# Ocyan Mollie payment adapter

This is the Oscar checkout adapter for the MandelBlog Mollie provider core.
It owns checkout initiation, redirects, source/payment events and the classic
Mollie webhook endpoint. New checkouts use Mollie's Payments API; historic
`ord_` references remain supported for reconciliation only.

## Runtime configuration

Configure a Mollie key only through approved project runtime settings.
`MOLLIE_API_KEY` takes precedence over `payment_mollie.api_key` and is read
only when a payment operation runs. Do not store keys in source, package
metadata, fixtures or logs.

Mollie's classic webhook posts only a payment identifier. The adapter fetches
the authoritative provider state, records an idempotency fingerprint without
storing customer payload data, and safely acknowledges unknown references.

Each browser checkout attempt receives an opaque UUID that is passed to
Mollie as its `Idempotency-Key`. The `MolliePaymentAttempt` record retains the
provider reference for operational diagnosis without keeping request payloads.
The adapter intentionally exposes no public refund URL. An authorised Oscar
dashboard or service integration may call `request_refund(...)` only after it
has applied its own staff/permission policy; the method validates the payment
reference and exact amount before asking Mollie to create a refund.

## Compatibility

The plugin targets Python 3.12, Django 5.2, Django Oscar 4.1 and Mollie SDK
4.x. It contains forward migrations for the webhook event ledger and checkout
attempt records; do not rename the `payment_mollie` app label or rewrite
migration history.
