TeraWallet 1.6.8 — REST admin writes fatal (WooWallet_Idempotency not loaded) + idempotent replay returns 500 for a completed transaction
Environment: TeraWallet 1.6.8 (official package), WordPress 7.0.2, WooCommerce 10.9.4, PHP 8.2.29, authentication via application password (Basic auth) with a user having wallet admin capabilities.
Bug 1 — critical: every terawallet/v1 admin write returns 500 (class not found).
Any authenticated write request, e.g.:
POST /wp-json/terawallet/v1/admin/transactions
Idempotency-Key: example-123
{“user_id”: 32, “type”: “debit”, “amount”: 0.04, “note”: “test”}
returns 500 internal_server_error (WordPress “critical error” page as body). Cause: the controllers call WooWallet_Idempotency::run() (e.g. in includes/api/v1/admin/class-terawallet-rest-admin-transactions-controller.php, create_item), and the class file ships at includes/services/class-woo-wallet-idempotency.php, but nothing loads it — class_exists(‘WooWallet_Idempotency’) is false at runtime, and there’s no include/autoload entry for it in includes/class-woo-wallet.php or elsewhere. This makes admin/transactions (create), admin/users/{id}/transactions/purge, and every other path calling require_idempotency_key()+run() fatal for all 1.6.8 installs.
Workaround we applied: adding
include_once WOO_WALLET_ABSPATH . ‘includes/services/class-woo-wallet-idempotency.php’;
next to the other includes in includes/class-woo-wallet.php restores the endpoints. Please add the include (or autoloader entry) in the next release.
Bug 2 — idempotency replay of a completed transaction returns 500 instead of the stored result.
Sequence observed (after applying the workaround above):
POST /admin/transactions (debit, Idempotency-Key: billing-sync-122-270). Server-side the transaction completed (wallet balance moved, transaction recorded), but our client hit its HTTP timeout before the response arrived (the request also sends the customer email synchronously, which can push response time past short client timeouts).
Retried the identical request with the same Idempotency-Key, expecting the recorded transaction back per idempotency semantics.
Response: 500 {“code”:”terawallet_rest_transaction_failed”,”message”:”Wallet transaction could not be recorded.”}.
The good news: no double charge happened. But the replay should return the originally recorded transaction (200) rather than re-running the closure and failing — otherwise API clients must treat a successfully completed charge as a failure, which defeats the purpose of the Idempotency-Key header. It looks like the stored-response persistence may not survive a client disconnect, so the replay re-executes and then the duplicate guard makes woo_wallet()->wallet->debit() return false.
Happy to provide logs or test anything on our staging site. Thanks for the plugin — the new terawallet/v1 API (idempotency included) is a clear step up from the wc/v2 routes once these two issues are sorted.