[FIX] account_payment: Do not create payment token when not logged-in

- When paying an invoice with a payment acquirer that saves tokens after each payments (S2S mode or save token to "ask" or "always") and while not connected.
  The payment token is saved as either the invoice partner (when the acquirer is in form mode) or as the public user's partner (for S2S acquirers).
  This should not happen.

  To fix this issue, if the customer is not connected and pays the invoice using a form acquirer, we do not create a token.
  If the customer pays the invoice using a S2S acquirer the created token is then linked to the invoice's partner.

addons/account_payment/controllers/payment.py

@@ -17,7 +17,6 @@ class PaymentPortal(http.Controller):
         :return html: form containing all values related to the acquirer to
                       redirect customers to the acquirer website """
         success_url = kwargs.get('success_url', '/my')
-        callback_method = kwargs.get('callback_method', '')
 
         invoice_sudo = request.env['account.invoice'].sudo().browse(invoice_id)
         if not invoice_sudo:
@@ -28,17 +27,16 @@ class PaymentPortal(http.Controller):
         except:
             return False
 
+        if request.env.user == request.env.ref('base.public_user'):
+            save_token = False # we avoid to create a token for the public user
+
         token = request.env['payment.token'].sudo()  # currently no support of payment tokens
         tx = request.env['payment.transaction'].sudo()._check_or_create_invoice_tx(
             invoice_sudo,
             acquirer,
             payment_token=token,
             tx_type='form_save' if save_token else 'form',
-            add_tx_values={
-                'callback_model_id': request.env['ir.model'].sudo().search([('model', '=', invoice_sudo._name)], limit=1).id,
-                'callback_res_id': invoice_sudo.id,
-                'callback_method': callback_method,
-            })
+        )
 
         # set the transaction id into the session
         request.session['portal_invoice_%s_transaction_id' % invoice_sudo.id] = tx.id
@@ -58,7 +56,6 @@ class PaymentPortal(http.Controller):
         """ Use a token to perform a s2s transaction """
         error_url = kwargs.get('error_url', '/my')
         success_url = kwargs.get('success_url', '/my')
-        callback_method = kwargs.get('callback_method', '')
         access_token = kwargs.get('access_token')
         params = {}
         if access_token:
@@ -73,7 +70,8 @@ class PaymentPortal(http.Controller):
             token = request.env['payment.token'].sudo().browse(int(pm_id))
         except (ValueError, TypeError):
             token = False
-        if not token:
+        token_owner = invoice_sudo.partner_id if request.env.user == request.env.ref('base.public_user') else request.env.user.partner_id
+        if not token or token.partner_id != token_owner:
             params['error'] = 'pay_invoice_invalid_token'
             return request.redirect(_build_url_w_params(error_url, params))
 
@@ -83,11 +81,7 @@ class PaymentPortal(http.Controller):
             token.acquirer_id,
             payment_token=token,
             tx_type='server2server',
-            add_tx_values={
-                'callback_model_id': request.env['ir.model'].sudo().search([('model', '=', invoice_sudo._name)], limit=1).id,
-                'callback_res_id': invoice_sudo.id,
-                'callback_method': callback_method,
-            })
+        )
 
         # set the transaction id into the session
         request.session['portal_invoice_%s_transaction_id' % invoice_sudo.id] = tx.id

addons/account_payment/controllers/portal.py

@@ -9,5 +9,18 @@ class PortalAccount(PortalAccount):
 
     def _invoice_get_page_view_values(self, invoice, access_token, **kwargs):
         values = super(PortalAccount, self)._invoice_get_page_view_values(invoice, access_token, **kwargs)
-        values.update(request.env['payment.acquirer']._get_available_payment_input(invoice.partner_id, invoice.company_id))
+        payment_inputs = request.env['payment.acquirer']._get_available_payment_input(company=invoice.company_id)
+        # if not connected (using public user), the method _get_available_payment_input will return public user tokens
+        is_public_user = request.env.ref('base.public_user') == request.env.user
+        if is_public_user:
+            # we should not display payment tokens owned by the public user
+            payment_inputs.pop('pms', None)
+            token_count = request.env['payment.token'].sudo().search_count([('acquirer_id.company_id', '=', invoice.company_id.id),
+                                                                      ('partner_id', '=', invoice.partner_id.id),
+                                                                    ])
+            values['existing_token'] = token_count > 0
+        values.update(payment_inputs)
+        # if the current user is connected we set partner_id to his partner otherwise we set it as the invoice partner
+        # we do this to force the creation of payment tokens to the correct partner and avoid token linked to the public user
+        values['partner_id'] = invoice.partner_id if is_public_user else request.env.user.partner_id,
         return values

addons/account_payment/views/account_portal_templates.xml

@@ -83,6 +83,11 @@
                     </t>
                 </div>
             </div>
+            <div class="panel-body" t-if="existing_token">
+                <div class="col-md-offset-3 col-md-6">
+                    <i class="fa fa-info"></i> You have credits card registered, you can log-in to be able to use them.
+                </div>
+            </div>
         </xpath>
     </template>