rsb-entitlements 0.9.1

data/app/models/rsb/entitlements/entitlement.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module RSB
+  module Entitlements
+    class Entitlement < ApplicationRecord
+      STATUSES = %w[pending active expired revoked].freeze
+      REVOKE_REASONS = %w[refund admin chargeback non_renewal upgrade].freeze
+
+      belongs_to :entitleable, polymorphic: true
+      belongs_to :plan
+
+      validates :status, presence: true, inclusion: { in: STATUSES }
+      validates :provider, presence: true,
+                           inclusion: {
+                             in: ->(_) { RSB::Entitlements.providers.keys.map(&:to_s) },
+                             message: 'is not a registered provider'
+                           }
+      validates :revoke_reason, inclusion: { in: REVOKE_REASONS }, allow_nil: true
+
+      scope :active, -> { where(status: 'active') }
+      scope :current, -> { where(status: %w[pending active]) }
+
+      after_commit :fire_changed_callback, if: :saved_change_to_status?
+      after_commit :create_usage_counters, on: %i[create update], if: :active?
+
+      def activate!
+        update!(status: 'active', activated_at: Time.current)
+      end
+
+      def expire!
+        update!(status: 'expired')
+      end
+
+      def revoke!(reason:)
+        update!(status: 'revoked', revoked_at: Time.current, revoke_reason: reason)
+      end
+
+      def active?
+        status == 'active'
+      end
+
+      def expired?
+        status == 'expired'
+      end
+
+      def revoked?
+        status == 'revoked'
+      end
+
+      def pending?
+        status == 'pending'
+      end
+
+      private
+
+      def fire_changed_callback
+        callback = RSB::Entitlements.configuration.after_entitlement_changed
+        callback&.call(self)
+      end
+
+      def create_usage_counters
+        return unless saved_change_to_status? && status == 'active'
+
+        UsageCounterService.new.create_counters_for(self)
+      end
+    end
+  end
+end

data/app/models/rsb/entitlements/payment_request.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module RSB
+  module Entitlements
+    class PaymentRequest < ApplicationRecord
+      STATUSES = %w[pending processing approved rejected expired refunded].freeze
+      ACTIONABLE_STATUSES = %w[pending processing].freeze
+
+      belongs_to :requestable, polymorphic: true
+      belongs_to :plan
+      belongs_to :entitlement, optional: true
+
+      validates :provider_key, presence: true,
+                               inclusion: {
+                                 in: ->(_) { RSB::Entitlements.providers.keys.map(&:to_s) },
+                                 message: 'is not a registered provider'
+                               }
+      validates :status, presence: true, inclusion: { in: STATUSES }
+      validates :amount_cents, numericality: { greater_than_or_equal_to: 0 }
+      validates :currency, presence: true
+
+      scope :actionable, -> { where(status: ACTIONABLE_STATUSES) }
+      scope :for_provider, ->(key) { where(provider_key: key.to_s) }
+
+      after_commit :fire_changed_callback, if: :saved_change_to_status?
+
+      # @return [Boolean] true if status is "pending"
+      def pending?
+        status == 'pending'
+      end
+
+      # @return [Boolean] true if status is "processing"
+      def processing?
+        status == 'processing'
+      end
+
+      # @return [Boolean] true if status is "approved"
+      def approved?
+        status == 'approved'
+      end
+
+      # @return [Boolean] true if status is "rejected"
+      def rejected?
+        status == 'rejected'
+      end
+
+      # @return [Boolean] true if status is "expired"
+      def expired?
+        status == 'expired'
+      end
+
+      # @return [Boolean] true if status is "refunded"
+      def refunded?
+        status == 'refunded'
+      end
+
+      # @return [Boolean] true if status is "pending" or "processing"
+      def actionable?
+        ACTIONABLE_STATUSES.include?(status)
+      end
+
+      private
+
+      def fire_changed_callback
+        callback = RSB::Entitlements.configuration.after_payment_request_changed
+        callback&.call(self)
+      end
+    end
+  end
+end

data/app/models/rsb/entitlements/plan.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module RSB
+  module Entitlements
+    class Plan < ApplicationRecord
+      INTERVALS = %w[monthly yearly lifetime one_time].freeze
+
+      has_many :entitlements, dependent: :restrict_with_error
+      has_many :usage_counters, dependent: :restrict_with_error
+
+      validates :name, presence: true
+      validates :slug, presence: true,
+                       uniqueness: true,
+                       format: { with: /\A[a-z0-9_-]+\z/ }
+      validates :interval, presence: true, inclusion: { in: INTERVALS }
+      validates :price_cents, presence: true, numericality: { greater_than_or_equal_to: 0 }
+      validates :currency, presence: true
+
+      scope :active, -> { where(active: true) }
+
+      def free?
+        price_cents.zero?
+      end
+
+      def feature?(key)
+        features[key.to_s] == true
+      end
+
+      # Returns the integer limit value for a metric from the nested limits config.
+      #
+      # @param key [String, Symbol] The metric key (e.g., "api_calls")
+      # @return [Integer, nil] The limit value, or nil if undefined or unlimited
+      #
+      # @example
+      #   plan.limit_for("api_calls")  # => 1000
+      #   plan.limit_for(:projects)    # => 10
+      #   plan.limit_for("undefined")  # => nil
+      def limit_for(key)
+        config = limits[key.to_s]
+        return nil unless config.is_a?(Hash)
+
+        config['limit']
+      end
+
+      # Returns the period type for a metric from the nested limits config.
+      #
+      # @param key [String, Symbol] The metric key (e.g., "api_calls")
+      # @return [String, nil] The period type ("daily", "weekly", "monthly"), or nil for cumulative
+      #
+      # @example
+      #   plan.period_for("api_calls")  # => "daily"
+      #   plan.period_for(:projects)    # => nil (cumulative)
+      #   plan.period_for("undefined")  # => nil
+      def period_for(key)
+        config = limits[key.to_s]
+        return nil unless config.is_a?(Hash)
+
+        config['period']
+      end
+
+      # Returns the full limit configuration hash for a metric.
+      #
+      # @param key [String, Symbol] The metric key (e.g., "api_calls")
+      # @return [Hash, nil] The full config hash with "limit" and "period" keys, or nil if undefined
+      #
+      # @example
+      #   plan.limit_config_for("api_calls")
+      #   # => { "limit" => 1000, "period" => "daily" }
+      #
+      #   plan.limit_config_for("projects")
+      #   # => { "limit" => 10, "period" => nil }
+      #
+      #   plan.limit_config_for("undefined")
+      #   # => nil
+      def limit_config_for(key)
+        config = limits[key.to_s]
+        return nil unless config.is_a?(Hash)
+
+        config
+      end
+    end
+  end
+end

data/app/models/rsb/entitlements/usage_counter.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module RSB
+  module Entitlements
+    class UsageCounter < ApplicationRecord
+      belongs_to :countable, polymorphic: true
+      belongs_to :plan, class_name: 'RSB::Entitlements::Plan'
+
+      validates :metric, presence: true,
+                         uniqueness: { scope: %i[countable_type countable_id period_key plan_id] }
+      validates :period_key, presence: true
+      validates :current_value, numericality: { greater_than_or_equal_to: 0 }
+
+      scope :for_metric, ->(metric) { where(metric: metric.to_s) }
+      scope :for_period, ->(period_key) { where(period_key: period_key.to_s) }
+      scope :for_plan, ->(plan) { where(plan_id: plan.id) }
+      scope :cumulative, -> { where(period_key: PeriodKeyCalculator::CUMULATIVE_KEY) }
+      scope :recent, ->(n) { order(period_key: :desc).limit(n) }
+
+      # Atomically increments the counter's current_value.
+      #
+      # Uses SQL UPDATE to ensure atomicity under concurrent access.
+      # Fires the `after_usage_limit_reached` callback if the counter reaches its limit.
+      #
+      # @param amount [Integer] the amount to increment by (default: 1)
+      # @return [Integer] the new current_value after increment
+      def increment!(amount = 1)
+        self.class.where(id: id).update_all(
+          ['current_value = current_value + ?', amount]
+        )
+        reload
+        check_limit_reached
+        current_value
+      end
+
+      # Returns whether the counter has reached its limit.
+      #
+      # @return [Boolean] true if current_value >= limit, false if no limit set
+      def at_limit?
+        return false if limit.nil?
+
+        current_value >= limit
+      end
+
+      # Returns the remaining quota before the limit is reached.
+      #
+      # @return [Integer, nil] remaining count, or nil if no limit (unlimited)
+      def remaining
+        return nil if limit.nil?
+
+        [limit - current_value, 0].max
+      end
+
+      private
+
+      def check_limit_reached
+        return unless at_limit?
+
+        callback = RSB::Entitlements.configuration.after_usage_limit_reached
+        callback&.call(self)
+      end
+    end
+  end
+end

data/app/services/rsb/entitlements/usage_counter_service.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module RSB
+  module Entitlements
+    class UsageCounterService
+      # Creates usage counters for a newly activated entitlement.
+      #
+      # For each metric in the plan's limits, creates a counter with the correct
+      # period_key and limit. Uses find_or_create_by! to avoid duplicates.
+      #
+      # @param entitlement [RSB::Entitlements::Entitlement] the activated entitlement
+      # @return [void]
+      def create_counters_for(entitlement)
+        return unless entitlement.active?
+        return unless RSB::Settings.get('entitlements.auto_create_counters')
+
+        plan = entitlement.plan
+        return if plan.limits.blank?
+
+        plan.limits.each do |metric, config|
+          next unless config.is_a?(Hash)
+
+          period = config['period']
+          limit_value = config['limit']
+          period_key = PeriodKeyCalculator.current_key(period)
+
+          entitlement.entitleable.usage_counters.find_or_create_by!(
+            metric: metric.to_s,
+            period_key: period_key,
+            plan_id: plan.id
+          ) do |counter|
+            counter.limit = limit_value
+          end
+        end
+      end
+
+      # Handles usage counter transitions when an entitleable changes plans.
+      #
+      # For each metric in the new plan:
+      # - If the period type changed: creates a fresh counter (value: 0)
+      # - If the period type is the same:
+      #   - "continue" mode: carries over current_value from old counter
+      #   - "reset" mode: creates counter with value: 0
+      # - New metrics get a fresh counter
+      # - Removed metrics: old counters are left as historical records
+      #
+      # @param entitleable [Object] the entitleable record (e.g., Organization)
+      # @param old_plan [RSB::Entitlements::Plan] the previous plan
+      # @param new_plan [RSB::Entitlements::Plan] the new plan
+      # @return [void]
+      def handle_plan_change(entitleable, old_plan:, new_plan:)
+        mode = begin
+          RSB::Settings.get('entitlements.on_plan_change_usage')
+        rescue StandardError
+          'continue'
+        end
+
+        source = entitleable.respond_to?(:entitlement_source) ? entitleable.entitlement_source : entitleable
+
+        new_plan.limits.each do |metric, new_config|
+          next unless new_config.is_a?(Hash)
+
+          new_period = new_config['period']
+          new_limit = new_config['limit']
+          new_period_key = PeriodKeyCalculator.current_key(new_period)
+
+          old_config = old_plan.limit_config_for(metric)
+          old_period = old_config&.dig('period')
+
+          # Determine carry-over value
+          carry_over = 0
+          if old_config && old_period == new_period && mode == 'continue'
+            old_period_key = PeriodKeyCalculator.current_key(old_period)
+            old_counter = source.usage_counters
+                                .for_metric(metric)
+                                .for_period(old_period_key)
+                                .for_plan(old_plan)
+                                .last
+            carry_over = old_counter&.current_value || 0
+          end
+
+          counter = source.usage_counters.find_or_initialize_by(
+            metric: metric.to_s,
+            period_key: new_period_key,
+            plan_id: new_plan.id
+          )
+          counter.current_value = carry_over
+          counter.limit = new_limit
+          counter.save!
+        end
+      end
+    end
+  end
+end

data/app/views/rsb/entitlements/admin/payment_requests/index.html.erb

@@ -0,0 +1,98 @@
+<div class="flex justify-between items-center mb-6">
+  <h1 class="text-2xl font-bold">Payment Requests</h1>
+</div>
+
+<div class="bg-rsb-card border border-rsb-border rounded-rsb-lg p-4 mb-4">
+  <form method="get" action="/admin/payment_requests" class="flex flex-wrap items-end gap-4">
+    <div>
+      <label class="block text-xs font-medium text-rsb-muted mb-1">Status</label>
+      <%= select_tag :status,
+        options_for_select(
+          [["All", ""]] + RSB::Entitlements::PaymentRequest::STATUSES.map { |s| [s.titleize, s] },
+          params[:status]
+        ),
+        class: "px-3 py-1.5 border border-rsb-border rounded-rsb text-sm focus:outline-none focus:border-rsb-primary focus:ring-2 focus:ring-rsb-primary/10" %>
+    </div>
+    <div>
+      <label class="block text-xs font-medium text-rsb-muted mb-1">Provider</label>
+      <%= select_tag :provider_key,
+        options_for_select(
+          [["All", ""]] + RSB::Entitlements.providers.all.map { |d| [d.label, d.key.to_s] },
+          params[:provider_key]
+        ),
+        class: "px-3 py-1.5 border border-rsb-border rounded-rsb text-sm focus:outline-none focus:border-rsb-primary focus:ring-2 focus:ring-rsb-primary/10" %>
+    </div>
+    <div class="flex gap-2">
+      <button type="submit"
+              class="px-4 py-1.5 bg-rsb-primary text-rsb-primary-text rounded-rsb text-sm font-medium hover:bg-rsb-primary-hover">
+        Filter
+      </button>
+      <a href="/admin/payment_requests"
+         class="px-4 py-1.5 border border-rsb-border text-rsb-muted rounded-rsb text-sm hover:bg-rsb-bg">
+        Clear
+      </a>
+    </div>
+  </form>
+</div>
+
+<div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm overflow-hidden">
+  <% if @payment_requests.any? %>
+    <div class="overflow-x-auto">
+      <table class="w-full">
+        <thead>
+          <tr>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">ID</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Type</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Owner ID</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Plan</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Provider</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Status</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Amount</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Currency</th>
+            <th class="px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border">Created</th>
+            <th class="px-4 py-3 text-right text-xs font-semibold uppercase tracking-wider text-rsb-muted bg-rsb-bg border-b border-rsb-border"></th>
+          </tr>
+        </thead>
+        <tbody>
+          <% @payment_requests.each do |request| %>
+            <tr class="hover:bg-rsb-bg border-b border-rsb-border last:border-b-0">
+              <td class="px-4 py-3 text-sm">
+                <a href="/admin/payment_requests/<%= request.id %>" class="text-rsb-primary hover:underline"><%= request.id %></a>
+              </td>
+              <td class="px-4 py-3 text-sm text-rsb-muted"><%= request.requestable_type.demodulize %></td>
+              <td class="px-4 py-3 text-sm"><%= request.requestable_id %></td>
+              <td class="px-4 py-3 text-sm"><%= request.plan&.name %></td>
+              <td class="px-4 py-3 text-sm"><%= rsb_admin_badge(request.provider_key) %></td>
+              <td class="px-4 py-3 text-sm"><%= rsb_admin_badge(request.status) %></td>
+              <td class="px-4 py-3 text-sm"><%= request.amount_cents %></td>
+              <td class="px-4 py-3 text-sm"><%= request.currency.upcase %></td>
+              <td class="px-4 py-3 text-sm text-rsb-muted"><%= request.created_at&.strftime("%Y-%m-%d %H:%M") %></td>
+              <td class="px-4 py-3 text-sm text-right">
+                <a href="/admin/payment_requests/<%= request.id %>"
+                   class="inline-flex items-center gap-1 px-3 py-1.5 border border-rsb-border text-rsb-text rounded-rsb text-xs font-medium hover:bg-rsb-bg transition-colors">View</a>
+              </td>
+            </tr>
+          <% end %>
+        </tbody>
+      </table>
+    </div>
+
+    <div class="flex justify-between items-center px-4 py-3 border-t border-rsb-border">
+      <span class="text-sm text-rsb-muted">Page <%= @current_page + 1 %></span>
+      <div class="flex gap-2">
+        <% if @current_page > 0 %>
+          <a href="/admin/payment_requests?page=<%= @current_page - 1 %><%= "&status=#{params[:status]}" if params[:status].present? %><%= "&provider_key=#{params[:provider_key]}" if params[:provider_key].present? %>"
+             class="inline-flex items-center px-3 py-1.5 border border-rsb-border text-rsb-text rounded-rsb text-xs font-medium hover:bg-rsb-bg transition-colors">Previous</a>
+        <% end %>
+        <% if @payment_requests.size == @per_page %>
+          <a href="/admin/payment_requests?page=<%= @current_page + 1 %><%= "&status=#{params[:status]}" if params[:status].present? %><%= "&provider_key=#{params[:provider_key]}" if params[:provider_key].present? %>"
+             class="inline-flex items-center px-3 py-1.5 border border-rsb-border text-rsb-text rounded-rsb text-xs font-medium hover:bg-rsb-bg transition-colors">Next</a>
+        <% end %>
+      </div>
+    </div>
+  <% else %>
+    <div class="p-8 text-center">
+      <p class="text-rsb-muted text-sm">No payment requests found.</p>
+    </div>
+  <% end %>
+</div>

data/app/views/rsb/entitlements/admin/payment_requests/show.html.erb

@@ -0,0 +1,137 @@
+<div class="flex justify-between items-center mb-6">
+  <h1 class="text-2xl font-bold">Payment Request #<%= @payment_request.id %></h1>
+  <div class="flex gap-2">
+    <a href="/admin/payment_requests"
+       class="inline-flex items-center gap-1 px-4 py-2 border border-rsb-border rounded-rsb text-sm hover:bg-rsb-bg transition-colors">Back</a>
+  </div>
+</div>
+
+<%# Request Details %>
+<div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-6 mb-4">
+  <h3 class="text-base font-semibold mb-4">Request Information</h3>
+  <div class="grid grid-cols-[200px_1fr] gap-4">
+    <strong class="text-sm text-rsb-muted">ID</strong>
+    <div><%= @payment_request.id %></div>
+
+    <strong class="text-sm text-rsb-muted">Requestable</strong>
+    <div><%= @payment_request.requestable_type.demodulize %> #<%= @payment_request.requestable_id %></div>
+
+    <strong class="text-sm text-rsb-muted">Plan</strong>
+    <div><%= @payment_request.plan&.name %></div>
+
+    <strong class="text-sm text-rsb-muted">Provider</strong>
+    <div><%= rsb_admin_badge(@payment_request.provider_key) %></div>
+
+    <strong class="text-sm text-rsb-muted">Status</strong>
+    <div><%= rsb_admin_badge(@payment_request.status) %></div>
+
+    <strong class="text-sm text-rsb-muted">Amount</strong>
+    <div><%= @payment_request.amount_cents %> <%= @payment_request.currency.upcase %></div>
+
+    <% if @payment_request.provider_ref.present? %>
+      <strong class="text-sm text-rsb-muted">Provider Ref</strong>
+      <div><code class="px-1.5 py-0.5 bg-rsb-bg rounded-rsb-sm text-sm"><%= @payment_request.provider_ref %></code></div>
+    <% end %>
+
+    <strong class="text-sm text-rsb-muted">Expires At</strong>
+    <div><%= @payment_request.expires_at&.strftime("%Y-%m-%d %H:%M") || "—" %></div>
+
+    <strong class="text-sm text-rsb-muted">Created At</strong>
+    <div><%= @payment_request.created_at&.strftime("%Y-%m-%d %H:%M") %></div>
+
+    <% if @payment_request.resolved_by.present? %>
+      <strong class="text-sm text-rsb-muted">Resolved By</strong>
+      <div><%= @payment_request.resolved_by %></div>
+
+      <strong class="text-sm text-rsb-muted">Resolved At</strong>
+      <div><%= @payment_request.resolved_at&.strftime("%Y-%m-%d %H:%M") %></div>
+    <% end %>
+
+    <% if @payment_request.admin_note.present? %>
+      <strong class="text-sm text-rsb-muted">Admin Note</strong>
+      <div><%= @payment_request.admin_note %></div>
+    <% end %>
+
+    <% if @payment_request.entitlement_id.present? %>
+      <strong class="text-sm text-rsb-muted">Entitlement</strong>
+      <div>#<%= @payment_request.entitlement_id %></div>
+    <% end %>
+  </div>
+</div>
+
+<%# Provider Details %>
+<% if @provider_details.present? %>
+  <div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-6 mb-4">
+    <h3 class="text-base font-semibold mb-4">Provider Details</h3>
+    <div class="grid grid-cols-[200px_1fr] gap-4">
+      <% @provider_details.each do |label, value| %>
+        <strong class="text-sm text-rsb-muted"><%= label %></strong>
+        <div><%= value %></div>
+      <% end %>
+    </div>
+  </div>
+<% end %>
+
+<%# Provider Data JSON %>
+<% if @payment_request.provider_data.present? && @payment_request.provider_data != {} %>
+  <div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-6 mb-4">
+    <h3 class="text-base font-semibold mb-4">Provider Data</h3>
+    <pre class="p-4 bg-rsb-bg rounded-rsb text-sm overflow-x-auto"><%= JSON.pretty_generate(@payment_request.provider_data) %></pre>
+  </div>
+<% end %>
+
+<%# Metadata JSON %>
+<% if @payment_request.metadata.present? && @payment_request.metadata != {} %>
+  <div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-6 mb-4">
+    <h3 class="text-base font-semibold mb-4">Metadata</h3>
+    <pre class="p-4 bg-rsb-bg rounded-rsb text-sm overflow-x-auto"><%= JSON.pretty_generate(@payment_request.metadata) %></pre>
+  </div>
+<% end %>
+
+<%# Action Buttons — Approve / Reject %>
+<% if @payment_request.actionable? && @provider_definition&.manual_resolution %>
+  <div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-6 mb-4">
+    <h3 class="text-base font-semibold mb-4">Actions</h3>
+    <div class="flex flex-wrap items-end gap-4">
+      <% if @provider_definition.admin_actions.include?(:approve) %>
+        <%= form_tag("/admin/payment_requests/#{@payment_request.id}/approve", method: :patch, class: "inline") do %>
+          <button type="submit"
+                  data-turbo-confirm="Approve this payment request?"
+                  class="px-4 py-2 bg-rsb-success text-white rounded-rsb text-sm font-medium hover:opacity-90 transition-colors">
+            Approve
+          </button>
+        <% end %>
+      <% end %>
+
+      <% if @provider_definition.admin_actions.include?(:reject) %>
+        <%= form_tag("/admin/payment_requests/#{@payment_request.id}/reject", method: :patch, class: "inline-flex items-end gap-2") do %>
+          <div>
+            <label class="block text-xs font-medium text-rsb-muted mb-1">Note</label>
+            <%= text_field_tag :admin_note, "",
+              placeholder: "Optional note",
+              class: "px-3 py-1.5 border border-rsb-border rounded-rsb text-sm focus:outline-none focus:border-rsb-primary focus:ring-2 focus:ring-rsb-primary/10" %>
+          </div>
+          <button type="submit"
+                  data-turbo-confirm="Reject this payment request?"
+                  class="px-4 py-2 bg-rsb-danger text-white rounded-rsb text-sm font-medium hover:opacity-90 transition-colors">
+            Reject
+          </button>
+        <% end %>
+      <% end %>
+    </div>
+  </div>
+<% end %>
+
+<%# Refund Button %>
+<% if @payment_request.approved? && @provider_definition&.refundable %>
+  <div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-6">
+    <h3 class="text-base font-semibold text-rsb-danger mb-4">Danger Zone</h3>
+    <%= form_tag("/admin/payment_requests/#{@payment_request.id}/refund", method: :patch) do %>
+      <button type="submit"
+              data-turbo-confirm="Refund this payment request? This will revoke the linked entitlement."
+              class="px-4 py-2 bg-rsb-danger text-white rounded-rsb text-sm font-medium hover:opacity-90 transition-colors">
+        Refund
+      </button>
+    <% end %>
+  </div>
+<% end %>