Critical Bug: HTTP PUT Requests Fail Due to Incorrect Connection Configuration

[kallal79]

Issue Summary

A critical bug exists in the ApiV3.kt file that prevents HTTP PUT requests from working correctly. The updateMerchantReferenceV3 method, which is essential for updating merchant references after checkout completion, will fail because the underlying HTTP connection is misconfigured.

Root Cause Analysis

In /afterpay/src/main/kotlin/com/afterpay/android/internal/ApiV3.kt, the configure method incorrectly sets up HTTP PUT requests:

HttpVerb.PUT -> {
    connection.doInput = true
    connection.doOutput = false // TODO: What? <-- THIS IS THE BUG
}

The doOutput property is set to false for PUT requests, but it should be true because:

1. HTTP PUT requires a request body - The method needs to send JSON payload to update merchant reference
2. Java HttpURLConnection documentation states that doOutput must be true for methods that send request bodies
3. The existing code writes to the output stream - Both request() and requestUnit() methods attempt to write payload to connection.outputStream, which will fail if doOutput is false

Impact Assessment

Affected Functionality

• Afterpay.updateMerchantReferenceV3() - BROKEN
• Afterpay.updateMerchantReferenceV3Async() - BROKEN

Business Impact

• Merchants cannot update order references after checkout completion
• Integration flows that depend on merchant reference updates will fail
• This affects the core V3 checkout functionality documented in the README

Technical Impact

• IOException will be thrown when attempting to get outputStream on a connection with doOutput = false
• Silent failures in production environments
• No error handling for this specific configuration issue

Evidence

1. TODO comment indicates awareness: The "TODO: What?" comment shows the developer was uncertain about this configuration
2. Missing test coverage: No unit tests exist for ApiV3 or the updateMerchantReferenceV3 method
3. Inconsistent configuration: POST requests correctly set doOutput = true, but PUT does not

Proposed Solution

Change the PUT request configuration to match POST requests:

HttpVerb.PUT -> {
    connection.doInput = true
    connection.doOutput = true  // FIX: Enable output for request body
}

Testing Strategy

Since this functionality lacks test coverage, the following test scenarios should be added:

1. Unit tests for ApiV3.kt

   • Test HTTP PUT request configuration
   • Test request body serialization for PUT requests
   • Test error handling for PUT requests

2. Integration tests for updateMerchantReferenceV3

   • Test successful merchant reference update
   • Test error scenarios (network failure, invalid tokens, etc.)