fix(sca): re-confirm payment intent on-session to surface 3ds next_action

api/handlers/cart.go

@@ -506,6 +506,21 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 func (h *CartHandler) respondRequiresAction(w http.ResponseWriter, order *models.Order, pi *stripe.PaymentIntent) {
 	db := database.GetDB()
 
+	// After an off-session authentication_required decline, the PI sits in
+	// status=requires_payment_method, not requires_action — there is no
+	// next_action to read. Re-confirm on-session so Stripe pushes the PI into
+	// requires_action and populates next_action.redirect_to_url with the 3DS
+	// challenge URL.
+	if pi.NextAction == nil || pi.NextAction.RedirectToURL == nil || pi.NextAction.RedirectToURL.URL == "" {
+		confirmed, cerr := paymentintent.Confirm(pi.ID, &stripe.PaymentIntentConfirmParams{
+			OffSession: stripe.Bool(false),
+			ReturnURL:  stripe.String(h.appURL + "/post-3ds"),
+		})
+		if cerr == nil && confirmed != nil {
+			pi = confirmed
+		}
+	}
+
 	if pi.NextAction == nil || pi.NextAction.RedirectToURL == nil || pi.NextAction.RedirectToURL.URL == "" {
 		middleware.RecordCartConversion("sca_missing_next_action")
 		db.Model(order).Update("status", models.OrderStatusFailed)