remove unnecessary DB interaction in GET private/orders/ID

20 files changed, 283 insertions, 272 deletions

diff --git a/contrib/wallet-core b/contrib/wallet-core
-Subproject 1b76ec350b6a6e3092f96939c2cfa1e16d5ca2b
+Subproject 0c211082e0b8372f8fa1cef8102e477c7363d9b
diff --git a/src/backend/taler-merchant-httpd_get-orders-ID.c b/src/backend/taler-merchant-httpd_get-orders-ID.c
index 0943e022..02f2997f 100644
--- a/src/backend/taler-merchant-httpd_get-orders-ID.c
+++ b/src/backend/taler-merchant-httpd_get-orders-ID.c
@@ -950,7 +950,6 @@ TMH_get_orders_ID (const struct TMH_RequestHandler *rh,
   if (NULL == god->contract_terms)
   {
     uint64_t order_serial;
-    bool paid = false;
     struct TALER_ClaimTokenP db_claim_token;
 
     qs = TMH_db->lookup_contract_terms (TMH_db->cls,
@@ -958,7 +957,6 @@ TMH_get_orders_ID (const struct TMH_RequestHandler *rh,
                                         order_id,
                                         &god->contract_terms,
                                         &order_serial,
-                                        &paid,
                                         &db_claim_token);
     if (0 > qs)
     {
diff --git a/src/backend/taler-merchant-httpd_post-orders-ID-claim.c b/src/backend/taler-merchant-httpd_post-orders-ID-claim.c
index 91a16814..16b69c53 100644
--- a/src/backend/taler-merchant-httpd_post-orders-ID-claim.c
+++ b/src/backend/taler-merchant-httpd_post-orders-ID-claim.c
@@ -62,7 +62,6 @@ claim_order (const char *instance_id,
   struct TALER_ClaimTokenP order_ct;
   enum GNUNET_DB_QueryStatus qs;
   uint64_t order_serial;
-  bool paid = false;
 
   if (GNUNET_OK !=
       TMH_db->start (TMH_db->cls,
@@ -76,7 +75,6 @@ claim_order (const char *instance_id,
                                       order_id,
                                       contract_terms,
                                       &order_serial,
-                                      &paid,
                                       NULL);
   if (0 > qs)
   {
diff --git a/src/backend/taler-merchant-httpd_post-orders-ID-paid.c b/src/backend/taler-merchant-httpd_post-orders-ID-paid.c
index 54d4b930..4eb7280f 100644
--- a/src/backend/taler-merchant-httpd_post-orders-ID-paid.c
+++ b/src/backend/taler-merchant-httpd_post-orders-ID-paid.c
@@ -134,14 +134,12 @@ TMH_post_orders_ID_paid (const struct TMH_RequestHandler *rh,
   TMH_db->preflight (TMH_db->cls);
   {
     uint64_t order_serial;
-    bool paid;
 
     qs = TMH_db->lookup_contract_terms (TMH_db->cls,
                                         hc->instance->settings.id,
                                         order_id,
                                         &contract_terms,
                                         &order_serial,
-                                        &paid,
                                         NULL);
   }
   if (0 > qs)
diff --git a/src/backend/taler-merchant-httpd_post-orders-ID-refund.c b/src/backend/taler-merchant-httpd_post-orders-ID-refund.c
index f71eb17e..e5595296 100644
--- a/src/backend/taler-merchant-httpd_post-orders-ID-refund.c
+++ b/src/backend/taler-merchant-httpd_post-orders-ID-refund.c
@@ -581,14 +581,12 @@ TMH_post_orders_ID_refund (const struct TMH_RequestHandler *rh,
     {
       json_t *contract_terms;
       uint64_t order_serial;
-      bool paid;
 
       qs = TMH_db->lookup_contract_terms (TMH_db->cls,
                                           hc->instance->settings.id,
                                           hc->infix,
                                           &contract_terms,
                                           &order_serial,
-                                          &paid,
                                           NULL);
       if (0 > qs)
       {
diff --git a/src/backend/taler-merchant-httpd_private-delete-orders-ID.c b/src/backend/taler-merchant-httpd_private-delete-orders-ID.c
index dfdb486e..cd8aa10c 100644
--- a/src/backend/taler-merchant-httpd_private-delete-orders-ID.c
+++ b/src/backend/taler-merchant-httpd_private-delete-orders-ID.c
@@ -78,6 +78,8 @@ TMH_private_delete_orders_ID (const struct TMH_RequestHandler *rh,
       struct TALER_MerchantPostDataHashP unused;
       uint64_t order_serial;
       bool paid = false;
+      bool wired = false;
+      bool matches = false;
 
       qs = TMH_db->lookup_order (TMH_db->cls,
                                  mi->settings.id,
@@ -87,13 +89,16 @@ TMH_private_delete_orders_ID (const struct TMH_RequestHandler *rh,
                                  NULL);
       if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == qs)
       {
-        qs = TMH_db->lookup_contract_terms (TMH_db->cls,
-                                            mi->settings.id,
-                                            hc->infix,
-                                            NULL,
-                                            &order_serial,
-                                            &paid,
-                                            NULL);
+        qs = TMH_db->lookup_contract_terms3 (TMH_db->cls,
+                                             mi->settings.id,
+                                             hc->infix,
+                                             NULL,
+                                             NULL,
+                                             &order_serial,
+                                             &paid,
+                                             &wired,
+                                             &matches,
+                                             NULL);
       }
       if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == qs)
         return TALER_MHD_reply_with_error (connection,
diff --git a/src/backend/taler-merchant-httpd_private-get-orders-ID.c b/src/backend/taler-merchant-httpd_private-get-orders-ID.c
index 602a970f..a19c64a4 100644
--- a/src/backend/taler-merchant-httpd_private-get-orders-ID.c
+++ b/src/backend/taler-merchant-httpd_private-get-orders-ID.c
@@ -390,6 +390,12 @@ struct GetOrderRequestContext
   bool paid;
 
   /**
+   * True if the paid session in the database matches
+   * our @e session_id.
+   */
+  bool paid_session_matches;
+
+  /**
    * True if the exchange wired the money to the merchant.
    */
   bool wired;
@@ -533,12 +539,12 @@ resume_by_event (void *cls,
   (void) extra;
   (void) extra_size;
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Resuming request %p by trigger\n",
-              gorc);
+              "Resuming request for order %s by trigger\n",
+              gorc->hc->infix);
   if (GNUNET_NO == gorc->suspended)
     return; /* duplicate event is possible */
   gorc->suspended = GNUNET_NO;
-  gorc->phase = GOP_PARSE_CONTRACT;
+  gorc->phase = GOP_FETCH_CONTRACT;
   GNUNET_CONTAINER_DLL_remove (gorc_head,
                                gorc_tail,
                                gorc);
@@ -742,13 +748,16 @@ phase_fetch_contract (struct GetOrderRequestContext *gorc)
     gorc->summary = NULL;
   }
   TMH_db->preflight (TMH_db->cls);
-  qs = TMH_db->lookup_contract_terms (TMH_db->cls,
-                                      hc->instance->settings.id,
-                                      hc->infix,
-                                      &gorc->contract_terms,
-                                      &gorc->order_serial,
-                                      &gorc->paid,
-                                      &gorc->claim_token);
+  qs = TMH_db->lookup_contract_terms3 (TMH_db->cls,
+                                       hc->instance->settings.id,
+                                       hc->infix,
+                                       gorc->session_id,
+                                       &gorc->contract_terms,
+                                       &gorc->order_serial,
+                                       &gorc->paid,
+                                       &gorc->wired,
+                                       &gorc->paid_session_matches,
+                                       &gorc->claim_token);
   if (0 > qs)
   {
     /* single, read-only SQL statements should never cause
@@ -880,34 +889,32 @@ phase_check_paid (struct GetOrderRequestContext *gorc)
 
   if (gorc->order_only)
   {
-    gorc->paid = false;
-    gorc->wired = false;
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Order %s unclaimed, no need to lookup payment status\n",
                 hc->infix);
     gorc->phase++;
     return;
   }
-  /* FIXME: why do another DB lookup here, we got 'paid' before already, could
-     have likely gotten 'wired' just as well! */
-  TMH_db->preflight (TMH_db->cls);
-  qs = TMH_db->lookup_payment_status (TMH_db->cls,
-                                      gorc->order_serial,
-                                      gorc->session_id,
-                                      &gorc->paid,
-                                      &gorc->wired);
-  if (0 > qs)
+  if (NULL == gorc->session_id)
   {
-    /* single, read-only SQL statements should never cause
-       serialization problems, and the entry should exist as per above */
-    GNUNET_break (GNUNET_DB_STATUS_HARD_ERROR == qs);
-    phase_end (gorc,
-               TALER_MHD_reply_with_error (gorc->sc.con,
-                                           MHD_HTTP_INTERNAL_SERVER_ERROR,
-                                           TALER_EC_GENERIC_DB_FETCH_FAILED,
-                                           "payment status"));
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "No session ID, do not need to lookup session-ID specific payment status (%s/%s)\n",
+                gorc->paid ? "paid" : "unpaid",
+                gorc->wired ? "wired" : "unwired");
+    gorc->phase++;
     return;
   }
+  if (! gorc->paid_session_matches)
+  {
+    gorc->paid = false;
+    gorc->wired = false;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Order %s %s for session %s (%s)\n",
+              hc->infix,
+              gorc->paid ? "paid" : "unpaid",
+              gorc->session_id,
+              gorc->wired ? "wired" : "unwired");
   gorc->phase++;
 }
 
@@ -966,9 +973,8 @@ phase_check_repurchase (struct GetOrderRequestContext *gorc)
     return;
   }
 
-  /* User did pay for this order, but under a different session; ask wallet
-       to switch order ID */
-
+  /* User did pay for this order, but under a different session; ask wallet to
+     switch order ID */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Found already paid order %s\n",
               already_paid_order_id);
@@ -1047,7 +1053,7 @@ phase_unpaid_finish (struct GetOrderRequestContext *gorc)
   {
     if (GNUNET_TIME_absolute_is_future (gorc->sc.long_poll_timeout))
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                   "Suspending GET /private/orders/%s\n",
                   hc->infix);
       GNUNET_CONTAINER_DLL_insert (gorc_head,
@@ -1058,7 +1064,7 @@ phase_unpaid_finish (struct GetOrderRequestContext *gorc)
       MHD_suspend_connection (gorc->sc.con);
       return;
     }
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Order %s claimed but not paid yet\n",
                 hc->infix);
     phase_end (gorc,
@@ -1075,7 +1081,7 @@ phase_unpaid_finish (struct GetOrderRequestContext *gorc)
   /* FIXME: too similar to logic above! */
   if (GNUNET_TIME_absolute_is_future (gorc->sc.long_poll_timeout))
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Suspending GET /private/orders/%s\n",
                 hc->infix);
     GNUNET_assert (GNUNET_NO == gorc->suspended);
diff --git a/src/backend/taler-merchant-httpd_private-get-orders.c b/src/backend/taler-merchant-httpd_private-get-orders.c
index e4f120f4..92a1f389 100644
--- a/src/backend/taler-merchant-httpd_private-get-orders.c
+++ b/src/backend/taler-merchant-httpd_private-get-orders.c
@@ -342,14 +342,12 @@ add_order (void *cls,
   {
     /* First try to find the order in the contracts */
     uint64_t os;
-    bool paid = false;
 
     qs = TMH_db->lookup_contract_terms (TMH_db->cls,
                                         po->instance_id,
                                         order_id,
                                         &contract_terms,
                                         &os,
-                                        &paid,
                                         NULL);
     if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT == qs)
       GNUNET_break (os == order_serial);
diff --git a/src/backend/taler-merchant-httpd_private-patch-orders-ID-forget.c b/src/backend/taler-merchant-httpd_private-patch-orders-ID-forget.c
index 78d2189a..cb64d607 100644
--- a/src/backend/taler-merchant-httpd_private-patch-orders-ID-forget.c
+++ b/src/backend/taler-merchant-httpd_private-patch-orders-ID-forget.c
@@ -96,7 +96,6 @@ TMH_private_patch_orders_ID_forget (const struct TMH_RequestHandler *rh,
     const json_t *fields;
     json_t *contract_terms;
     bool changed = false;
-    bool paid = false;
 
     if (GNUNET_OK !=
         TMH_db->start (TMH_db->cls,
@@ -112,7 +111,6 @@ TMH_private_patch_orders_ID_forget (const struct TMH_RequestHandler *rh,
                                         order_id,
                                         &contract_terms,
                                         &order_serial,
-                                        &paid,
                                         NULL);
     switch (qs)
     {
diff --git a/src/backend/taler-merchant-httpd_private-post-orders-ID-refund.c b/src/backend/taler-merchant-httpd_private-post-orders-ID-refund.c
index 58fa96f4..67e1410b 100644
--- a/src/backend/taler-merchant-httpd_private-post-orders-ID-refund.c
+++ b/src/backend/taler-merchant-httpd_private-post-orders-ID-refund.c
@@ -150,14 +150,12 @@ TMH_private_post_orders_ID_refund (const struct TMH_RequestHandler *rh,
     enum GNUNET_DB_QueryStatus qs;
     uint64_t order_serial;
     struct GNUNET_TIME_Timestamp refund_deadline;
-    bool paid = false;
 
     qs = TMH_db->lookup_contract_terms (TMH_db->cls,
                                         hc->instance->settings.id,
                                         hc->infix,
                                         &contract_terms,
                                         &order_serial,
-                                        &paid,
                                         NULL);
     if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs)
     {
diff --git a/src/backenddb/Makefile.am b/src/backenddb/Makefile.am
index a63a56b1..1818a877 100644
--- a/src/backenddb/Makefile.am
+++ b/src/backenddb/Makefile.am
@@ -117,6 +117,7 @@ libtaler_plugin_merchantdb_postgres_la_SOURCES = \
   pg_insert_order.h pg_insert_order.c \
   pg_unlock_inventory.h pg_unlock_inventory.c \
   pg_insert_order_lock.h pg_insert_order_lock.c \
+  pg_lookup_contract_terms3.h pg_lookup_contract_terms3.c \
   pg_lookup_contract_terms2.h pg_lookup_contract_terms2.c \
   pg_lookup_contract_terms.h pg_lookup_contract_terms.c \
   pg_insert_contract_terms.h pg_insert_contract_terms.c \
@@ -131,7 +132,6 @@ libtaler_plugin_merchantdb_postgres_la_SOURCES = \
   pg_refund_coin.h pg_refund_coin.c \
   pg_lookup_order_status.h pg_lookup_order_status.c \
   pg_lookup_order_status_by_serial.h pg_lookup_order_status_by_serial.c \
-  pg_lookup_payment_status.h pg_lookup_payment_status.c \
   pg_lookup_deposits_by_order.h pg_lookup_deposits_by_order.c \
   pg_lookup_transfer_details_by_order.h pg_lookup_transfer_details_by_order.c \
   pg_mark_order_wired.h pg_mark_order_wired.c \
diff --git a/src/backenddb/pg_lookup_contract_terms.c b/src/backenddb/pg_lookup_contract_terms.c
index e1f24ac4..9588eef4 100644
--- a/src/backenddb/pg_lookup_contract_terms.c
+++ b/src/backenddb/pg_lookup_contract_terms.c
@@ -1,6 +1,6 @@
 /*
    This file is part of TALER
-   Copyright (C) 2022 Taler Systems SA
+   Copyright (C) 2022-2024 Taler Systems SA
 
    TALER is free software; you can redistribute it and/or modify it under the
    terms of the GNU General Public License as published by the Free Software
@@ -17,6 +17,7 @@
  * @file backenddb/pg_lookup_contract_terms.c
  * @brief Implementation of the lookup_contract_terms function for Postgres
  * @author Iván Ávalos
+ * @author Christian Grothoff
  */
 #include "platform.h"
 #include <taler/taler_error_codes.h>
@@ -25,6 +26,7 @@
 #include "pg_lookup_contract_terms.h"
 #include "pg_helper.h"
 
+
 enum GNUNET_DB_QueryStatus
 TMH_PG_lookup_contract_terms (
   void *cls,
@@ -32,7 +34,6 @@ TMH_PG_lookup_contract_terms (
   const char *order_id,
   json_t **contract_terms,
   uint64_t *order_serial,
-  bool *paid,
   struct TALER_ClaimTokenP *claim_token)
 {
   struct PostgresClosure *pg = cls;
@@ -49,8 +50,6 @@ TMH_PG_lookup_contract_terms (
                                contract_terms),
     GNUNET_PQ_result_spec_uint64 ("order_serial",
                                   order_serial),
-    GNUNET_PQ_result_spec_bool ("paid",
-                                paid),
     GNUNET_PQ_result_spec_auto_from_type ("claim_token",
                                           &ct),
     GNUNET_PQ_result_spec_end
@@ -63,7 +62,6 @@ TMH_PG_lookup_contract_terms (
            " contract_terms"
            ",order_serial"
            ",claim_token"
-           ",paid"
            " FROM merchant_contract_terms"
            " WHERE order_id=$2"
            "   AND merchant_serial="
diff --git a/src/backenddb/pg_lookup_contract_terms.h b/src/backenddb/pg_lookup_contract_terms.h
index 2ab1bb16..fa757ed1 100644
--- a/src/backenddb/pg_lookup_contract_terms.h
+++ b/src/backenddb/pg_lookup_contract_terms.h
@@ -33,7 +33,6 @@
  * @param order_id order_id used to lookup.
  * @param[out] contract_terms where to store the result, NULL to only check for existence
  * @param[out] order_serial set to the order's serial number
- * @param[out] paid set to true if the order is fully paid
  * @param[out] claim_token set to token to use for access control
  * @return transaction status
  */
@@ -44,7 +43,6 @@ TMH_PG_lookup_contract_terms (
   const char *order_id,
   json_t **contract_terms,
   uint64_t *order_serial,
-  bool *paid,
   struct TALER_ClaimTokenP *claim_token);
 
 #endif
diff --git a/src/backenddb/pg_lookup_contract_terms3.c b/src/backenddb/pg_lookup_contract_terms3.c
new file mode 100644
index 00000000..ef955a51
--- /dev/null
+++ b/src/backenddb/pg_lookup_contract_terms3.c
@@ -0,0 +1,99 @@
+/*
+   This file is part of TALER
+   Copyright (C) 2022 Taler Systems SA
+
+   TALER is free software; you can redistribute it and/or modify it under the
+   terms of the GNU General Public License as published by the Free Software
+   Foundation; either version 3, or (at your option) any later version.
+
+   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License along with
+   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+ */
+/**
+ * @file backenddb/pg_lookup_contract_terms3.c
+ * @brief Implementation of the lookup_contract_terms3 function for Postgres
+ * @author Iván Ávalos
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include <taler/taler_error_codes.h>
+#include <taler/taler_dbevents.h>
+#include <taler/taler_pq_lib.h>
+#include "pg_lookup_contract_terms3.h"
+#include "pg_helper.h"
+
+
+enum GNUNET_DB_QueryStatus
+TMH_PG_lookup_contract_terms3 (
+  void *cls,
+  const char *instance_id,
+  const char *order_id,
+  const char *session_id,
+  json_t **contract_terms,
+  uint64_t *order_serial,
+  bool *paid,
+  bool *wired,
+  bool *session_matches,
+  struct TALER_ClaimTokenP *claim_token)
+{
+  struct PostgresClosure *pg = cls;
+  enum GNUNET_DB_QueryStatus qs;
+  struct TALER_ClaimTokenP ct;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_string (instance_id),
+    GNUNET_PQ_query_param_string (order_id),
+    NULL == session_id
+    ? GNUNET_PQ_query_param_null ()
+    : GNUNET_PQ_query_param_string (session_id),
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    /* contract_terms must be first! */
+    TALER_PQ_result_spec_json ("contract_terms",
+                               contract_terms),
+    GNUNET_PQ_result_spec_uint64 ("order_serial",
+                                  order_serial),
+    GNUNET_PQ_result_spec_bool ("paid",
+                                paid),
+    GNUNET_PQ_result_spec_bool ("wired",
+                                wired),
+    GNUNET_PQ_result_spec_allow_null (
+      GNUNET_PQ_result_spec_bool ("session_matches",
+                                  session_matches),
+      NULL),
+    GNUNET_PQ_result_spec_auto_from_type ("claim_token",
+                                          &ct),
+    GNUNET_PQ_result_spec_end
+  };
+
+  *session_matches = false;
+  check_connection (pg);
+  PREPARE (pg,
+           "lookup_contract_terms3",
+           "SELECT"
+           " contract_terms"
+           ",order_serial"
+           ",claim_token"
+           ",paid"
+           ",wired"
+           ",(session_id=$3) AS session_matches"
+           " FROM merchant_contract_terms"
+           " WHERE order_id=$2"
+           "   AND merchant_serial="
+           "     (SELECT merchant_serial"
+           "        FROM merchant_instances"
+           "        WHERE merchant_id=$1)");
+  qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                 "lookup_contract_terms3",
+                                                 params,
+                                                 (NULL != contract_terms)
+                                                   ? rs
+                                                   : &rs[1]);
+  if (NULL != claim_token)
+    *claim_token = ct;
+  return qs;
+}
diff --git a/src/backenddb/pg_lookup_contract_terms3.h b/src/backenddb/pg_lookup_contract_terms3.h
new file mode 100644
index 00000000..d1cc78a2
--- /dev/null
+++ b/src/backenddb/pg_lookup_contract_terms3.h
@@ -0,0 +1,56 @@
+/*
+   This file is part of TALER
+   Copyright (C) 2022 Taler Systems SA
+
+   TALER is free software; you can redistribute it and/or modify it under the
+   terms of the GNU General Public License as published by the Free Software
+   Foundation; either version 3, or (at your option) any later version.
+
+   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License along with
+   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+ */
+/**
+ * @file backenddb/pg_lookup_contract_terms3.h
+ * @brief implementation of the lookup_contract_terms3 function for Postgres
+ * @author Iván Ávalos
+ */
+#ifndef PG_LOOKUP_CONTRACT_TERMS3_H
+#define PG_LOOKUP_CONTRACT_TERMS3_H
+
+#include <taler/taler_util.h>
+#include <taler/taler_json_lib.h>
+#include "taler_merchantdb_plugin.h"
+
+/**
+ * Retrieve contract terms given its @a order_id
+ *
+ * @param cls closure
+ * @param instance_id instance's identifier
+ * @param order_id order_id used to lookup.
+ * @param session_id session_id to compare, can be NULL
+ * @param[out] contract_terms where to store the result, NULL to only check for existence
+ * @param[out] order_serial set to the order's serial number
+ * @param[out] paid set to true if the order is fully paid
+ * @param[out] wired set to true if the exchange wired the funds
+ * @param[out] session_matches set to true if @a session_id matches session stored for this contract
+   * @param[out] claim_token set to token to use for access control
+ * @return transaction status
+ */
+enum GNUNET_DB_QueryStatus
+TMH_PG_lookup_contract_terms3 (
+  void *cls,
+  const char *instance_id,
+  const char *order_id,
+  const char *session_id,
+  json_t **contract_terms,
+  uint64_t *order_serial,
+  bool *paid,
+  bool *wired,
+  bool *session_matches,
+  struct TALER_ClaimTokenP *claim_token);
+
+#endif
diff --git a/src/backenddb/pg_lookup_payment_status.c b/src/backenddb/pg_lookup_payment_status.c
deleted file mode 100644
index fc4e5d94..00000000
--- a/src/backenddb/pg_lookup_payment_status.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
-   This file is part of TALER
-   Copyright (C) 2022 Taler Systems SA
-
-   TALER is free software; you can redistribute it and/or modify it under the
-   terms of the GNU General Public License as published by the Free Software
-   Foundation; either version 3, or (at your option) any later version.
-
-   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
-   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
-   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License along with
-   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
- */
-/**
- * @file backenddb/pg_lookup_payment_status.c
- * @brief Implementation of the lookup_payment_status function for Postgres
- * @author Iván Ávalos
- */
-#include "platform.h"
-#include <taler/taler_error_codes.h>
-#include <taler/taler_dbevents.h>
-#include <taler/taler_pq_lib.h>
-#include "pg_lookup_payment_status.h"
-#include "pg_helper.h"
-
-enum GNUNET_DB_QueryStatus
-TMH_PG_lookup_payment_status (void *cls,
-                              uint64_t order_serial,
-                              const char *session_id,
-                              bool *paid,
-                              bool *wired)
-{
-  struct PostgresClosure *pg = cls;
-  uint8_t paid8;
-  uint8_t wired8;
-  enum GNUNET_DB_QueryStatus qs;
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_auto_from_type ("paid",
-                                          &paid8),
-    GNUNET_PQ_result_spec_auto_from_type ("wired",
-                                          &wired8),
-    GNUNET_PQ_result_spec_end
-  };
-  check_connection (pg);
-  if (NULL == session_id)
-  {
-    struct GNUNET_PQ_QueryParam params[] = {
-      GNUNET_PQ_query_param_uint64 (&order_serial),
-      GNUNET_PQ_query_param_end
-    };
-
-    PREPARE (pg,
-             "lookup_payment_status",
-             "SELECT"
-             " wired"
-             ",paid"
-             " FROM merchant_contract_terms"
-             " WHERE order_serial=$1");
-    qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                   "lookup_payment_status",
-                                                   params,
-                                                   rs);
-  }
-  else
-  {
-    struct GNUNET_PQ_QueryParam params[] = {
-      GNUNET_PQ_query_param_uint64 (&order_serial),
-      GNUNET_PQ_query_param_string (session_id),
-      GNUNET_PQ_query_param_end
-    };
-
-    PREPARE (pg,
-             "lookup_payment_status_session_id",
-             "SELECT"
-             " wired"
-             ",paid"
-             " FROM merchant_contract_terms"
-             " WHERE order_serial=$1"
-             "   AND session_id=$2");
-    qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
-                                                   "lookup_payment_status_session_id",
-                                                   params,
-                                                   rs);
-  }
-  if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT == qs)
-  {
-    *paid = (0 != paid8);
-    *wired = (0 != wired8);
-  }
-  else
-  {
-    *paid = false; /* just to be safe(r) */
-    *wired = false; /* just to be safe(r) */
-  }
-  return qs;
-}
diff --git a/src/backenddb/pg_lookup_payment_status.h b/src/backenddb/pg_lookup_payment_status.h
deleted file mode 100644
index a46ee31e..00000000
--- a/src/backenddb/pg_lookup_payment_status.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
-   This file is part of TALER
-   Copyright (C) 2022 Taler Systems SA
-
-   TALER is free software; you can redistribute it and/or modify it under the
-   terms of the GNU General Public License as published by the Free Software
-   Foundation; either version 3, or (at your option) any later version.
-
-   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
-   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
-   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License along with
-   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
- */
-/**
- * @file backenddb/pg_lookup_payment_status.h
- * @brief implementation of the lookup_payment_status function for Postgres
- * @author Iván Ávalos
- */
-#ifndef PG_LOOKUP_PAYMENT_STATUS_H
-#define PG_LOOKUP_PAYMENT_STATUS_H
-
-#include <taler/taler_util.h>
-#include <taler/taler_json_lib.h>
-#include "taler_merchantdb_plugin.h"
-
-/**
- * Retrieve payment and wire status for a given @a order_serial and session ID.
- *
- * @param cls closure
- * @param order_serial identifies the order
- * @param session_id session for which to check the payment status, NULL for any
- * @param[out] paid set to the payment status of the contract
- * @param[out] wired set to the wire transfer status of the exchange payment
- * @return transaction status
- */
-enum GNUNET_DB_QueryStatus
-TMH_PG_lookup_payment_status (void *cls,
-                              uint64_t order_serial,
-                              const char *session_id,
-                              bool *paid,
-                              bool *wired);
-
-#endif
diff --git a/src/backenddb/plugin_merchantdb_postgres.c b/src/backenddb/plugin_merchantdb_postgres.c
index 30f5c169..0e538ba9 100644
--- a/src/backenddb/plugin_merchantdb_postgres.c
+++ b/src/backenddb/plugin_merchantdb_postgres.c
@@ -1,6 +1,6 @@
 /*
   This file is part of TALER
-  (C) 2014--2023 Taler Systems SA
+  (C) 2014--2024 Taler Systems SA
 
   TALER is free software; you can redistribute it and/or modify it under the
   terms of the GNU Lesser General Public License as published by the Free Software
@@ -76,6 +76,7 @@
 #include "pg_insert_order.h"
 #include "pg_unlock_inventory.h"
 #include "pg_insert_order_lock.h"
+#include "pg_lookup_contract_terms3.h"
 #include "pg_lookup_contract_terms2.h"
 #include "pg_lookup_contract_terms.h"
 #include "pg_insert_contract_terms.h"
@@ -96,7 +97,6 @@
 #include "pg_refund_coin.h"
 #include "pg_lookup_order_status.h"
 #include "pg_lookup_order_status_by_serial.h"
-#include "pg_lookup_payment_status.h"
 #include "pg_lookup_deposits_by_order.h"
 #include "pg_lookup_transfer_details_by_order.h"
 #include "pg_mark_order_wired.h"
@@ -456,6 +456,8 @@ libtaler_plugin_merchantdb_postgres_init (void *cls)
     = &TMH_PG_lookup_contract_terms;
   plugin->lookup_contract_terms2
     = &TMH_PG_lookup_contract_terms2;
+  plugin->lookup_contract_terms3
+    = &TMH_PG_lookup_contract_terms3;
   plugin->insert_contract_terms
     = &TMH_PG_insert_contract_terms;
   plugin->update_contract_terms
@@ -480,8 +482,6 @@ libtaler_plugin_merchantdb_postgres_init (void *cls)
     = &TMH_PG_lookup_order_status;
   plugin->lookup_order_status_by_serial
     = &TMH_PG_lookup_order_status_by_serial;
-  plugin->lookup_payment_status
-    = &TMH_PG_lookup_payment_status;
   plugin->lookup_deposits_by_order
     = &TMH_PG_lookup_deposits_by_order;
   plugin->lookup_transfer_details_by_order
diff --git a/src/backenddb/test_merchantdb.c b/src/backenddb/test_merchantdb.c
index 3cbe0467..d85bccd3 100644
--- a/src/backenddb/test_merchantdb.c
+++ b/src/backenddb/test_merchantdb.c
@@ -1665,7 +1665,6 @@ test_lookup_contract_terms (const struct InstanceData *instance,
 {
   json_t *contract = NULL;
   uint64_t order_serial;
-  bool paid;
 
   if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
       plugin->lookup_contract_terms (plugin->cls,
@@ -1673,7 +1672,6 @@ test_lookup_contract_terms (const struct InstanceData *instance,
                                      order->id,
                                      &contract,
                                      &order_serial,
-                                     &paid,
                                      NULL))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -1843,22 +1841,36 @@ test_lookup_order_by_fulfillment (const struct InstanceData *instance,
  * @return 0 on success, 1 otherwise.
  */
 static int
-test_lookup_payment_status (uint64_t order_id,
+test_lookup_payment_status (const char *instance_id,
+                            const char *order_id,
                             const char *session_id,
                             bool expected_paid,
                             bool expected_wired)
 {
   bool paid;
   bool wired;
+  bool matches;
+  uint64_t os;
+
   TEST_COND_RET_ON_FAIL (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT ==
-                         plugin->lookup_payment_status (plugin->cls,
-                                                        order_id,
-                                                        session_id,
-                                                        &paid,
-                                                        &wired),
+                         plugin->lookup_contract_terms3 (plugin->cls,
+                                                         instance_id,
+                                                         order_id,
+                                                         session_id,
+                                                         NULL,
+                                                         &os,
+                                                         &paid,
+                                                         &wired,
+                                                         &matches,
+                                                         NULL),
                          "Lookup payment status failed\n");
-  if ((expected_paid != paid) ||
-      (expected_wired != wired))
+  if ( (NULL != session_id) && (! matches) )
+  {
+    paid = false;
+    wired = false;
+  }
+  if ( (expected_paid != paid) ||
+       (expected_wired != wired) )
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Lookup payment status failed\n");
@@ -2051,7 +2063,6 @@ run_test_orders (struct TestOrders_Closure *cls)
   {
     json_t *lookup_contract = NULL;
     uint64_t lookup_order_serial;
-    bool paid;
 
     if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS !=
         plugin->lookup_contract_terms (plugin->cls,
@@ -2059,7 +2070,6 @@ run_test_orders (struct TestOrders_Closure *cls)
                                        cls->orders[1].id,
                                        &lookup_contract,
                                        &lookup_order_serial,
-                                       &paid,
                                        NULL))
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -2098,21 +2108,11 @@ run_test_orders (struct TestOrders_Closure *cls)
     }
   }
   /* Test lookup payment status */
-  TEST_RET_ON_FAIL (test_lookup_payment_status (serial,
+  TEST_RET_ON_FAIL (test_lookup_payment_status (cls->instance.instance.id,
+                                                cls->orders[0].id,
                                                 NULL,
                                                 false,
                                                 false));
-  {
-    bool paid;
-    bool wired;
-    TEST_COND_RET_ON_FAIL (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS ==
-                           plugin->lookup_payment_status (plugin->cls,
-                                                          256,
-                                                          NULL,
-                                                          &paid,
-                                                          &wired),
-                           "Lookup payment status failed\n");
-  }
   /* Test lookup order status fails for nonexistent order */
   {
     struct TALER_PrivateContractHashP h_contract_terms;
@@ -2134,25 +2134,21 @@ run_test_orders (struct TestOrders_Closure *cls)
   TEST_RET_ON_FAIL (test_mark_contract_paid (&cls->instance,
                                              &cls->orders[0],
                                              GNUNET_DB_STATUS_SUCCESS_ONE_RESULT));
-  TEST_RET_ON_FAIL (test_lookup_payment_status (serial,
+  TEST_RET_ON_FAIL (test_lookup_payment_status (cls->instance.instance.id,
+                                                cls->orders[0].id,
                                                 NULL,
                                                 true,
                                                 false));
-  TEST_RET_ON_FAIL (test_lookup_payment_status (serial,
+  TEST_RET_ON_FAIL (test_lookup_payment_status (cls->instance.instance.id,
+                                                cls->orders[0].id,
                                                 "test_orders_session",
                                                 true,
                                                 false));
-  {
-    bool paid;
-    bool wired;
-    TEST_COND_RET_ON_FAIL (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS ==
-                           plugin->lookup_payment_status (plugin->cls,
-                                                          serial,
-                                                          "bad_session",
-                                                          &paid,
-                                                          &wired),
-                           "Lookup payment status failed\n");
-  }
+  TEST_RET_ON_FAIL (test_lookup_payment_status (cls->instance.instance.id,
+                                                cls->orders[0].id,
+                                                "bad_session",
+                                                false,
+                                                false));
   /* Test lookup order by fulfillment */
   TEST_RET_ON_FAIL (test_lookup_order_by_fulfillment (&cls->instance,
                                                       &cls->orders[0],
@@ -2187,7 +2183,8 @@ run_test_orders (struct TestOrders_Closure *cls)
   /* Test marking orders as wired */
   TEST_RET_ON_FAIL (test_mark_order_wired (serial,
                                            GNUNET_DB_STATUS_SUCCESS_ONE_RESULT));
-  TEST_RET_ON_FAIL (test_lookup_payment_status (serial,
+  TEST_RET_ON_FAIL (test_lookup_payment_status (cls->instance.instance.id,
+                                                cls->orders[0].id,
                                                 NULL,
                                                 true,
                                                 true));
@@ -4281,7 +4278,8 @@ run_test_transfers (struct TestTransfers_Closure *cls)
                                                   &cls->account,
                                                   &cls->transfers[0],
                                                   GNUNET_DB_STATUS_SUCCESS_ONE_RESULT));
-  TEST_RET_ON_FAIL (test_lookup_payment_status (order_serial,
+  TEST_RET_ON_FAIL (test_lookup_payment_status (cls->instance.instance.id,
+                                                cls->order.id,
                                                 NULL,
                                                 false,
                                                 true));
diff --git a/src/include/taler_merchantdb_plugin.h b/src/include/taler_merchantdb_plugin.h
index 27950232..7e2b748c 100644
--- a/src/include/taler_merchantdb_plugin.h
+++ b/src/include/taler_merchantdb_plugin.h
@@ -1979,21 +1979,48 @@ struct TALER_MERCHANTDB_Plugin
    *
    * @param cls closure
    * @param instance_id instance's identifier
-   * @param order_id order_id used to lookup.
+   * @param order_id order_id used to lookup
+   * @param session_id session_id to compare, can be NULL
    * @param[out] contract_terms where to store the result, NULL to only check for existence
    * @param[out] order_serial set to the order's serial number
    * @param[out] paid set to true if the order is fully paid
+   * @param[out] wired set to true if the exchange wired the funds
+   * @param[out] session_matches set to true if @a session_id matches session stored for this contract
    * @param[out] claim_token set to the claim token, NULL to only check for existence
    * @return transaction status
    */
   enum GNUNET_DB_QueryStatus
-  (*lookup_contract_terms)(
+  (*lookup_contract_terms3)(
     void *cls,
     const char *instance_id,
     const char *order_id,
+    const char *session_id,
     json_t **contract_terms,
     uint64_t *order_serial,
     bool *paid,
+    bool *wired,
+    bool *session_matches,
+    struct TALER_ClaimTokenP *claim_token);
+
+
+  /**
+   * Retrieve contract terms given its @a order_id
+   *
+   * @param cls closure
+   * @param instance_id instance's identifier
+   * @param order_id order_id used to lookup.
+   * @param[out] contract_terms where to store the result, NULL to only check for existence
+   * @param[out] order_serial set to the order's serial number
+   * @param[out] claim_token set to the claim token, NULL to only check for existence
+   * @return transaction status
+   */
+  enum GNUNET_DB_QueryStatus
+  (*lookup_contract_terms)(
+    void *cls,
+    const char *instance_id,
+    const char *order_id,
+    json_t **contract_terms,
+    uint64_t *order_serial,
     struct TALER_ClaimTokenP *claim_token);
 
 
@@ -2262,25 +2289,6 @@ struct TALER_MERCHANTDB_Plugin
 
 
   /**
-   * Retrieve payment and wire status for a given @a order_serial and
-   * session ID.
-   *
-   * @param cls closure
-   * @param order_serial identifies the order
-   * @param session_id session for which to check the payment status, NULL for any
-   * @param[out] paid set to the payment status of the contract
-   * @param[out] wired set to the wire transfer status of the exchange payment
-   * @return transaction status
-   */
-  enum GNUNET_DB_QueryStatus
-  (*lookup_payment_status)(void *cls,
-                           uint64_t order_serial,
-                           const char *session_id,
-                           bool *paid,
-                           bool *wired);
-
-
-  /**
    * Retrieve details about coins that were deposited for an order.
    *
    * @param cls closure