NO_API_ACCESS_TO_RECEIVER in sandbox account paypal - ruby-on-rails-4

I have integrated paypal-adaptive-payment-delayed-chained-payments in my Rails Application and there will Primary receiver hold whole amount and sender can cancel the product and refund the amount.
I am using paypal sandbox account for testing but getting "refund_status"=>"NO_API_ACCESS_TO_RECEIVER" this after call refund and paypal success is true
so I am confusing what that mean, as I know in sandbox paypal provide full access
log is:
{"response_envelope"=>{"timestamp"=>"2015-10-06T22:55:49.604-07:00", "ack"=>"Success", "correlation_id"=>"9f0f563554297", "build"=>"17820627"}, "currency_code"=>"USD", "refund_info_list"=>{"refund_info"=>[{"receiver"=>{"amount"=>"60.00", "email"=>"test#gmail.com"}, "refund_status"=>"NO_API_ACCESS_TO_RECEIVER"}]}}
Please let me know where I am doing wrong

The status NO_API_ACCESS_TO_RECEIVER indicates that the request cannot be completed because you do not have third-party access from the receiver to make the refund.
Sandbox account has provided full access but when it comes to Adaptive Payments (Chained) Refund in particular, you would need your refund API caller (in your case, the primary receiver) to be granted with refund permission (3rd party access to make a refund on-behalf) from all secondary recievers in the chain.
Check HERE (the Refund API Overview section) for instructions

Related

How to sign transaction on the client side and then submit it on the server side on the Aptos

I am writing a app, where user can deposit APT coins and receive points in the app. So, I have to be 100% sure that the user has transferred APT to the escrow, in order to give him points. What I want to do is to sign transfer transaction on the client side using user wallet and send the signature to the server, where the transaction is verified and submitted to the blockchain. If everything is correct, user will receive points on the app. My question is how can I submit already signed transaction on the backend and verify that it transferred coins to the escrow account?
I've tried signing transaction on the client side and sending a signature buffer to the server. Then I wanted to use AptosClient.submitTransaction(), but it didn't work.
Instead of trying to submit the transaction on the server side, there are a few things you can do on the contract (or even backend) side to ensure they've made a deposit:
Emit an event in your contract on the users' account when they escrow the coins, and have your backend server check their account for that
Run an indexer, and check for the expected interactions that way
If you send their signed txn to your backend, you open yourself up to the race condition of a user completing another txn after/during sending the signed txn to the backend, which increments the users seq_no, making the previously signed txn invalid

Authorize.net: How to retry failed ARB transactions?

Is there a good way to retry failed subscription payments? Sometimes our customers will fail a payment but then have money the next day, so we just want to retry the payment instead of having them update their card. Some things we've tried:
Foolishly signed up for "Automatic Retry" thinking it would automatically retry, but it only retries after the customer updates their card.
In order for Automatic Retry to kick in, the subscription needs to change from Suspended to Active which has to be done manually according to support. There's really no way to do this through the API?
Our last resort: On any failed subscription, cancel the subscription and re-create it from the profile, starting on the date we want to retry the payment. Any downsides to this I'm not considering?
There is no way to automatically retry a failed subscription payment through their API. That thread is a few years old but no new endpoints were added since then to enable this functionality.
On any failed subscription, cancel the subscription and re-create it from the profile, starting on the date we want to retry the payment. Any downsides to this I'm not considering?
You will incur transaction fees for retrying even though the chance for success is low.
Make sure you control all notifications. If your user gets emails telling them they're making unexpected payments or setting up new subscriptions you run the risk of chargebacks which could cause you to lose your ability to accept credit cards.

Re-activate a suspended G Suite subscription at the end of its annual commitment interval

We have a system that manages our G Suite Reseller via the API.
Given a G Suite subscription that has been suspended because it has already passed its annual commitment period (and its renewal setting is set to "CANCEL" i.e. be suspended after its commitment period), will the "Activate" request be enough to immediately re-activate the subscription with the same plan details that it had before (i.e. same plan and renewal settings)?
I have checked this article and it only mentions briefly that to activate a suspended account, the activate code simply has to be called:
https://developers.google.com/admin-sdk/reseller/v1/reference/subscriptions/changeRenewalSettings#renewalType
Could anyone clarify or verify this? I am unable to test it since our G Suite sandbox environment does not have any subscriptions that have already exceeded its commitment period (and I am unable to create one with that setup either).
It was clearly stated in the G Suite Administrator Help to "Avoid suspension".
However, if it happen, you can follow the steps on how to renew an expired domain registration.
But you have to consider this:
Note: We can't guarantee that you can renew an expired domain
purchased through Google. It depends on whether the domain is still
available from your domain host. In any case, try to renew the domain
right away. The longer you wait, the less likely you'll be able to
renew. As a general rule, you should renew within 19 days of the
official renewal date to increase the chances that you can renew
successfully.
You have to first changeplan with customerId/domain and subscriptionId
Then call activate.
NOTE:
calling activate on subscriptions which are suspended after trail was completed will result in failure.But if the plan is set you can call activate.
Pay attention to suspensionReasons in API response.

AWS SES Production Access setup with Meteor

Setting up Meteor to use "out of the box" AWS SES is simple, and one can use native Meteor "Email" methods without modification.
Steps to implement this can be found here. Thanks to Brian
Shamblen for putting together a detailed answer.
But one caveat with the "out of the box" SES is you need to both verify the sender and receiver email address.
To remedy this, you can put in a request with AWS SES for what they call, Production Access.
And further, according to Brian Shamblen,
The process to get production access is rather complicated. One will
need to handle bounce and complaint notifications from SES and prevent
messages from being sent to those addresses in the future.
Question
What is the Meteor code involved in handling bounce and complaint notifications from SES and prevent messages from being sent to those addresses in the future?
EDIT: Made modifications to question for clarity.
Requesting production access is fairly straightforward. You just need to contact them and they usually give it to you in a couple of hours.
Information about the process is here: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/request-production-access.html
Load up the URL : http://aws.amazon.com/ses/fullaccessrequest/ and let them know what you will be sending via Emails, for example if you will be sending transaction based email (verification of a transaction, etc)
With production access you can either send email from:
A specific verified email address, where you will be asked to click a link to an email sent to that address to verify you own it
Any email under an entire domain. Under this process you prove you own the domain by editing its DNS records to contain a 'key'.
Most use cases are covered under production access, they typically give you 2000 emails a day and rate limit emails to 5/sec (they queue them so the maximum send rate is 5/sec). If you need more than this you can contact them to raise this additionally.
The process of verification is to stop people quickly creating AWS accounts to mass-spam users. If they allowed this straight-off then AWS IPs would be looked at as spam by other email providers.
For bounce notifications, SES tracks these, and you have to make sure that you don't get an above average bounce rate. Typically these would come from sending unsolicited email, which I wouldn't advise sending via SES.
Production access is only approved by the AWS team. Wait a bit and they should easily give you 2.000 emails/day for free.
As per bounces-unsubscribes... You'll need to have the SES API notify you of each email address which has been 'marked' with such status.
You should store all those email addresses somewhere and tell your app not to send them ANYTHING else in the future.

Architecture for robust payment processing

Imagine 3 system components:
1. External ecommerce web service to process credit card transactions
2. Local Database to store processing results
3. Local UI (or win service) to perform payment processing of the customer order document
The external web service is obviously not transactional, so how to guarantee:
1. results to be eventually persisted to database when received from web service even in case the database is not accessible at that moment(network issue, db timeout)
2. prevent clients from processing the customer order while payment initiated by other client but results not successfully persisted to database yet(and waiting in some kind of recovery queue)
The aim is to do processing having non transactional system components and guarantee the transaction won't be repeated by other process in case of failure.
(please look at it in the context of post sell payment processing, where multiple operators might attempt manual payment processing; not web checkout application)
Ask the payment processor whether they can detect duplicate transactions based on an order ID you supply. Then if you are unable to store the response due to a database failure, you can safely resubmit the request without fear of double-charging (at least one PSP I've used returned the same response/auth code in this scenario, along with a flag to say that this was a duplicate).
Alternatively, just set a flag on your order immediately before attempting payment, and don't attempt payment if the flag was already set. If an error then occurs during payment, you can investigate and fix the data at your leisure.
I'd be reluctant to go down the route of trying to automatically cancel the order and resubmitting, as this just gets confusing (e.g. what if cancelling fails - should you retry or not?). Best to keep the logic simple so when something goes wrong you know exactly where you stand.
In any system like this, you need robust error handling and error reporting. This is doubly true when it comes to dealing with payments, where you absolutely do not want to accidentaly take someone's money and not deliver the goods.
Because you're outsourcing your payment handling to a 3rd party, you're ultimately very reliant on the gateway having robust error handling and reporting systems.
In general then, you hand off control to the payment gateway and start a task that waits for a response from the gateway, which is either 'payment accepted' or 'payment declined'. When you get that response you move onto the next step in your process and everything is good.
When you don't get a response at all (time out), or the response is invalid, then how you proceed very much depends on the payment gateway:
If the gateway supports it send a 'cancel payment' style request. If the payment cancels successfully then you probably want to send the user to a 'sorry, please try again' style page.
If the gateway doesn't support canceling, or you have no communications to the gateway then you will need to manually (in person, such as telephone) contact the 3rd party to discover what went wrong and how to proceed. To aid this you need to dump as much detail as you have to error logs, such as date/time, customer id, transaction value, product ids etc.
Once you're back on your site (and payment is accepted) then you're much more in control of errors, but in brief if you cant complete the order, then you should either dump the details to disk (such as csv file for manual handling) or contact the gateway to cancel the payment.
Its also worth having a system in place to track errors as they occur, and if an excessive number occur then consider what should happen. If its a high traffic site for example you may want to temporarily prevent further customers from placing orders whilst the issue is investigated.
Distributed messaging.
When your payment gateway returns submit a message to a durable queue that guarantees a handler will eventually get it and process it. The handler would update the database. Should failure occur at that point the handler can leave the message in the queue or repost it to the queue, or post an alternate message.
Should something occur later that invalidates the transaction, another message could be queued to "undo" the change.
There's a fair amount of buzz lately about eventual consistency and distribute messaging. NServiceBus is the new component hotness. I suggest looking into this, I know we are.