Problem/Motivation
In AcceptHostedInterface::getAcceptHostedCheckoutForm() (src/Plugin/Commerce/PaymentGateway/AcceptHosted.php), when no amount context is explicitly passed in, the transaction amount sent to
Authorize.net's Accept Hosted payment page falls back to:
$amount = $order->getTotalPrice();
This should be:
$amount = $order->getBalance();
getTotalPrice() returns the order's full total regardless of anything already paid or credited against it. getBalance() returns the total minus completed payments, which is the amount actually still owed
and the amount that should be presented for authorization/capture.
As written, any order that arrives at the Accept Hosted payment step with a non-zero difference between total and balance — e.g. a partial payment already recorded, store credit or loyalty/bonus credit
applied via an adjustment or payment, or a resumed/edited order — will be charged the full order total on Authorize.net instead of the correct remaining balance, resulting in an overcharge.
Note that other parts of this same class already treat getBalance() as the source of truth for amount/currency in the equivalent authorize/capture path (see AcceptHosted::onReturn(), which builds the
Price from $order->getBalance()->getCurrencyCode()), so this fallback is inconsistent with the rest of the class. Sibling hosted-checkout payment gateways (commerce_cybersource's CyberSourceSahcForm,
commerce_stripe's StripePaymentElement) both use $order->getBalance() for this same purpose, confirming getBalance() is the correct convention here.
Steps to reproduce
1. Have an order where the balance differs from the total (e.g. a loyalty/bonus credit or partial payment applied to the order before checkout reaches the payment step).
2. Proceed to the Accept Hosted payment step without the checkout flow supplying an explicit amount context.
3. Observe that the amount sent to Authorize.net's hosted payment page (getPaymentPageRequestToken()) is the full order total, not the remaining balance.
Proposed resolution
In AcceptHosted::getAcceptHostedCheckoutForm(), change the fallback from $order->getTotalPrice() to $order->getBalance(), matching the convention already used elsewhere in the class and in the other
hosted-checkout gateways.
Issue fork commerce_authnet-3621524
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #4
vmarchukCommitted!