spree_core 5.6.1 → 6.0.0.beta2

data/app/models/spree/payment.rb

@@ -4,9 +4,9 @@ module Spree
   class Payment < Spree.base_class
     has_prefix_id :py  # Stripe: py_
 
-    include Spree::Core::NumberGenerator.new(prefix: 'P', letters: true, length: 7)
-    include Spree::NumberIdentifier
-    include Spree::Metafields
+    include Spree::DerivedNumber
+    derives_number infix: 'P'
+    include Spree::HasCustomFields
     include Spree::Metadata
     if defined?(Spree::Security::Payments)
       include Spree::Security::Payments
@@ -15,24 +15,31 @@ module Spree
     extend Spree::DisplayMoney
 
     include Spree::Payment::Processing
-    include Spree::Payment::Webhooks
     include Spree::Payment::CustomEvents
 
     publishes_lifecycle_events
 
     NON_RISKY_AVS_CODES = ['B', 'D', 'H', 'J', 'M', 'Q', 'T', 'V', 'X', 'Y'].freeze
     RISKY_AVS_CODES     = ['A', 'C', 'E', 'F', 'G', 'I', 'K', 'L', 'N', 'O', 'P', 'R', 'S', 'U', 'W', 'Z'].freeze
-    INVALID_STATES      = %w(failed invalid void).freeze
+    INVALID_STATUSES    = %w(failed invalid void).freeze
+    INVALID_STATES      = INVALID_STATUSES
+    deprecate_constant :INVALID_STATES
 
     with_options inverse_of: :payments do
-      belongs_to :order, class_name: 'Spree::Order', touch: true
+      belongs_to :order, class_name: 'Spree::Order', touch: true, optional: true
+      belongs_to :cart, class_name: 'Spree::Cart', optional: true
+      # A grouped checkout's payment belongs to the group: there is one charge
+      # for the whole basket, and the per-order shares are payment_splits.
+      belongs_to :order_group, class_name: 'Spree::OrderGroup', optional: true
       belongs_to :payment_method, -> { with_deleted }, class_name: 'Spree::PaymentMethod'
     end
-    belongs_to :source, polymorphic: true
+
+    has_many :payment_splits, class_name: 'Spree::PaymentSplit', dependent: :destroy, inverse_of: :payment
+    belongs_to :source, polymorphic: true, optional: true
+
+    validate :exactly_one_owner
 
     has_many :offsets, -> { offset_payment }, class_name: 'Spree::Payment', foreign_key: :source_id
-    has_many :log_entries, as: :source
-    has_many :state_changes, as: :stateful
     has_many :capture_events, class_name: 'Spree::PaymentCaptureEvent'
     has_many :refunds, inverse_of: :payment
 
@@ -47,17 +54,20 @@ module Spree
 
     before_validation :validate_source
 
-    after_initialize :set_amount, if: -> { new_record? && order.present? && !amount_changed? }
+    after_initialize :set_amount, if: -> { new_record? && owner.present? && !amount_changed? }
 
     #
     # Callbacks
-    after_save :create_payment_profile, if: :profiles_supported?
-    # update the order totals, etc.
-    after_save :update_order, unless: -> { capture_on_dispatch }
+    before_create :assign_risk_codes_from_source
     # invalidate previously entered payments
     after_create :invalidate_old_payments
     after_create :create_eligible_credit_event
-    after_destroy :update_order
+    # Every other change reaches the order through payment events, which the
+    # order status subscriber answers. Destruction cannot: Payment is not
+    # paranoid, so the row is gone by the time payment.deleted lands and its
+    # payload carries no owner — nothing can lead the subscriber back to the
+    # order, which still has to stop counting that money.
+    after_destroy :recalculate_owner_totals
 
     attr_accessor :source_attributes, :request_env, :capture_on_dispatch
     attribute :skip_source_requirement, :boolean, default: false
@@ -72,74 +82,155 @@ module Spree
     default_scope { order(:created_at) }
 
     scope :from_credit_card, -> { where(source_type: 'Spree::CreditCard') }
-    scope :with_state, ->(s) { where(state: s.to_s) }
+    # @deprecated use the status scopes / +where(status:)+ — removed in 6.1
+    scope :with_state, ->(s) { where(status: s.to_s) }
     # "offset" is reserved by activerecord
-    scope :offset_payment, -> { where("source_type = 'Spree::Payment' AND amount < 0 AND state = 'completed'") }
+    scope :offset_payment, -> { where("source_type = 'Spree::Payment' AND amount < 0 AND status = 'completed'") }
 
-    scope :checkout, -> { with_state('checkout') }
-    scope :completed, -> { with_state('completed') }
-    scope :pending, -> { with_state('pending') }
-    scope :processing, -> { with_state('processing') }
-    scope :failed, -> { with_state('failed') }
+    # checkout/processing/pending/completed/failed/void scopes and predicates
+    # come from has_status below.
+    scope :incomplete, -> { where.not(status: 'completed') }
 
-    scope :incomplete, -> { where.not(state: 'completed') }
-
-    scope :risky, -> { where("avs_response IN (?) OR (cvv_response_code IS NOT NULL and cvv_response_code != 'M') OR state = 'failed'", RISKY_AVS_CODES) }
-    scope :valid, -> { where.not(state: INVALID_STATES) }
+    scope :risky, -> { where("avs_response IN (?) OR (cvv_response_code IS NOT NULL and cvv_response_code != 'M') OR status = 'failed'", RISKY_AVS_CODES) }
+    scope :valid, -> { where.not(status: INVALID_STATUSES) }
 
     scope :store_credits, -> { where(source_type: Spree::StoreCredit.to_s) }
     scope :not_store_credits, -> { where(arel_table[:source_type].not_eq(Spree::StoreCredit.to_s).or(arel_table[:source_type].eq(nil))) }
 
     self.whitelisted_ransackable_associations = %w[payment_method order source]
-    self.whitelisted_ransackable_attributes = %w[number amount state response_code avs_response cvv_response_code cvv_response_message]
+    ransack_alias :state, :status # @deprecated filter alias — removed in 6.1
+    # `number` is deliberately absent: it is derived (its column is NULL on
+    # 6.0 rows), so a filter on it silently matches nothing. The 6.1 payment
+    # `reference` becomes the searchable identifier
+    # (docs/plans/6.0-6.1-b2b-payment-terms.md).
+    self.whitelisted_ransackable_attributes = %w[amount status state response_code avs_response cvv_response_code cvv_response_message]
 
     # transaction_id is much easier to understand
     alias_attribute :transaction_id, :response_code
 
-    delegate :currency, to: :order
+    delegate :currency, :store, to: :owner
 
     money_methods :amount, :credit_allowed
     alias money display_amount # for compatibility with older versions of Spree
 
-    # order state machine (see http://github.com/pluginaweek/state_machine/tree/master for details)
-    state_machine initial: :checkout do
-      # With card payments, happens before purchase or authorization happens
-      #
-      # Setting it after creating a profile and authorizing a full amount will
-      # prevent the payment from being authorized again once Order transitions
-      # to complete
-      event :started_processing do
-        transition from: [:checkout, :pending, :completed, :processing], to: :processing
-      end
-      # When processing during checkout fails
-      event :failure do
-        transition from: [:pending, :processing], to: :failed
-      end
-      # With card payments this represents authorizing the payment
-      event :pend do
-        transition from: [:checkout, :processing], to: :pending
-      end
-      # With card payments this represents completing a purchase or capture transaction
-      event :complete do
-        transition from: [:processing, :pending, :checkout], to: :completed
-      end
-      after_transition to: :completed, do: [:after_completed, :send_payment_completed_webhook, :publish_payment_completed_event]
-      event :void do
-        transition from: [:pending, :processing, :completed, :checkout], to: :void
+    # No state machine — transitions run inside Spree::Payments workflows and
+    # Spree::Payment::Processing (docs/plans/6.0-service-workflows.md). The
+    # `invalid` status deliberately generates no predicate or scope: `invalid?`
+    # is ActiveModel's, use +has_invalid_status?+.
+    include Spree::HasStatus
+    has_status :checkout, :processing, :pending, :completed, :failed, :void, :invalid,
+               default: :checkout
+
+    # Status writes, called from the payments workflows and Processing. The
+    # completed/voided events publish here — the one place the status changes —
+    # replacing the machine's after_transition callbacks.
+    # failed is deliberately claimable: a failure can be transient — a
+    # gateway outage, a network timeout, our own error — and the retry is
+    # simply running the workflow again on the same row. The row must be
+    # reused, not replaced: response_code is unique per order, so a session
+    # payment's intent can only ever live on one payment.
+    CLAIMABLE_STATUSES = %w[checkout pending processing failed].freeze
+
+    # Atomically claims the payment for gateway processing. Only a live or
+    # retryable payment can be claimed, so a stale instance can never
+    # resurrect a payment another writer already settled and drive the
+    # gateway again.
+    #
+    # @return [Boolean] false when the payment completed concurrently — the
+    #   caller's outcome already exists and the claim must be a no-op
+    # @raise [Spree::Core::GatewayError] for a dead payment (void, invalid)
+    def started_processing!
+      if new_record?
+        self.status = 'processing'
+        save!
+        return true
       end
-      after_transition to: :void, do: [:after_void, :send_payment_voided_webhook, :publish_payment_voided_event]
-      # when the card brand isn't supported
-      event :invalidate do
-        transition from: [:checkout], to: :invalid
+
+      claimed = self.class.where(id: id, status: CLAIMABLE_STATUSES)
+                          .update_all(status: 'processing', updated_at: Time.current) == 1
+      if claimed
+        self.status = 'processing'
+        clear_attribute_changes(['status'])
+        return true
       end
 
-      after_transition do |payment, transition|
-        payment.state_changes.create!(
-          previous_state: transition.from,
-          next_state: transition.to,
-          name: 'payment'
-        )
+      fresh_status = self.class.where(id: id).pick(:status)
+      return false if fresh_status == 'completed'
+
+      raise Spree::Core::GatewayError, "Payment #{number} is #{fresh_status} and cannot be processed"
+    end
+
+    def pend!
+      update!(status: 'pending')
+    end
+
+    def complete!
+      update!(status: 'completed')
+      publish_event('payment.completed')
+      true
+    end
+
+    # The single void writer. A compare-and-swap rather than a plain save:
+    # of two racing voids only the one whose update moves the row publishes
+    # payment.voided, so the loser is an idempotent no-op. Callers that
+    # already asked the gateway pass the authorization it returned.
+    #
+    # @param authorization [String, nil] written only when present — a
+    #   successful void without one must not null the stored reference
+    # @return [Boolean] false when the payment was already void
+    def void!(authorization: nil)
+      if new_record?
+        self.status = 'void'
+        self.response_code = authorization if authorization.present?
+        save!
+        publish_event('payment.voided')
+        return true
       end
+
+      updates = { status: 'void', updated_at: Time.current }
+      updates[:response_code] = authorization if authorization.present?
+
+      return false unless self.class.where(id: id).where.not(status: 'void').update_all(updates) == 1
+
+      assign_attributes(updates.except(:updated_at))
+      clear_attribute_changes(updates.except(:updated_at).keys)
+      publish_event('payment.voided')
+      true
+    end
+
+    def failure!
+      update!(status: 'failed')
+    end
+    alias failure failure!
+
+    def invalidate!
+      update!(status: 'invalid')
+    end
+
+    # Guards preserved from the machine's transition graph, consulted by the
+    # workflows before money moves.
+    def can_complete?
+      status.in?(%w[processing pending checkout])
+    end
+
+    def can_pend?
+      status.in?(%w[checkout processing])
+    end
+
+    def can_void?
+      status.in?(%w[pending processing completed checkout])
+    end
+
+    # @deprecated read +status+ — removed in 6.1
+    def state
+      Spree::Deprecation.warn('Spree::Payment#state is deprecated and will be removed in Spree 6.1. Use #status instead.')
+      status
+    end
+
+    # @deprecated write +status+ — removed in 6.1
+    def state=(value)
+      Spree::Deprecation.warn('Spree::Payment#state= is deprecated and will be removed in Spree 6.1. Use #status= instead.')
+      self.status = value
     end
 
     def source
@@ -150,12 +241,12 @@ module Spree
     end
 
     def max_amount
-      return amount if order.nil?
+      return amount if owner.nil?
 
-      amount_from_order = order.total - order.payment_total
+      amount_from_order = owner.total - owner.payment_total
 
       if payment_method&.store_credit?
-        store_credits = order.available_store_credits
+        store_credits = owner.available_store_credits
         store_credits.any? ? [store_credits.first.amount_remaining, amount_from_order].min : amount_from_order
       else
         amount_from_order
@@ -200,13 +291,13 @@ module Spree
                         payment_method.payment_source_class.new(source_attributes)
                       end
 
-        if source.user_id.present? && source.user_id != order.user_id
+        if source.customer_id.present? && source.customer_id != owner&.customer_id
           self.source = nil
           return
         end
 
         source.payment_method_id = payment_method.id if source.respond_to?(:payment_method_id)
-        source.user_id = order.user_id if order
+        source.customer_id = owner.customer_id if owner
       end
     end
 
@@ -247,6 +338,56 @@ module Spree
       amount - captured_amount
     end
 
+    # Row work only — moves the uncaptured remainder onto a new pending
+    # payment and shrinks this one to what was captured. The caller authorizes
+    # the returned remainder at the gateway afterwards, outside any lock.
+    #
+    # @return [Spree::Payment, nil] the remainder payment, or nil when fully captured
+    def split_uncaptured_amount
+      return if uncaptured_amount <= 0
+
+      remainder = owner.payments.create!(
+        amount: uncaptured_amount,
+        payment_method: payment_method,
+        source: source,
+        status: 'pending',
+        capture_on_dispatch: true
+      )
+      carry_splits_to(remainder)
+      # Bang: a silent failure here would leave this payment at its full amount
+      # beside a remainder that also exists, so the group would hold more money
+      # than the customer was ever charged.
+      update!(amount: captured_amount)
+      remainder
+    end
+
+    # Hands each order's still-uncaptured share over to the remainder payment.
+    #
+    # A shared payment covers several orders, so capturing one seller's share
+    # shrinks a payment the others are still relying on. Their shares have to
+    # move to the remainder with the money, or the sellers who have not shipped
+    # would be left pointing at an authorization that no longer holds their
+    # amount — unable to capture, and reading as unpaid forever.
+    def carry_splits_to(remainder)
+      return unless grouped?
+
+      payment_splits.each do |split|
+        # What is genuinely still to draw — money a parcel has reserved is
+        # mid-charge against *this* payment, so carrying it to the remainder
+        # would hand that order its share a second time.
+        outstanding = split.undrawn_amount
+        next if outstanding <= 0
+
+        Spree::PaymentSplit.create!(
+          payment: remainder,
+          order_id: split.order_id,
+          currency: split.currency,
+          authorized_amount: outstanding
+        )
+        split.update!(authorized_amount: split.authorized_amount - outstanding)
+      end
+    end
+
     def editable?
       checkout? || pending?
     end
@@ -265,51 +406,111 @@ module Spree
     end
 
     def add_gateway_processing_error(error_message)
-      if has_metafield?('gateway.processing_errors')
-        errors = JSON.parse(get_metafield('gateway.processing_errors').value)
+      if has_custom_field?('gateway.processing_errors')
+        errors = JSON.parse(get_custom_field('gateway.processing_errors').value)
         errors << { message: error_message }
 
-        set_metafield('gateway.processing_errors', errors.to_json)
+        set_custom_field('gateway.processing_errors', errors.to_json)
       else
-        set_metafield('gateway.processing_errors', [{ message: error_message }].to_json)
+        set_custom_field('gateway.processing_errors', [{ message: error_message }].to_json)
       end
     end
 
     def gateway_processing_error_messages
       @gateway_processing_error_messages ||= begin
-        errors = JSON.parse(get_metafield('gateway.processing_errors')&.value || '[]')
+        errors = JSON.parse(get_custom_field('gateway.processing_errors')&.value || '[]')
         errors.map { |error| error['message'] }
       rescue JSON::ParserError
         []
       end
     end
 
+    def has_invalid_status?
+      INVALID_STATUSES.include?(status)
+    end
+
+    # @deprecated use {#has_invalid_status?} — removed in 6.1
     def has_invalid_state?
-      INVALID_STATES.include?(state)
+      Spree::Deprecation.warn('Spree::Payment#has_invalid_state? is deprecated and will be removed in Spree 6.1. Use #has_invalid_status? instead.')
+      has_invalid_status?
     end
 
-    private
+    # What this payment was made against — a cart mid-checkout, a single order,
+    # or the group a split checkout produced. Everything reading totals,
+    # currency or gateway options goes through here rather than through #order,
+    # which is nil on a grouped payment.
+    #
+    # @return [Spree::Cart, Spree::Order, Spree::OrderGroup, nil]
+    def owner
+      order || cart || order_group
+    end
 
-    def set_amount
-      self.amount = order.total - order.payment_total
+    # @return [Boolean] whether this payment covers several orders placed in one
+    #   checkout, in which case its per-order shares are {#payment_splits}
+    def grouped?
+      order_group_id.present?
     end
 
-    def amount_must_be_less_than_or_equal_to_max_amount
-      errors.add(:amount, :greater_than_max_amount, max_amount: max_amount) if amount > max_amount
+    # Bridge for legacy callers assigning +current_order+ (now a Spree::Cart)
+    # to the order association — routes carts to the cart FK instead.
+    def order=(record)
+      if record.is_a?(Spree::Cart)
+        self.cart = record
+        super(nil)
+      else
+        super
+      end
     end
 
-    def after_void
+    def profiles_supported?
+      payment_method.respond_to?(:payment_profiles_supported?) && payment_method.payment_profiles_supported?
     end
 
-    def after_completed
+    # Stores the payment source at the gateway for later off-session use.
+    # Gateway I/O — creation flows that take raw card data call this
+    # explicitly after the payment commits, on the same in-memory instance
+    # (the card number never persists, and some gateways need it). Session
+    # gateways store profile ids during source creation and never call this.
+    def create_payment_profile
+      # Don't attempt to create on bad payments.
+      return if has_invalid_status?
+      # Payment profile cannot be created without source
+      return unless source
+      # Imported payments shouldn't create a payment profile.
+      # Imported is only available on Spree::CreditCard, non-credit card payments should not have this attribute.
+      return if source.respond_to?(:imported) && source.imported
+
+      payment_method.create_profile(self)
+    rescue Spree::PaymentConnectionError => e
+      gateway_error e
     end
 
-    def publish_payment_completed_event
-      publish_event('payment.completed')
+    private
+
+    # Session-created payments never pass through the gateway response path
+    # that normally sets these codes, so the gateway gets asked at creation.
+    # Codes already assigned (the response path runs before save) win.
+    def assign_risk_codes_from_source
+      return if source.blank?
+      return if avs_response.present? && cvv_response_code.present?
+
+      codes = payment_method&.risk_codes_for(source)
+      return if codes.blank?
+
+      self.avs_response ||= codes[:avs_response]
+      self.cvv_response_code ||= codes[:cvv_response_code]
     end
 
-    def publish_payment_voided_event
-      publish_event('payment.voided')
+    def exactly_one_owner
+      errors.add(:base, :exactly_one_of_cart_or_order, message: Spree.t('errors.messages.exactly_one_of_cart_or_order')) unless [order, cart, order_group].compact.one?
+    end
+
+    def set_amount
+      self.amount = owner.total - owner.payment_total
+    end
+
+    def amount_must_be_less_than_or_equal_to_max_amount
+      errors.add(:amount, :greater_than_max_amount, max_amount: max_amount) if amount > max_amount
     end
 
     def validate_source
@@ -325,9 +526,9 @@ module Spree
 
     def payment_method_available_for_order
       return if payment_method.blank?
-      return if order.blank?
+      return if owner.blank?
 
-      errors.add(:payment_method, :invalid) if !payment_method.available_for_order?(order) || !payment_method.available_for_store?(order.store)
+      errors.add(:payment_method, :invalid) if !payment_method.available_for_order?(owner) || !payment_method.available_for_store?(owner.store)
     end
 
     def add_source_error(field, message)
@@ -335,47 +536,22 @@ module Spree
       errors.add(Spree.t(source.class.to_s.demodulize.underscore), "#{field_name} #{message}")
     end
 
-    def profiles_supported?
-      payment_method.respond_to?(:payment_profiles_supported?) && payment_method.payment_profiles_supported?
-    end
 
-    def create_payment_profile
-      # Don't attempt to create on bad payments.
-      return if has_invalid_state?
-      # Payment profile cannot be created without source
-      return unless source
-      # Imported payments shouldn't create a payment profile.
-      # Imported is only available on Spree::CreditCard, non-credit card payments should not have this attribute.
-      return if source.respond_to?(:imported) && source.imported
 
-      payment_method.create_profile(self)
-    rescue Spree::PaymentConnectionError => e
-      gateway_error e
-    end
 
-    def split_uncaptured_amount
-      if uncaptured_amount > 0
-        order.payments.create!(
-          amount: uncaptured_amount,
-          payment_method: payment_method,
-          source: source,
-          state: 'pending',
-          capture_on_dispatch: true
-        ).authorize!
-        update(amount: captured_amount)
-      end
+    def recalculate_owner_totals
+      return if owner.blank?
+
+      owner.refresh_payment_total!
+      owner.update_statuses! if owner.is_a?(Spree::Order) && owner.completed?
     end
 
+    # @deprecated The order recomputes itself from payment events —
+    #   Spree::Orders::UpdateStatuses writes statuses, the totals workflow
+    #   writes payment_total. Removed in 7.0.
     def update_order
-      order.updater.update_payment_total if completed? || void?
-
-      if order.completed?
-        order.updater.update_payment_state
-        order.updater.update_shipments
-        order.updater.update_shipment_state
-      end
-
-      order.persist_totals if completed? || order.completed?
+      Spree::Deprecation.warn('Spree::Payment#update_order is deprecated and will be removed in Spree 7.0. The order recomputes from payment events; call owner.recalculate_totals! to force it.')
+      owner&.recalculate_totals!
     end
 
     def create_eligible_credit_event
@@ -394,9 +570,9 @@ module Spree
 
     def invalidate_old_payments
       # invalid payment or store_credit payment shouldn't invalidate other payment types
-      return if has_invalid_state? || store_credit?
+      return if has_invalid_status? || store_credit?
 
-      order.payments.with_state('checkout').where.not(id: id).each do |payment|
+      owner.payments.with_state('checkout').where.not(id: id).each do |payment|
         payment.invalidate! unless payment.store_credit?
       end
     end

data/app/models/spree/payment_method/check.rb

@@ -14,19 +14,20 @@ module Spree
 
     # Indicates whether its possible to capture the payment
     def can_capture?(payment)
-      ['checkout', 'pending'].include?(payment.state)
+      ['checkout', 'pending'].include?(payment.status)
     end
 
     # Indicates whether its possible to void the payment.
     def can_void?(payment)
-      payment.state != 'void'
+      payment.status != 'void'
     end
 
     def capture(*)
       simulated_successful_billing_response
     end
 
-    def cancel(*)
+    # Voids outright, so there is no captured charge for `refund:` to govern.
+    def cancel(*, **)
       simulated_successful_billing_response
     end
 

data/app/models/spree/payment_method/session_instrumentation.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Spree
+  class PaymentMethod
+    # Wraps the provider-implemented payment-session methods in the
+    # 'gateway.spree_payments' notification so every caller — controllers,
+    # workflows, extensions — gets the gateway span, not just known call
+    # sites. Prepended to every subclass from PaymentMethod.inherited:
+    # prepending only the base class would sit below a subclass override in
+    # the ancestor chain and never run. If an implementation calls super into
+    # another prepended copy, the nested (duplicate) span is accepted rather
+    # than guarded against — the base implementations raise NotImplementedError,
+    # so that chain does not occur in practice.
+    module SessionInstrumentation
+      SESSION_METHODS = %i[
+        create_payment_session
+        update_payment_session
+        complete_payment_session
+        create_payment_setup_session
+        complete_payment_setup_session
+      ].freeze
+
+      SESSION_METHODS.each do |session_method|
+        define_method(session_method) do |*args, **kwargs, &block|
+          ActiveSupport::Notifications.instrument(
+            'gateway.spree_payments', action: session_method.to_s, payment_method_type: type
+          ) do
+            super(*args, **kwargs, &block)
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/spree/payment_method/store_credit.rb

@@ -13,7 +13,7 @@ module Spree
     end
 
     def can_capture?(payment)
-      ['checkout', 'pending'].include?(payment.state)
+      ['checkout', 'pending'].include?(payment.status)
     end
 
     def can_void?(payment)
@@ -82,7 +82,9 @@ module Spree
       handle_action(action, :credit, auth_code)
     end
 
-    def cancel(auth_code, _payment = nil)
+    # Credit goes back to the customer's balance rather than a card, so this
+    # is a release rather than a refund and `refund:` does not apply.
+    def cancel(auth_code, _payment = nil, refund: true)
       store_credit_event = StoreCreditEvent.find_by(authorization_code: auth_code,
                                                     action: Spree::StoreCredit::CAPTURE_ACTION)
       store_credit = store_credit_event.try(:store_credit)