fix(router): added validation to check total orderDetails amount equal to amount in request

crates/router/src/core/payments/helpers.rs

@@ -3685,3 +3685,27 @@ pub async fn get_gsm_record(
         })
         .ok()
 }
+
+pub fn validate_order_details_amount(
+    order_details: Vec<api_models::payments::OrderDetailsWithAmount>,
+    amount: Option<api_models::payments::Amount>,
+) -> Result<(), errors::ApiErrorResponse> {
+    let total_order_details_amount: i64 = order_details.iter().map(|order| order.amount).sum();
+    let amount: i64 = match amount {
+        Some(value) => value.into(),
+        None => {
+            return Err(errors::ApiErrorResponse::InvalidRequestData {
+                message: "Please provide amount if order details are provided".to_string(),
+            });
+        }
+    };
+
+    if total_order_details_amount != amount {
+        Err(errors::ApiErrorResponse::InvalidRequestData {
+            message: "Total sum of order details doesn't match amount in payment request"
+                .to_string(),
+        })
+    } else {
+        Ok(())
+    }
+}

crates/router/src/core/payments/operations/payment_confirm.rs

@@ -827,6 +827,10 @@ impl<F: Send + Clone, Ctx: PaymentMethodRetrieve> ValidateRequest<F, api::Paymen
     )> {
         helpers::validate_customer_details_in_request(request)?;
 
+        if let Some(order_details) = &request.order_details {
+            helpers::validate_order_details_amount(order_details.to_owned(), request.amount)?;
+        }
+
         let request_merchant_id = request.merchant_id.as_deref();
         helpers::validate_merchant_id(&merchant_account.merchant_id, request_merchant_id)
             .change_context(errors::ApiErrorResponse::InvalidDataFormat {

crates/router/src/core/payments/operations/payment_create.rs

@@ -522,6 +522,10 @@ impl<F: Send + Clone, Ctx: PaymentMethodRetrieve> ValidateRequest<F, api::Paymen
             )?;
         }
 
+        if let Some(order_details) = &request.order_details {
+            helpers::validate_order_details_amount(order_details.to_owned(), request.amount)?;
+        }
+
         let payment_id = request.payment_id.clone().ok_or(error_stack::report!(
             errors::ApiErrorResponse::PaymentNotFound
         ))?;