feat(core): confirm flow and authorization api changes for external authentication

config/deployments/production.toml

@@ -80,7 +80,7 @@ worldline.base_url = "https://eu.sandbox.api-ingenico.com/"
 worldpay.base_url = "https://try.access.worldpay.com/"
 zen.base_url = "https://api.zen.com/"
 zen.secondary_base_url = "https://secure.zen.com/"
-threedsecureio.base_url = "https://service.sandbox.3dsecure.io"
+threedsecureio.base_url = "https://service.3dsecure.io"
 
 [delayed_session_response]
 connectors_with_delayed_session_response = "trustpay,payme"

crates/api_models/src/enums.rs

@@ -149,6 +149,127 @@ impl Connector {
     pub fn requires_defend_dispute(&self) -> bool {
         matches!(self, Self::Checkout)
     }
+    pub fn is_separate_authentication_supported(&self) -> bool {
+        #[cfg(feature = "dummy_connector")]
+        match self {
+            Self::DummyConnector1
+            | Self::DummyConnector2
+            | Self::DummyConnector3
+            | Self::DummyConnector4
+            | Self::DummyConnector5
+            | Self::DummyConnector6
+            | Self::DummyConnector7 => false,
+            Self::Aci
+            | Self::Adyen
+            | Self::Airwallex
+            | Self::Authorizedotnet
+            | Self::Bambora
+            | Self::Bankofamerica
+            | Self::Bitpay
+            | Self::Bluesnap
+            | Self::Boku
+            | Self::Braintree
+            | Self::Cashtocode
+            | Self::Coinbase
+            | Self::Cryptopay
+            | Self::Dlocal
+            | Self::Fiserv
+            | Self::Forte
+            | Self::Globalpay
+            | Self::Globepay
+            | Self::Gocardless
+            | Self::Helcim
+            | Self::Iatapay
+            | Self::Klarna
+            | Self::Mollie
+            | Self::Multisafepay
+            | Self::Nexinets
+            | Self::Nmi
+            | Self::Nuvei
+            | Self::Opennode
+            | Self::Payme
+            | Self::Paypal
+            | Self::Payu
+            | Self::Placetopay
+            | Self::Powertranz
+            | Self::Prophetpay
+            | Self::Rapyd
+            | Self::Shift4
+            | Self::Square
+            | Self::Stax
+            | Self::Trustpay
+            | Self::Tsys
+            | Self::Volt
+            | Self::Wise
+            | Self::Worldline
+            | Self::Worldpay
+            | Self::Zen
+            | Self::Signifyd
+            | Self::Plaid
+            | Self::Riskified
+            | Self::Threedsecureio
+            | Self::Cybersource
+            | Self::Noon
+            | Self::Stripe => false,
+            Self::Checkout => true,
+        }
+        #[cfg(not(feature = "dummy_connector"))]
+        match self {
+            Self::Aci
+            | Self::Adyen
+            | Self::Airwallex
+            | Self::Authorizedotnet
+            | Self::Bambora
+            | Self::Bankofamerica
+            | Self::Bitpay
+            | Self::Bluesnap
+            | Self::Boku
+            | Self::Braintree
+            | Self::Cashtocode
+            | Self::Coinbase
+            | Self::Cryptopay
+            | Self::Dlocal
+            | Self::Fiserv
+            | Self::Forte
+            | Self::Globalpay
+            | Self::Globepay
+            | Self::Gocardless
+            | Self::Helcim
+            | Self::Iatapay
+            | Self::Klarna
+            | Self::Mollie
+            | Self::Multisafepay
+            | Self::Nexinets
+            | Self::Nmi
+            | Self::Nuvei
+            | Self::Opennode
+            | Self::Payme
+            | Self::Paypal
+            | Self::Payu
+            | Self::Placetopay
+            | Self::Powertranz
+            | Self::Prophetpay
+            | Self::Rapyd
+            | Self::Shift4
+            | Self::Square
+            | Self::Stax
+            | Self::Trustpay
+            | Self::Tsys
+            | Self::Volt
+            | Self::Wise
+            | Self::Worldline
+            | Self::Worldpay
+            | Self::Zen
+            | Self::Signifyd
+            | Self::Plaid
+            | Self::Riskified
+            | Self::Threedsecureio
+            | Self::Cybersource
+            | Self::Noon
+            | Self::Stripe => false,
+            Self::Checkout => true,
+        }
+    }
 }
 
 #[derive(

crates/api_models/src/payments.rs

@@ -2708,7 +2708,7 @@ pub struct PaymentsResponse {
     pub external_authentication_details: Option<ExternalAuthenticationDetailsResponse>,
 
     /// Flag indicating if external 3ds authentication is made or not
-    pub request_external_3ds_authentication: Option<bool>,
+    pub external_3ds_authentication_attempted: Option<bool>,
 
     /// Date Time expiry of the payment
     #[schema(example = "2022-09-10T10:11:12Z")]

crates/common_enums/src/enums.rs

@@ -2133,6 +2133,15 @@ pub enum PaymentSource {
     ExternalAuthenticator,
 }
 
+impl PaymentSource {
+    pub fn is_for_internal_use_only(&self) -> bool {
+        match self {
+            Self::Dashboard | Self::Sdk | Self::MerchantServer | Self::Postman => false,
+            Self::Webhook | Self::ExternalAuthenticator => true,
+        }
+    }
+}
+
 #[derive(
     Clone,
     Copy,

crates/router/src/core/authentication.rs

@@ -209,6 +209,7 @@ pub async fn perform_pre_authentication<F: Clone + Send>(
             if authentication_data
                 .as_ref()
                 .is_some_and(|authentication_data| authentication_data.is_separate_authn_required())
+                || authentication.authentication_status.is_failed()
             {
                 *should_continue_confirm_transaction = false;
             }

crates/router/src/core/authentication/utils.rs

@@ -13,7 +13,7 @@ use crate::{
     routes::AppState,
     services::{self, execute_connector_processing_step},
     types::{
-        api,
+        api::{self, ConnectorCallType},
         authentication::{AuthNFlowType, AuthenticationResponseData},
         storage,
         transformers::ForeignFrom,
@@ -22,6 +22,34 @@ use crate::{
     utils::OptionExt,
 };
 
+pub fn get_connector_name_if_separate_authn_supported(
+    connector_call_type: &ConnectorCallType,
+) -> Option<String> {
+    match connector_call_type {
+        ConnectorCallType::PreDetermined(connector_data) => {
+            if connector_data
+                .connector_name
+                .is_separate_authentication_supported()
+            {
+                Some(connector_data.connector_name.to_string())
+            } else {
+                None
+            }
+        }
+        ConnectorCallType::Retryable(connectors) => connectors.first().and_then(|connector_data| {
+            if connector_data
+                .connector_name
+                .is_separate_authentication_supported()
+            {
+                Some(connector_data.connector_name.to_string())
+            } else {
+                None
+            }
+        }),
+        ConnectorCallType::SessionMultiple(_) => None,
+    }
+}
+
 pub async fn update_trackers<F: Clone, Req>(
     state: &AppState,
     router_data: RouterData<F, Req, AuthenticationResponseData>,

crates/router/src/core/payments.rs

@@ -169,7 +169,7 @@ where
 
     let should_add_task_to_process_tracker = should_add_task_to_process_tracker(&payment_data);
 
-    payment_data = tokenize_in_router_when_confirm_false(
+    payment_data = tokenize_in_router_when_confirm_false_or_external_authentication(
         state,
         &operation,
         &mut payment_data,
@@ -217,6 +217,18 @@ where
             should_continue_capture,
         );
 
+        operation
+            .to_domain()?
+            .call_external_three_ds_authentication_if_eligible(
+                state,
+                &mut payment_data,
+                &mut should_continue_transaction,
+                &connector_details,
+                &business_profile,
+                &key_store,
+            )
+            .await?;
+
         if should_continue_transaction {
             #[cfg(feature = "frm")]
             match (
@@ -1015,6 +1027,70 @@ impl<Ctx: PaymentMethodRetrieve> PaymentRedirectFlow<Ctx> for PaymentRedirectSyn
     }
 }
 
+#[derive(Clone, Debug)]
+pub struct PaymentAuthenticateCompleteAuthorize;
+
+#[async_trait::async_trait]
+impl<Ctx: PaymentMethodRetrieve> PaymentRedirectFlow<Ctx> for PaymentAuthenticateCompleteAuthorize {
+    async fn call_payment_flow(
+        &self,
+        state: &AppState,
+        merchant_account: domain::MerchantAccount,
+        merchant_key_store: domain::MerchantKeyStore,
+        req: PaymentsRedirectResponseData,
+        connector_action: CallConnectorAction,
+    ) -> RouterResponse<api::PaymentsResponse> {
+        let payment_confirm_req = api::PaymentsRequest {
+            payment_id: Some(req.resource_id.clone()),
+            merchant_id: req.merchant_id.clone(),
+            feature_metadata: Some(api_models::payments::FeatureMetadata {
+                redirect_response: Some(api_models::payments::RedirectResponse {
+                    param: req.param.map(Secret::new),
+                    json_payload: Some(req.json_payload.unwrap_or(serde_json::json!({})).into()),
+                }),
+            }),
+            ..Default::default()
+        };
+        Box::pin(payments_core::<
+            api::Authorize,
+            api::PaymentsResponse,
+            _,
+            _,
+            _,
+            Ctx,
+        >(
+            state.clone(),
+            merchant_account,
+            merchant_key_store,
+            PaymentConfirm,
+            payment_confirm_req,
+            services::api::AuthFlow::Merchant,
+            connector_action,
+            None,
+            HeaderPayload::with_source(enums::PaymentSource::ExternalAuthenticator),
+        ))
+        .await
+    }
+    fn generate_response(
+        &self,
+        payments_response: api_models::payments::PaymentsResponse,
+        business_profile: diesel_models::business_profile::BusinessProfile,
+        payment_id: String,
+        connector: String,
+    ) -> RouterResult<api::RedirectionResponse> {
+        helpers::get_handle_response_url(
+            payment_id,
+            &business_profile,
+            payments_response,
+            connector,
+        )
+    }
+
+    fn get_payment_action(&self) -> services::PaymentAction {
+        services::PaymentAction::CompleteAuthorize
+    }
+}
+
 #[allow(clippy::too_many_arguments)]
 #[instrument(skip_all)]
 pub async fn call_connector_service<F, RouterDReq, ApiRequest, Ctx>(
@@ -1989,7 +2065,7 @@ where
     Ok(payment_data_and_tokenization_action)
 }
 
-pub async fn tokenize_in_router_when_confirm_false<F, Req, Ctx>(
+pub async fn tokenize_in_router_when_confirm_false_or_external_authentication<F, Req, Ctx>(
     state: &AppState,
     operation: &BoxedOperation<'_, F, Req, Ctx>,
     payment_data: &mut PaymentData<F>,
@@ -2002,23 +2078,27 @@ where
     Ctx: PaymentMethodRetrieve,
 {
     // On confirm is false and only router related
-    let payment_data = if !is_operation_confirm(operation) {
-        let (_operation, payment_method_data, pm_id) = operation
-            .to_domain()?
-            .make_pm_data(
-                state,
-                payment_data,
-                validate_result.storage_scheme,
-                merchant_key_store,
-                customer,
-            )
-            .await?;
-        payment_data.payment_method_data = payment_method_data;
-        payment_data.payment_attempt.payment_method_id = pm_id;
-        payment_data
-    } else {
-        payment_data
-    };
+    let is_external_authentication_requested = payment_data
+        .payment_intent
+        .request_external_three_ds_authentication;
+    let payment_data =
+        if !is_operation_confirm(operation) || is_external_authentication_requested == Some(true) {
+            let (_operation, payment_method_data, pm_id) = operation
+                .to_domain()?
+                .make_pm_data(
+                    state,
+                    payment_data,
+                    validate_result.storage_scheme,
+                    merchant_key_store,
+                    customer,
+                )
+                .await?;
+            payment_data.payment_method_data = payment_method_data;
+            payment_data.payment_attempt.payment_method_id = pm_id;
+            payment_data
+        } else {
+            payment_data
+        };
     Ok(payment_data.to_owned())
 }