@open-mercato/core 0.9.0 → 0.9.1-develop.7459.1.99e3accd30

package/src/modules/customers/migrations/Migration20260930110235_customers.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260930110235_customers extends Migration {
+
+  override name = 'Migration20260930110235_customers';
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "customer_interactions" add "timezone" text null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "customer_interactions" drop column "timezone";`);
+  }
+
+}

package/src/modules/dictionaries/components/DictionaryTable.tsx

@@ -143,62 +143,69 @@ export function DictionaryTable({
     : undefined
 
   return (
-    <DataTable<DictionaryTableEntry>
-      title={translations.title}
-      titleHeadingLevel={2}
-      actions={actions}
-      columns={columns}
-      data={paginated}
-      embedded
-      sortable
-      sorting={sorting}
-      onSortingChange={setSorting}
-      searchValue={search}
-      onSearchChange={(value) => {
-        setSearch(value)
-        setPage(1)
-      }}
-      searchPlaceholder={translations.searchPlaceholder}
-      isLoading={loading}
-      emptyState={<p className="py-10 text-center text-sm text-muted-foreground">{translations.emptyLabel}</p>}
-      pagination={{
-        page,
-        pageSize,
-        total: filtered.length,
-        totalPages,
-        onPageChange: setPage,
-      }}
-      refreshButton={onRefresh ? {
-        label: translations.refreshLabel,
-        onRefresh,
-        isRefreshing: loading,
-      } : undefined}
-      onRowClick={handleRowClick}
-      rowActions={
-        canManage
-          ? (entry) => {
-              if (!entry) return null
-              if (entry.isInherited) return null
-              const items: RowActionItem[] = []
-              if (onEdit) {
-                items.push({
-                  id: 'edit',
-                  label: translations.editLabel,
-                  onSelect: () => onEdit(entry),
-                })
+    <div
+      role="region"
+      aria-label={translations.title}
+      tabIndex={0}
+      className="w-full min-w-0 max-w-full overflow-x-auto focus-visible:outline-none focus-visible:shadow-focus"
+    >
+      <DataTable<DictionaryTableEntry>
+        title={translations.title}
+        titleHeadingLevel={2}
+        actions={actions}
+        columns={columns}
+        data={paginated}
+        embedded
+        sortable
+        sorting={sorting}
+        onSortingChange={setSorting}
+        searchValue={search}
+        onSearchChange={(value) => {
+          setSearch(value)
+          setPage(1)
+        }}
+        searchPlaceholder={translations.searchPlaceholder}
+        isLoading={loading}
+        emptyState={<p className="py-10 text-center text-sm text-muted-foreground">{translations.emptyLabel}</p>}
+        pagination={{
+          page,
+          pageSize,
+          total: filtered.length,
+          totalPages,
+          onPageChange: setPage,
+        }}
+        refreshButton={onRefresh ? {
+          label: translations.refreshLabel,
+          onRefresh,
+          isRefreshing: loading,
+        } : undefined}
+        onRowClick={handleRowClick}
+        rowActions={
+          canManage
+            ? (entry) => {
+                if (!entry) return null
+                if (entry.isInherited) return null
+                const items: RowActionItem[] = []
+                if (onEdit) {
+                  items.push({
+                    id: 'edit',
+                    label: translations.editLabel,
+                    onSelect: () => onEdit(entry),
+                  })
+                }
+                if (onDelete) {
+                  items.push({
+                    id: 'delete',
+                    label: translations.deleteLabel,
+                    onSelect: () => onDelete(entry),
+                    destructive: true,
+                  })
+                }
+                return items.length ? <RowActions items={items} /> : null
               }
-              if (onDelete) {
-                items.push({
-                  id: 'delete',
-                  label: translations.deleteLabel,
-                  onSelect: () => onDelete(entry),
-                  destructive: true,
-                })
-              }
-              return items.length ? <RowActions items={items} /> : null
-            }
-          : undefined
-      }
-    />
+            : undefined
+        }
+      />
+    </div>
   )
 }

package/src/modules/messages/subscribers/message-notification.ts

@@ -10,6 +10,7 @@ import {
 import { User } from '../../auth/data/entities'
 import { Message } from '../data/entities'
 import { notificationTypes } from '../notifications'
+import { resolveMessageChannelThreadAccess } from '../lib/channelThreadAccess'
 import {
   EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
   SEND_AS_USER_SOURCE_ENTITY_TYPE,
@@ -135,10 +136,19 @@ async function isChannelRoutedMessage(payload: MessageSentPayload, ctx: Resolver
       },
     )
     if (!message) return false
-    return (
-      message.sourceEntityType === SEND_AS_USER_SOURCE_ENTITY_TYPE ||
-      message.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE
+    if (message.sourceEntityType === SEND_AS_USER_SOURCE_ENTITY_TYPE) return true
+    if (message.sourceEntityType !== EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE) return false
+
+    const channelThreadAccess = await resolveMessageChannelThreadAccess(
+      ctx,
+      {
+        tenantId: payload.tenantId,
+        organizationId: payload.organizationId ?? null,
+      },
+      { messageThreadId: message.threadId },
+      { userId: null, features: [] },
     )
+    return channelThreadAccess !== null
   } catch {
     return false
   }

package/src/modules/payment_gateways/api/webhook/[provider]/route.ts

@@ -1,11 +1,18 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'
 import type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { getWebhookHandler } from '@open-mercato/shared/modules/payment_gateways/types'
+import {
+  getWebhookHandler,
+  WebhookVerificationUnavailableError,
+  type WebhookHandlerRegistration,
+  type WebhookHttpResponse,
+  type WebhookResponseOutcome,
+} from '@open-mercato/shared/modules/payment_gateways/types'
 import { markQueueJobOrigin } from '@open-mercato/shared/lib/queue/dispatchOrigin'
 import type { IntegrationLogService } from '../../../../integrations/lib/log-service'
 import type { PaymentGatewayService } from '../../../lib/gateway-service'
@@ -15,7 +22,8 @@ import { getPaymentGatewayQueue } from '../../../lib/queue'
 import { processPaymentGatewayWebhookJob } from '../../../lib/webhook-processor'
 import { paymentGatewaysTag } from '../../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'
+import { readBoundedRequestBody, readBoundedRequestBytes, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 
 const logger = createLogger('payment_gateways').child({ component: 'webhook' })
 
@@ -25,6 +33,13 @@ export const metadata = {
 }
 
 const WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'
+const WEBHOOK_PAYLOAD_TOO_LARGE = 'Webhook payload too large'
+const INTERNAL_SERVER_ERROR = 'Internal server error'
+const DEFAULT_TEXT_CONTENT_TYPE = 'text/plain; charset=utf-8'
+const CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/
+const JSON_CONTENT_TYPE = /^application\/([\w.+-]+\+)?json(\s*;|$)/
+
+const paymentIdHintSchema = z.guid()
 
 const paymentGatewayWebhookRateLimitConfig = {
   points: 60,
@@ -32,6 +47,8 @@ const paymentGatewayWebhookRateLimitConfig = {
   keyPrefix: 'payment_gateways:webhook',
 }
 
+type RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>
+
 export async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {
   const resolvedParams = await params
   const providerKey = resolvedParams.provider
@@ -42,17 +59,39 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
   }
 
   const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)
-  if (rateLimitResponse) return rateLimitResponse
+  const outcome: WebhookResponseOutcome = rateLimitResponse
+    ? 'rate_limited'
+    : await receiveWebhook(req, providerKey, registration, container)
+  const response = respond(registration, outcome, rateLimitResponse)
+  const logFields = { providerKey, outcome, status: response.status }
+  if (outcome === 'accepted') logger.info('Webhook handled', logFields)
+  else logger.warn('Webhook handled', logFields)
+  return response
+}
 
-  let rawBody: string
+async function receiveWebhook(
+  req: Request,
+  providerKey: string,
+  registration: WebhookHandlerRegistration,
+  container: RequestContainer,
+): Promise<WebhookResponseOutcome> {
+  let rawBody: string | Buffer
+  let bodyText: string
   try {
-    rawBody = registration.maxBodyBytes === undefined
-      ? await req.text()
-      : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })
-  } catch (error) {
-    if (error instanceof WebhookBodyTooLargeError) {
-      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })
+    if (registration.rawBody === 'bytes') {
+      const bytes = registration.maxBodyBytes === undefined
+        ? new Uint8Array(await req.arrayBuffer())
+        : await readBoundedRequestBytes(req, { maxBytes: registration.maxBodyBytes })
+      rawBody = Buffer.from(bytes)
+      bodyText = new TextDecoder().decode(rawBody)
+    } else {
+      bodyText = registration.maxBodyBytes === undefined
+        ? await req.text()
+        : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })
+      rawBody = bodyText
     }
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) return 'payload_too_large'
     throw error
   }
   const headers: Record<string, string> = {}
@@ -64,81 +103,218 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
   const em = container.resolve('em') as EntityManager
   const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService
   const queue = getPaymentGatewayQueue(registration.queue ?? 'payment-gateways-webhook')
-  const payload = await readJsonSafe<Record<string, unknown>>(rawBody)
-  const sessionIdHint = registration.readSessionIdHint?.(payload) ?? null
+  const payload = await readJsonSafe<Record<string, unknown>>(bodyText)
+  const locatorContext = { rawBody, headers }
+  let sessionIdHint: string | null
+  let paymentIdHint: string | null
+  try {
+    sessionIdHint = normalizeSessionIdHint(registration.readSessionIdHint?.(payload, locatorContext))
+    paymentIdHint = normalizePaymentIdHint(registration.readPaymentIdHint?.(payload, locatorContext))
+  } catch (error: unknown) {
+    reportWebhookError(error, 'payment_gateways.webhook_locator_failed')
+    return 'no_candidate'
+  }
 
   try {
     // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a
     // GatewayTransaction whose per-tenant credentials successfully verify the inbound
     // signature — NEVER from attacker-controlled payload metadata. If no candidate
-    // transaction can be located by the provider-reported session id, or no candidate's
-    // credentials can verify the signature, we fail closed with 401. This prevents
-    // forged webhooks (e.g. mock gateway PoC) from mutating another tenant's payment
-    // state via `event.data.metadata.{organizationId,tenantId}`.
-    const candidates = sessionIdHint
-      ? await findWithDecryption(
-        em,
-        GatewayTransaction,
-        {
-          providerKey,
-          providerSessionId: sessionIdHint,
-          deletedAt: null,
-        },
-        { limit: 10, orderBy: { createdAt: 'desc' } },
-      )
-      : []
+    // transaction can be located by the provider-reported session or payment id, or no
+    // candidate's credentials can verify the signature, we fail closed. This
+    // prevents forged webhooks (e.g. mock gateway PoC) from mutating another tenant's
+    // payment state via `event.data.metadata.{organizationId,tenantId}`. When more than one
+    // candidate verifies, the scope is ambiguous and we also fail closed.
+    let candidates: GatewayTransaction[]
+    try {
+      candidates = sessionIdHint || paymentIdHint
+        ? await findWithDecryption(
+          em,
+          GatewayTransaction,
+          {
+            providerKey,
+            ...(sessionIdHint ? { providerSessionId: sessionIdHint } : {}),
+            ...(paymentIdHint ? { paymentId: paymentIdHint } : {}),
+            deletedAt: null,
+          },
+          { limit: 10, orderBy: { createdAt: 'desc' } },
+        )
+        : []
+    } catch (error: unknown) {
+      reportWebhookError(error, 'payment_gateways.webhook_lookup_failed')
+      return 'processing_failed'
+    }
 
-    let transaction: GatewayTransaction | null = null
-    let matchedScope: { organizationId: string; tenantId: string } | null = null
-    let event: Awaited<ReturnType<typeof registration.handler>> | null = null
-    let lastVerificationError: unknown = null
+    if (candidates.length === 0) return 'no_candidate'
+
+    const verifiedMatches: Array<{
+      transaction: GatewayTransaction
+      scope: { organizationId: string; tenantId: string }
+      event: Awaited<ReturnType<typeof registration.handler>>
+    }> = []
+    let verificationUnavailable = false
 
     for (const candidate of candidates) {
       const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }
-      const credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {}
+      let credentials: Record<string, unknown>
+      try {
+        credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {}
+      } catch (error: unknown) {
+        reportWebhookError(error, 'payment_gateways.webhook_credentials_failed')
+        verificationUnavailable = true
+        continue
+      }
       try {
-        event = await registration.handler({ rawBody, headers, credentials })
-        transaction = candidate
-        matchedScope = candidateScope
-        break
+        const candidateEvent = await registration.handler({
+          rawBody,
+          headers,
+          credentials,
+          candidate: {
+            transactionId: candidate.id,
+            paymentId: candidate.paymentId,
+            providerSessionId: candidate.providerSessionId ?? null,
+            amount: candidate.amount,
+            currencyCode: candidate.currencyCode,
+          },
+        })
+        verifiedMatches.push({ transaction: candidate, scope: candidateScope, event: candidateEvent })
       } catch (error: unknown) {
-        lastVerificationError = error
+        if (error instanceof WebhookVerificationUnavailableError) verificationUnavailable = true
       }
     }
 
-    if (!event || !transaction || !matchedScope) {
-      throw lastVerificationError ?? new Error('Webhook verification failed: no matching transaction')
+    if (verifiedMatches.length > 1) {
+      logger.error('Webhook matched multiple verified candidates', {
+        providerKey,
+        candidateCount: verifiedMatches.length,
+      })
+      getTelemetryRuntime()?.reportError(
+        new Error('[internal] Webhook matched multiple verified candidates'),
+        { module: 'payment_gateways', code: 'payment_gateways.webhook_ambiguous_candidates' },
+      )
+      return 'verification_failed'
+    }
+
+    if (verificationUnavailable && verifiedMatches.length === 1) {
+      logger.warn('Webhook candidate left unverified; ambiguity cannot be ruled out', {
+        providerKey,
+        candidateCount: candidates.length,
+      })
+      return 'verification_unavailable'
     }
 
-    const scope = matchedScope
+    const [match] = verifiedMatches
+    if (!match) return verificationUnavailable ? 'verification_unavailable' : 'verification_failed'
 
     const jobPayload = markQueueJobOrigin({
       providerKey,
-      event,
-      transactionId: transaction.id,
-      scope,
+      event: match.event,
+      transactionId: match.transaction.id,
+      scope: match.scope,
     }, 'inbound-webhook')
 
-    if (process.env.QUEUE_STRATEGY === 'async') {
-      await queue.enqueue(jobPayload)
-    } else {
-      await processPaymentGatewayWebhookJob(
-        {
-          em: container.resolve('em') as EntityManager,
-          paymentGatewayService: service,
-          integrationLogService: container.resolve('integrationLogService') as IntegrationLogService,
-        },
-        jobPayload,
-      )
+    try {
+      if (process.env.QUEUE_STRATEGY === 'async') {
+        await queue.enqueue(jobPayload)
+      } else {
+        await processPaymentGatewayWebhookJob(
+          {
+            em: container.resolve('em') as EntityManager,
+            paymentGatewayService: service,
+            integrationLogService: container.resolve('integrationLogService') as IntegrationLogService,
+          },
+          jobPayload,
+        )
+      }
+    } catch (error: unknown) {
+      getTelemetryRuntime()?.reportError(error, {
+        module: 'payment_gateways',
+        code: 'payment_gateways.webhook_processing_failed',
+      })
+      return 'processing_failed'
     }
 
-    return NextResponse.json({ received: true, queued: true }, { status: 202 })
-  } catch (err: unknown) {
-    logger.warn('Webhook verification failed', { providerKey, err })
-    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })
+    return 'accepted'
+  } catch (error: unknown) {
+    reportWebhookError(error, 'payment_gateways.webhook_unexpected_failure')
+    return 'verification_failed'
   }
 }
 
+function respond(
+  registration: WebhookHandlerRegistration,
+  outcome: WebhookResponseOutcome,
+  rateLimitResponse: NextResponse | null,
+): NextResponse {
+  if (!registration.formatResponse) return legacyResponse(outcome, rateLimitResponse)
+  try {
+    const response = toValidatedResponse(registration.formatResponse(outcome))
+    if (outcome === 'rate_limited' && rateLimitResponse) {
+      rateLimitResponse.headers.forEach((value, key) => {
+        if (key !== 'content-type' && key !== 'content-length') response.headers.set(key, value)
+      })
+    }
+    return response
+  } catch (error: unknown) {
+    getTelemetryRuntime()?.reportError(error, {
+      module: 'payment_gateways',
+      code: 'payment_gateways.webhook_formatter_invalid',
+    })
+    return NextResponse.json({ error: INTERNAL_SERVER_ERROR }, { status: 500 })
+  }
+}
+
+function legacyResponse(outcome: WebhookResponseOutcome, rateLimitResponse: NextResponse | null): NextResponse {
+  if (outcome === 'rate_limited' && rateLimitResponse) return rateLimitResponse
+  if (outcome === 'accepted') return NextResponse.json({ received: true, queued: true }, { status: 202 })
+  if (outcome === 'payload_too_large') return NextResponse.json({ error: WEBHOOK_PAYLOAD_TOO_LARGE }, { status: 413 })
+  return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })
+}
+
+function toValidatedResponse(formatted: WebhookHttpResponse): NextResponse {
+  const { status, body, contentType } = formatted
+  if (!Number.isInteger(status) || status < 200 || status > 599) {
+    throw new Error('[internal] Webhook formatter returned an invalid status')
+  }
+  if (contentType !== undefined && (typeof contentType !== 'string' || CONTROL_CHARACTERS.test(contentType))) {
+    throw new Error('[internal] Webhook formatter returned an invalid content type')
+  }
+  const normalizedContentType = contentType?.toLowerCase()
+  if (typeof body === 'string') {
+    if (normalizedContentType !== undefined && !normalizedContentType.startsWith('text/')) {
+      throw new Error('[internal] Webhook formatter returned a non-text content type for a text body')
+    }
+    return new NextResponse(body, { status, headers: { 'content-type': contentType ?? DEFAULT_TEXT_CONTENT_TYPE } })
+  }
+  if (!isPlainObject(body)) {
+    throw new Error('[internal] Webhook formatter returned an invalid body')
+  }
+  if (normalizedContentType !== undefined && !JSON_CONTENT_TYPE.test(normalizedContentType)) {
+    throw new Error('[internal] Webhook formatter returned a non-JSON content type for an object body')
+  }
+  const response = NextResponse.json(body, { status })
+  if (contentType !== undefined) response.headers.set('content-type', contentType)
+  return response
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === Object.prototype || prototype === null
+}
+
+function reportWebhookError(error: unknown, code: string): void {
+  getTelemetryRuntime()?.reportError(error, { module: 'payment_gateways', code })
+}
+
+function normalizeSessionIdHint(value: unknown): string | null {
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+function normalizePaymentIdHint(value: unknown): string | null {
+  const parsed = paymentIdHintSchema.safeParse(value)
+  return parsed.success ? parsed.data : null
+}
+
 async function checkProviderWebhookRateLimit(
   container: { resolve: (name: string) => unknown },
   req: Request,
@@ -171,10 +347,15 @@ export const openApi = {
       summary: 'Process inbound webhook from payment provider',
       tags: [paymentGatewaysTag],
       responses: [
-        { status: 202, description: 'Webhook accepted for async processing' },
-        { status: 401, description: 'Signature verification failed' },
-        { status: 413, description: 'Webhook payload too large' },
+        { status: 200, description: 'Webhook accepted (provider-defined acknowledgement may apply)' },
+        { status: 202, description: 'Webhook accepted for processing (default acknowledgement)' },
+        { status: 400, description: 'Webhook rejected (provider-defined response may apply)' },
+        { status: 401, description: 'Webhook could not be verified or processed (default failure response)' },
         { status: 404, description: 'Unknown provider' },
+        { status: 413, description: 'Webhook payload too large' },
+        { status: 429, description: 'Too many webhook requests' },
+        { status: 500, description: 'Internal server error (provider-defined response may apply)' },
+        { status: 503, description: 'Webhook temporarily unavailable (provider-defined response may apply)' },
       ],
     },
   },

package/src/modules/payment_gateways/lib/gateway-service.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto'
+import { QueryOrder } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -184,6 +185,14 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
     }, scope)
   }
 
+  async function stampLastPolledAt(transaction: GatewayTransaction, polledAt: Date): Promise<void> {
+    await em.nativeUpdate(
+      GatewayTransaction,
+      { id: transaction.id, organizationId: transaction.organizationId, tenantId: transaction.tenantId },
+      { lastPolledAt: polledAt },
+    )
+  }
+
   async function resolveAdapterAndCredentials(providerKey: string, scope: { organizationId: string; tenantId: string }) {
     const integrationId = `gateway_${providerKey}`
     const selectedVersion = deps.integrationStateService
@@ -685,23 +694,39 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
 
     async getPaymentStatus(transactionId: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayPaymentStatus> {
       const transaction = await findTransactionOrThrow(transactionId, scope)
-      const { adapter, credentials } = await resolveAdapterAndCredentials(
-        transaction.providerKey,
-        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },
-      )
-
-      const status = await adapter.getStatus({
-        sessionId: readProviderSessionId(transaction),
-        credentials,
-      })
+      let status: GatewayPaymentStatus
+      try {
+        const { adapter, credentials } = await resolveAdapterAndCredentials(
+          transaction.providerKey,
+          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },
+        )
+        status = await adapter.getStatus({
+          sessionId: readProviderSessionId(transaction),
+          credentials,
+        })
+      } catch (error) {
+        try {
+          await stampLastPolledAt(transaction, new Date())
+        } catch (stampError) {
+          logger.warn('Failed to record last poll time after a failed status read', {
+            transactionId: transaction.id,
+            providerKey: transaction.providerKey,
+            err: stampError,
+          })
+        }
+        throw error
+      }
 
-      if (status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus as UnifiedPaymentStatus, status.status)) {
+      const polledAt = new Date()
+      const shouldApplyStatus = status.status !== transaction.unifiedStatus
+        && isValidTransition(transaction.unifiedStatus as UnifiedPaymentStatus, status.status)
+      if (shouldApplyStatus) {
         const previousStatus = transaction.unifiedStatus
         transaction.unifiedStatus = status.status
         alignCapturedAmountWithStatus(transaction, status.status)
         transaction.gatewayStatus = status.status
         transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), statusResult: status.providerData ?? null }
-        transaction.lastPolledAt = new Date()
+        transaction.lastPolledAt = polledAt
         await em.flush()
         await emitStatusEvent(status.status, {
           transactionId: transaction.id,
@@ -722,6 +747,8 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
             nextStatus: status.status,
           },
         )
+      } else {
+        await stampLastPolledAt(transaction, polledAt)
       }
 
       return status
@@ -846,7 +873,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         GatewayTransaction,
         where,
         {
-          orderBy: { updatedAt: 'asc' },
+          orderBy: { lastPolledAt: QueryOrder.ASC_NULLS_FIRST, createdAt: QueryOrder.ASC },
           limit: scope?.limit ?? 100,
         },
         scope,