From bbb386bb5ab25c19c302a545f261eca588b0b828 Mon Sep 17 00:00:00 2001
From: Patrick McLain <pat@pmclain.com>
Date: Fri, 14 Dec 2018 02:07:47 -0500
Subject: [PATCH] Prevent display of token when save for later is not selected

This sets the token `isVisible` value to faluse if
`VaultConfigProvider::IS_ACTIVE_CODE` is not set in the payment's
`additionalInformation` property. The value is not set when placing orders
through the admin panel, unless the save for later checkbox is selected. This
caused all admin order payment to be visible in the stored payment method
section in the storefront.

Fixes magento/magento2#19515

Testing on 2.3 depends on magento/magento2#19764
---
 .../Observer/AfterPaymentSaveObserver.php     |  8 ++---
 .../Observer/AfterPaymentSaveObserverTest.php | 31 ++++++++++++++++---
 2 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/app/code/Magento/Vault/Observer/AfterPaymentSaveObserver.php b/app/code/Magento/Vault/Observer/AfterPaymentSaveObserver.php
index 49d34091b136a..00aee961d8d3f 100644
--- a/app/code/Magento/Vault/Observer/AfterPaymentSaveObserver.php
+++ b/app/code/Magento/Vault/Observer/AfterPaymentSaveObserver.php
@@ -77,11 +77,9 @@ public function execute(Observer $observer)
         $paymentToken->setPaymentMethodCode($payment->getMethod());
 
         $additionalInformation = $payment->getAdditionalInformation();
-        if (isset($additionalInformation[VaultConfigProvider::IS_ACTIVE_CODE])) {
-            $paymentToken->setIsVisible(
-                (bool) (int) $additionalInformation[VaultConfigProvider::IS_ACTIVE_CODE]
-            );
-        }
+        $paymentToken->setIsVisible(
+            (bool) (int) ($additionalInformation[VaultConfigProvider::IS_ACTIVE_CODE] ?? 0)
+        );
 
         $paymentToken->setPublicHash($this->generatePublicHash($paymentToken));
 
diff --git a/app/code/Magento/Vault/Test/Unit/Observer/AfterPaymentSaveObserverTest.php b/app/code/Magento/Vault/Test/Unit/Observer/AfterPaymentSaveObserverTest.php
index 09c17d1e58d98..a6b8502f66a1b 100644
--- a/app/code/Magento/Vault/Test/Unit/Observer/AfterPaymentSaveObserverTest.php
+++ b/app/code/Magento/Vault/Test/Unit/Observer/AfterPaymentSaveObserverTest.php
@@ -15,6 +15,7 @@
 use Magento\Sales\Model\Order\Payment;
 use Magento\Vault\Model\PaymentToken;
 use Magento\Vault\Model\PaymentTokenManagement;
+use Magento\Vault\Model\Ui\VaultConfigProvider;
 use Magento\Vault\Observer\AfterPaymentSaveObserver;
 use PHPUnit_Framework_MockObject_MockObject as MockObject;
 
@@ -93,7 +94,7 @@ protected function setUp()
 
         // Sales Order Payment Model
         $this->salesOrderPaymentMock = $this->getMockBuilder(Payment::class)
-            ->setMethods(null)
+            ->setMethods(['getAdditionalInformation'])
             ->disableOriginalConstructor()
             ->getMock();
         $this->salesOrderPaymentMock->setOrder($this->salesOrderMock);
@@ -122,9 +123,10 @@ protected function setUp()
      * @param string $token
      * @param bool $isActive
      * @param string $method
+     * @param array $additionalInformation
      * @dataProvider positiveCaseDataProvider
      */
-    public function testPositiveCase($customerId, $createdAt, $token, $isActive, $method)
+    public function testPositiveCase($customerId, $createdAt, $token, $isActive, $method, $additionalInformation)
     {
         $this->paymentTokenMock->setGatewayToken($token);
         $this->paymentTokenMock->setCustomerId($customerId);
@@ -136,6 +138,8 @@ public function testPositiveCase($customerId, $createdAt, $token, $isActive, $me
             ->method('getVaultPaymentToken')
             ->willReturn($this->paymentTokenMock);
 
+        $this->salesOrderPaymentMock->method('getAdditionalInformation')->willReturn($additionalInformation);
+
         if (!empty($token)) {
             $this->paymentTokenManagementMock->expects($this->once())
                 ->method('saveTokenWithPaymentLink')
@@ -158,6 +162,7 @@ public function testPositiveCase($customerId, $createdAt, $token, $isActive, $me
         static::assertEquals($token, $paymentToken->getGatewayToken());
         static::assertEquals($isActive, $paymentToken->getIsActive());
         static::assertEquals($createdAt, $paymentToken->getCreatedAt());
+        static::assertEquals($additionalInformation[VaultConfigProvider::IS_ACTIVE_CODE] ?? false, $paymentToken->getIsVisible());
     }
 
     /**
@@ -171,14 +176,32 @@ public function positiveCaseDataProvider()
                 '10\20\2015',
                 'asdfg',
                 true,
-                'paypal'
+                'paypal',
+                [],
+            ],
+            [
+                1,
+                '10\20\2015',
+                'asdfg',
+                true,
+                'paypal',
+                [VaultConfigProvider::IS_ACTIVE_CODE => true],
+            ],
+            [
+                1,
+                '10\20\2015',
+                'asdfg',
+                true,
+                'paypal',
+                [VaultConfigProvider::IS_ACTIVE_CODE => false],
             ],
             [
                 null,
                 null,
                 null,
                 false,
-                null
+                null,
+                [],
             ],
         ];
     }