Language: Python
Label: safe
CWE: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Code:
def payment_gateway_notification_event(
    *, order: Order, user: UserType, message: str, payment: Payment
) -> OrderEvent:
    if not _user_is_valid(user):
        user = None
    parameters = {"message": message}

    if payment:
        parameters.update({"gateway": payment.gateway, "payment_id": payment.token})

    return OrderEvent.objects.create(
        order=order,
        type=OrderEvents.PAYMENT_GATEWAY_NOTIFICATION,
        user=user,
        parameters=parameters,
    )