713 is merged into 23.0, so this is fixed. After @aspangaro's review the refusal is limited to the replacement case: an invoice closed with close_code 'replaced' no longer shows a payable form, because that amount is claimed by the replacement invoice. An invoice abandoned for any other reason, a bad debt for instance, keeps its link usable, so a customer who decides to pay anyway still can.

Issue left open only because the pull request targeted 23.0 rather than the default branch.

To be explicit about the scope: this closes the payment page, it does not revoke anything on the Stripe side, the link simply no longer leads to a payable form.

[meuchels]

#39713 is merged into 23.0, so this is fixed. After @aspangaro's review the refusal is limited to the replacement case: an invoice closed with close_code 'replaced' no longer shows a payable form, because that amount is claimed by the replacement invoice. An invoice abandoned for any other reason, a bad debt for instance, keeps its link usable, so a customer who decides to pay anyway still can.

Issue left open only because the pull request targeted 23.0 rather than the default branch.

To be explicit about the scope: this closes the payment page, it does not revoke anything on the Stripe side, the link simply no longer leads to a payable form.

in our state if an invoice goes to collections you are no longer authorized to collect on it. therefore abandon the invoice should kill the link. maybe it should be optional??

[pixodeo]

@meuchels that is a fair point and your suggestion is the right shape, so I sent #39735 against 23.0.

ONLINE_PAYMENT_REFUSE_ABANDONED_INVOICE, off by default, extends the refusal to every abandoned invoice instead of only the replaced case:

invoice	default	with the constant
abandoned, replaced	refused	refused
abandoned, bad customer	form shown	refused
abandoned, abandon	form shown	refused
abandoned, other	form shown	refused
validated	form shown	form shown

So your install can set it and the link dies as soon as the invoice is abandoned, whatever the reason, while @aspangaro's case keeps working unchanged for everyone who does not set it. Nothing changes by default.

One limit worth repeating: this closes the Dolibarr payment page, it does not revoke anything on the Stripe side. If your legal constraint requires the Stripe object itself to be cancelled, that is a different change and worth its own issue, since it means calling the Stripe API when an invoice is abandoned rather than just refusing to render the form.