[BUG] As a user, I sometimes experience errors when using my stored card after updating it in checkout

[damienwebdev]

🐛 Bug report

Current Behavior

We had a customer report that when they try to update the address on their stored card in checkout to the new location that they moved to IRL, they receive an AVS mismatch error.

Expected Behavior

Ability to update the address of a stored card.

Minimal reproduction of the problem with instructions

1. Create an account
2. Create a stored card
3. Change the address on the stored card with the bank
4. Update the address on the stored card with GraphQl (updateTokenBaseCard)
5. Turn on AVS checks
6. Get an AVS mismatch error as the billing address on the card does not match the card on file

What is the motivation / use case for changing the behavior?

UX.

Environment

TokenBase version: 4.7.2
Magento version: v2.4.6-p10
PHP version: 8.1.29


Others:

[damienwebdev]

Here's a potential patch:

diff --git a/Model/ResourceModel/CardRepository.php b/Model/ResourceModel/CardRepository.php
index 0244737..3192756 100644
--- a/Model/ResourceModel/CardRepository.php
+++ b/Model/ResourceModel/CardRepository.php
@@ -352,7 +352,8 @@ class CardRepository implements CardRepositoryInterface
         if (!empty($card->getPaymentId())
             && empty($paymentData['cc_number'])
             && empty($paymentData['token'])
-            && empty($paymentData['acceptjs_value'])) {
+            && empty($paymentData['acceptjs_value'])
+            && !$card->hasDataChanges()) {
             return;
         }

In essence, it is possible for any address data stored on the user's payment profile in Authorize.net to be stale. As such, users would be forced to create new cards as opposed to simply being able to modify existing address data stored on their card/payment profile.

This diff essentially forces card resync upon modification to the card after it has been modified.. I'm uncertain if this is the best behavior as the repository method is used in many places and this could potentially cause a jump in the number of Authorize.net API calls.

[rhoerr]

Thank you Damien -- we'll review. The expected behavior is that any card address update by any interface should propagate to Authorize.net.