Extract stock-check logic to controller concern and inject prior to final Paypal payment confirmation.

app/controllers/checkout_controller.rb

@@ -5,6 +5,7 @@ require 'open_food_network/address_finder'
 class CheckoutController < Spree::StoreController
   layout 'darkswarm'
 
+  include OrderStockCheck
   include CheckoutHelper
   include OrderCyclesHelper
   include EnterprisesHelper
@@ -77,13 +78,6 @@ class CheckoutController < Spree::StoreController
     redirect_to main_app.cart_path if @order.completed?
   end
 
-  def ensure_sufficient_stock_lines
-    if @order.insufficient_stock_lines.present?
-      flash[:error] = Spree.t(:inventory_error_flash_for_insufficient_quantity)
-      redirect_to main_app.cart_path
-    end
-  end
-
   def load_order
     @order = current_order
 

app/controllers/concerns/order_stock_check.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module OrderStockCheck
+  extend ActiveSupport::Concern
+
+  def ensure_sufficient_stock_lines
+    if @order.insufficient_stock_lines.present?
+      flash[:error] = Spree.t(:inventory_error_flash_for_insufficient_quantity)
+      redirect_to main_app.cart_path
+    end
+  end
+end

app/controllers/spree/paypal_controller_decorator.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 Spree::PaypalController.class_eval do
+  include OrderStockCheck
+
   before_action :enable_embedded_shopfront
   before_action :destroy_orphaned_paypal_payments, only: :confirm
   after_action :reset_order_when_complete, only: :confirm
@@ -55,23 +57,26 @@ Spree::PaypalController.class_eval do
   end
 
   def confirm
-    order = current_order || raise(ActiveRecord::RecordNotFound)
-    order.payments.create!({
+    @order = current_order || raise(ActiveRecord::RecordNotFound)
+    # At this point the user has come back from the Paypal form, and we get one
+    # last chance to interact with the payment process before the money moves...
+    ensure_sufficient_stock_lines
+    @order.payments.create!({
       source: Spree::PaypalExpressCheckout.create({
         token: params[:token],
         payer_id: params[:PayerID]
       }),
-      amount: order.total,
+      amount: @order.total,
       payment_method: payment_method
     })
-    order.next
-    if order.complete?
+    @order.next
+    if @order.complete?
       flash.notice = Spree.t(:order_processed_successfully)
       flash[:commerce_tracking] = "nothing special"
       session[:order_id] = nil
-      redirect_to completion_route(order)
+      redirect_to completion_route(@order)
     else
-      redirect_to checkout_state_path(order.state)
+      redirect_to checkout_state_path(@order.state)
     end
   end