@easypayment/medusa-payment-paypal 0.9.14 → 0.9.16

package/src/api/store/paypal-complete/route.ts

@@ -1,10 +1,13 @@
 import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
-import type { IPaymentModuleService } from "@medusajs/framework/types"
-import { Modules } from "@medusajs/framework/utils"
+import type { IPaymentModuleService, Logger } from "@medusajs/framework/types"
+import { ContainerRegistrationKeys, Modules } from "@medusajs/framework/utils"
 import { completeCartWorkflow } from "@medusajs/core-flows"
-import type PayPalModuleService from "../../../modules/paypal/service"
+import { randomUUID } from "crypto"
+import { isPayPalProviderId } from "../../../modules/paypal/utils/provider-ids"
 
 export async function POST(req: MedusaRequest, res: MedusaResponse) {
+  const logger = req.scope.resolve<Logger>(ContainerRegistrationKeys.LOGGER)
+  const requestId = randomUUID()
   const { cart_id } = req.body as { cart_id: string }
 
   if (!cart_id || typeof cart_id !== "string") {
@@ -40,7 +43,7 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
 
     const sessions = cart?.payment_collection?.payment_sessions || []
     const session = sessions
-      .filter((s: any) => String(s.provider_id || "").includes("paypal"))
+      .filter((s: any) => isPayPalProviderId(s.provider_id))
       .sort(
         (a: any, b: any) =>
           new Date(b.created_at || 0).getTime() - new Date(a.created_at || 0).getTime()
@@ -52,46 +55,27 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
 
     const paymentModule = req.scope.resolve(Modules.PAYMENT) as IPaymentModuleService
 
-    const [liveSession] = await paymentModule.listPaymentSessions(
-      { id: [session.id] },
-      { take: 1 }
-    )
-
-    const liveData = (liveSession?.data || {}) as Record<string, any>
-
-    const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
-    const settings = await paypal.getSettings().catch(() => ({}))
-    const settingsData =
-      settings && typeof settings === "object" && "data" in settings
-        ? ((settings as { data?: Record<string, any> }).data ?? {})
-        : {}
-    const additionalSettings = (settingsData.additional_settings || {}) as Record<string, any>
-    const paymentAction =
-      typeof additionalSettings.paymentAction === "string"
-        ? additionalSettings.paymentAction
-        : "capture"
-
-    const timestampKey = paymentAction === "authorize" ? "authorized_at" : "captured_at"
-
-    if (!liveData[timestampKey]) {
-      await (paymentModule as any).updatePaymentSession({
-        id: session.id,
-        data: {
-          ...liveData,
-          [timestampKey]: new Date().toISOString(),
-        },
-        amount: liveSession?.amount ?? session.amount,
-        currency_code: liveSession?.currency_code ?? session.currency_code,
-      })
-    }
+    // Do NOT fabricate captured_at/authorized_at here. The authoritative
+    // timestamp and status are set by the provider's authorizePayment (invoked
+    // via authorizePaymentSession below) only after it verifies the capture /
+    // authorization against PayPal. Stamping it ourselves would mark an unpaid
+    // session as paid.
 
     const currentStatus = String(session.status || "")
     if (currentStatus !== "authorized") {
       try {
         await (paymentModule as any).authorizePaymentSession(session.id, {})
-        console.info("[paypal-complete] authorizePaymentSession succeeded for session", session.id)
+        logger.info(
+          `[paypal] paypal-complete authorizePaymentSession succeeded (request_id=${requestId}, session_id=${session.id})`
+        )
       } catch (e: any) {
-        console.warn("[paypal-complete] authorizePaymentSession non-fatal:", e?.message)
+        // Authorization is the gate for completion; if it fails, the
+        // completeCartWorkflow below fails too and we report that honestly.
+        logger.warn(
+          `[paypal] paypal-complete authorizePaymentSession failed (request_id=${requestId}, session_id=${session.id}): ${
+            e?.message ?? String(e)
+          }`
+        )
       }
     }
 
@@ -99,14 +83,44 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
       const { result } = await completeCartWorkflow(req.scope).run({
         input: { id: cart_id },
       })
-      console.info("[paypal-complete] cart completed, order:", result?.id)
-      return res.json({ success: true, cart_id, order_id: result?.id })
+      logger.info(
+        `[paypal] paypal-complete cart completed (request_id=${requestId}, cart_id=${cart_id}, order_id=${result?.id})`
+      )
+      return res.json({ success: true, cart_id, order_id: result?.id, request_id: requestId })
     } catch (e: any) {
-      console.warn("[paypal-complete] completeCartWorkflow failed:", e?.message)
-      return res.json({ success: true, session_id: session.id })
+      // The cart may have been completed by a concurrent request between our
+      // initial check and now — treat that as success, not an error.
+      const recheck = await query
+        .graph({ entity: "cart", fields: ["id", "completed_at"], filters: { id: cart_id } })
+        .catch(() => ({ data: [] as any[] }))
+      if (recheck?.data?.[0]?.completed_at) {
+        return res.json({ success: true, cart_id, already_completed: true, request_id: requestId })
+      }
+
+      logger.error(
+        `[paypal] paypal-complete completeCartWorkflow failed (request_id=${requestId}, cart_id=${cart_id}): ${
+          e?.message ?? String(e)
+        }`,
+        e instanceof Error ? e : undefined
+      )
+      // The payment may have been captured at PayPal but the order was not
+      // finalized. Report failure (not a false success) so the storefront can
+      // surface a "payment taken, contact support" state.
+      return res.status(500).json({
+        success: false,
+        cart_id,
+        session_id: session.id,
+        message: "Payment was processed but the order could not be finalized.",
+        request_id: requestId,
+      })
     }
   } catch (e: any) {
-    console.error("[paypal-complete] error:", e?.message || e)
-    return res.status(500).json({ message: "Internal error" })
+    logger.error(
+      `[paypal] paypal-complete failed (request_id=${requestId}, cart_id=${cart_id}): ${
+        e?.message ?? String(e)
+      }`,
+      e instanceof Error ? e : undefined
+    )
+    return res.status(500).json({ message: "Internal error", request_id: requestId })
   }
 }

package/src/jobs/paypal-webhook-retry.ts

@@ -1,4 +1,5 @@
 import type { MedusaContainer } from "@medusajs/framework/types"
+import { ContainerRegistrationKeys } from "@medusajs/framework/utils"
 import type PayPalModuleService from "../modules/paypal/service"
 import {
   computeNextRetryAt,
@@ -8,11 +9,60 @@ import {
   processPayPalWebhookEvent,
 } from "../modules/paypal/webhook-processor"
 
+// Bound how many failed events one run drains so the cron can't load an
+// unbounded backlog into memory.
+const RETRY_BATCH_SIZE = 100
+
+// Stable key for the Postgres advisory lock that serializes this cron across
+// instances. pg_try_advisory_xact_lock auto-releases at transaction end, so
+// there is no unlock to pair (and no risk of a leaked lock).
+const RETRY_ADVISORY_LOCK_KEY = 838907812
+
 export default async function paypalWebhookRetry(container: MedusaContainer) {
+  // Run the sweep under a Postgres advisory lock so that with multiple server
+  // instances running this cron, only one drains the queue per cycle (each
+  // event is processed at most once). Falls back to running directly if the
+  // raw connection isn't resolvable, so the job degrades gracefully rather
+  // than breaking.
+  let pg: any = null
+  try {
+    pg = container.resolve(ContainerRegistrationKeys.PG_CONNECTION)
+  } catch {
+    pg = null
+  }
+
+  if (!pg?.transaction) {
+    await runRetrySweep(container)
+    return
+  }
+
+  try {
+    await pg.transaction(async (trx: any) => {
+      const res = await trx.raw(
+        "SELECT pg_try_advisory_xact_lock(?) AS locked",
+        [RETRY_ADVISORY_LOCK_KEY]
+      )
+      const locked = res?.rows?.[0]?.locked ?? res?.[0]?.locked ?? false
+      if (!locked) {
+        console.info("[PayPal] webhook-retry: another instance holds the lock, skipping")
+        return
+      }
+      await runRetrySweep(container)
+    })
+  } catch (e: any) {
+    console.warn("[PayPal] webhook-retry: advisory lock path failed, running unlocked:", e?.message)
+    await runRetrySweep(container)
+  }
+}
+
+async function runRetrySweep(container: MedusaContainer) {
   const paypal = container.resolve<PayPalModuleService>("paypal_onboarding")
   const now = Date.now()
 
-  const candidates = await paypal.listPayPalWebhookEvents({ status: "failed" })
+  const candidates = await paypal.listPayPalWebhookEvents(
+    { status: "failed" },
+    { take: RETRY_BATCH_SIZE, order: { next_retry_at: "ASC" } }
+  )
   if (!candidates?.length) return
 
   console.info(

package/src/modules/paypal/clients/paypal-seller.client.ts

@@ -1,3 +1,5 @@
+import { paypalFetch } from "../utils/paypal-fetch"
+
 export class PayPalSellerClient {
   private static readonly BN_CODE = "MBJTechnolabs_SI_SPB"
 
@@ -19,7 +21,7 @@ export class PayPalSellerClient {
   }
 
   async createOrder(body: any) {
-    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders`, {
+    const res = await paypalFetch(`${this.baseUrl()}/v2/checkout/orders`, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify(body),
@@ -30,7 +32,7 @@ export class PayPalSellerClient {
   }
 
   async getOrder(orderId: string) {
-    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
+    const res = await paypalFetch(`${this.baseUrl()}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
       method: "GET",
       headers: this.headers(),
     })
@@ -40,7 +42,7 @@ export class PayPalSellerClient {
   }
 
   async captureOrder(orderId: string) {
-    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`, {
+    const res = await paypalFetch(`${this.baseUrl()}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`, {
       method: "POST",
       headers: this.headers(),
     })
@@ -50,7 +52,7 @@ export class PayPalSellerClient {
   }
 
   async refundCapture(captureId: string, body?: any) {
-    const res = await fetch(`${this.baseUrl()}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
+    const res = await paypalFetch(`${this.baseUrl()}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
       method: "POST",
       headers: this.headers(),
       body: body ? JSON.stringify(body) : "{}",

package/src/modules/paypal/payment-provider/card-service.ts

@@ -26,6 +26,7 @@ import type {
 } from "@medusajs/framework/types"
 import { getPayPalWebhookActionAndData } from "./webhook-utils"
 import { formatAmountForPayPal } from "../utils/amounts"
+import { paypalFetch } from "../utils/paypal-fetch"
 import {
   assertPayPalCurrencySupported,
   normalizeCurrencyCode,
@@ -110,7 +111,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
 
   private async getOrderDetails(orderId: string) {
     const { accessToken, base } = await this.getPayPalAccessToken()
-    const resp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
+    const resp = await paypalFetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -350,7 +351,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
           : {}),
       }
 
-      const ppResp = await fetch(`${base}/v2/checkout/orders`, {
+      const ppResp = await paypalFetch(`${base}/v2/checkout/orders`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -404,7 +405,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
         },
       }
     } else {
-      const authorizeResp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`, {
+      const authorizeResp = await paypalFetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -495,7 +496,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
       order?.intent || paypalData.order?.intent || data.intent || ""
     ).toUpperCase()
     if (!authorizationId && resolvedIntent === "AUTHORIZE") {
-      const authorizeResp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`, {
+      const authorizeResp = await paypalFetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -544,7 +545,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
       ? `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/capture`
       : `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`
 
-    const ppResp = await fetch(captureUrl, {
+    const ppResp = await paypalFetch(captureUrl, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -611,7 +612,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
       const { accessToken, base } = await this.getPayPalAccessToken()
       const requestId = this.getIdempotencyKey(_input, `void-${authorizationId}`)
 
-      const resp = await fetch(
+      const resp = await paypalFetch(
         `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/void`,
         {
           method: "POST",
@@ -635,9 +636,9 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
       }
     } else if (captureId) {
       const { accessToken, base } = await this.getPayPalAccessToken()
-      const requestId = this.getIdempotencyKey(_input, `refund-${captureId}`)
+      const requestId = this.getIdempotencyKey(_input, `cancel-refund-${captureId}`)
 
-      const resp = await fetch(
+      const resp = await paypalFetch(
         `${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`,
         {
           method: "POST",
@@ -710,7 +711,9 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
     }
 
     const requestId = this.getIdempotencyKey(_input, `refund-${captureId}`)
-    const amount = Number(data.amount ?? 0)
+    // Use the refund amount Medusa passes (top-level input), not the session
+    // amount in `data` — otherwise a partial refund would refund the full order.
+    const amount = Number(_input.amount ?? 0)
     const currencyOverride = await this.resolveCurrencyOverride()
     const currencyCode = normalizeCurrencyCode(
       data.currency_code || currencyOverride || "EUR"
@@ -726,7 +729,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
           }
         : {}
 
-    const resp = await fetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
+    const resp = await paypalFetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,

package/src/modules/paypal/payment-provider/service.ts

@@ -31,6 +31,7 @@ import {
 } from "../utils/currencies"
 import type PayPalModuleService from "../service"
 import { getPayPalWebhookActionAndData } from "./webhook-utils"
+import { paypalFetch } from "../utils/paypal-fetch"
 
 type Options = {}
 
@@ -110,7 +111,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
 
   private async getOrderDetails(orderId: string) {
     const { accessToken, base } = await this.getPayPalAccessToken()
-    const resp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
+    const resp = await paypalFetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -395,7 +396,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
           data.session_id || data.cart_id || data.payment_collection_id || undefined,
       }
 
-      const ppResp = await fetch(`${base}/v2/checkout/orders`, {
+      const ppResp = await paypalFetch(`${base}/v2/checkout/orders`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -430,7 +431,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
       if (existingAuthorization) {
         authorization = order
       } else {
-        const authorizeResp = await fetch(
+        const authorizeResp = await paypalFetch(
           `${base}/v2/checkout/orders/${encodeURIComponent(newOrderId)}/authorize`,
           {
             method: "POST",
@@ -613,7 +614,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
       ).toUpperCase()
 
       if (!authorizationId && resolvedIntent === "AUTHORIZE") {
-        const authorizeResp = await fetch(
+        const authorizeResp = await paypalFetch(
           `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`,
           {
             method: "POST",
@@ -668,7 +669,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         ? `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/capture`
         : `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`
 
-      const ppResp = await fetch(captureUrl, {
+      const ppResp = await paypalFetch(captureUrl, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -781,7 +782,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         refundPayload.note_to_payer = refundReason
       }
 
-      const ppResp = await fetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
+      const ppResp = await paypalFetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -871,7 +872,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         const { accessToken, base } = await this.getPayPalAccessToken()
         const requestId = this.getIdempotencyKey(input, `void-${authorizationId}`)
 
-        const resp = await fetch(
+        const resp = await paypalFetch(
           `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/void`,
           {
             method: "POST",
@@ -901,9 +902,9 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         })
       } else if (captureId) {
         const { accessToken, base } = await this.getPayPalAccessToken()
-        const requestId = this.getIdempotencyKey(input, `refund-${captureId}`)
+        const requestId = this.getIdempotencyKey(input, `cancel-refund-${captureId}`)
 
-        const resp = await fetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
+        const resp = await paypalFetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
           method: "POST",
           headers: {
             Authorization: `Bearer ${accessToken}`,

package/src/modules/paypal/payment-provider/webhook-utils.ts

@@ -66,6 +66,18 @@ function resolveEventType(payload: ProviderWebhookPayload["payload"]) {
   return raw?.event_type || raw?.eventType
 }
 
+/**
+ * Maps a PayPal webhook payload to the generic Medusa payment-provider webhook
+ * result (the `getWebhookActionAndData` hook on AbstractPaymentProvider).
+ *
+ * NOTE: the authoritative webhook handling for this plugin is the dedicated
+ * `/store/paypal/webhook` route (signature verification, replay window,
+ * dedup, dead-letter retry). This helper exists only for the framework's
+ * generic `/hooks/payment/:provider` path. The `session_id` returned here is
+ * derived from the PayPal resource `custom_id`, which this plugin sets to the
+ * cart id (see create-order) — so consumers must resolve the cart, not treat
+ * it as a payment-session id directly.
+ */
 export function getPayPalWebhookActionAndData(
   payload: ProviderWebhookPayload["payload"]
 ): WebhookActionResult {