[FIX] payment_ogone: ensure token aliases are unique

Prior to this commit, the generation of token aliases in Ogone relied
on the util function `singularize_reference_prefix`, which is intended
to make transaction references (and not token aliases!) more
distinguishable by suffixing a timestamp accurate to the second. That
util function does not guarantee the uniqueness of generated reference
prefixes, which is okay because the final reference is further suffixed
if the prefix happens to collide with an existing reference.

Using the util to generate Ogone's token aliases, however, poses a
problem because aliases *must* be unique. Otherwise, a customer saving a
payment token at the same second as another customer would end up
linking their payment method to the other customer's payment token.

This commit drops the use of the util method and replaces it with a UUID.

closes odoo/odoo#115580

X-original-commit: 61d833ffcd1562950126d3c87c92569fe35a8b08
Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com>

addons/payment/utils.py

@@ -57,6 +57,10 @@ def singularize_reference_prefix(prefix='tx', separator='-', max_length=None):
     If the `max_length` argument is passed, the end of the prefix can be stripped before
     singularizing to ensure that the result accounts for no more than `max_length` characters.
 
+    Warning: Generated prefixes are *not* uniques! This function should be used only for making
+    transaction reference prefixes more distinguishable and *not* for operations that require the
+    generated value to be unique.
+
     :param str prefix: The custom prefix to singularize
     :param str separator: The custom separator used to separate the prefix from the suffix
     :param int max_length: The maximum length of the singularized prefix

addons/payment_ogone/models/payment_transaction.py

@@ -2,6 +2,7 @@
 
 import logging
 import pprint
+import uuid
 
 from lxml import etree, objectify
 from werkzeug import urls
@@ -83,7 +84,7 @@ class PaymentTransaction(models.Model):
         }
         if self.tokenize:
             rendering_values.update({
-                'ALIAS': payment_utils.singularize_reference_prefix(prefix='ODOO-ALIAS'),
+                'ALIAS': f'ODOO-ALIAS-{uuid.uuid4().hex}',
                 'ALIASUSAGE': _("Storing your payment details is necessary for future use."),
             })
         rendering_values.update({