@easypayment/medusa-payment-paypal 0.9.15 → 0.9.16

package/src/modules/paypal/utils/secret-crypto.ts

@@ -0,0 +1,94 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto"
+
+/**
+ * Opt-in encryption-at-rest for PayPal secrets (client secret, app access
+ * token).
+ *
+ * Activated only when `PAYPAL_ENCRYPTION_KEY` is set. When it is unset (the
+ * default), both functions are the identity — behavior is byte-for-byte
+ * unchanged, so existing deployments are unaffected.
+ *
+ * Format: `enc:v1:<iv_b64>:<tag_b64>:<ciphertext_b64>` using AES-256-GCM
+ * (authenticated, so tampering is detected on decrypt). Legacy plaintext values
+ * (no prefix) are returned as-is on decrypt, so secrets stored before
+ * encryption was enabled keep working and are upgraded on the next save.
+ */
+const PREFIX = "enc:v1:"
+
+let cachedRaw: string | undefined
+let cachedKey: Buffer | null = null
+
+/**
+ * `@types/node` 22.0-22.6 typed `Buffer` as `Buffer<ArrayBufferLike>`, which is
+ * rejected where the `crypto` APIs and `Buffer.concat` expect a plain
+ * `Uint8Array` (the regression was fixed in 22.8). Narrowing each byte view to
+ * `Uint8Array` at the call boundary sidesteps it without changing runtime
+ * behavior, and stays valid on every other `@types/node` / TypeScript version.
+ */
+const bytes = (view: Buffer): Uint8Array => view as unknown as Uint8Array
+
+function getKey(): Buffer | null {
+  const raw = (process.env.PAYPAL_ENCRYPTION_KEY || "").trim()
+  if (raw !== cachedRaw) {
+    cachedRaw = raw
+    // Accept a key of any length/format; derive a stable 32-byte AES key.
+    cachedKey = raw ? createHash("sha256").update(raw).digest() : null
+  }
+  return cachedKey
+}
+
+export function isSecretEncryptionEnabled(): boolean {
+  return getKey() !== null
+}
+
+export function isEncrypted(value: unknown): boolean {
+  return typeof value === "string" && value.startsWith(PREFIX)
+}
+
+/**
+ * Encrypt a secret for storage. Returns the input unchanged when no key is
+ * configured or when the value is empty/already encrypted.
+ */
+export function encryptSecret<T extends string | null | undefined>(value: T): T | string {
+  if (!value) {
+    return value
+  }
+  const key = getKey()
+  if (!key || isEncrypted(value)) {
+    return value
+  }
+  const iv = randomBytes(12)
+  const cipher = createCipheriv("aes-256-gcm", bytes(key), bytes(iv))
+  const ciphertext = Buffer.concat([bytes(cipher.update(String(value), "utf8")), bytes(cipher.final())])
+  const tag = cipher.getAuthTag()
+  return `${PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ciphertext.toString("base64")}`
+}
+
+/**
+ * Decrypt a stored secret. Returns non-encrypted (legacy plaintext) values
+ * unchanged. Throws if the value is encrypted but no key is configured, or if
+ * authentication fails (wrong key / tampering).
+ */
+export function decryptSecret<T extends string | null | undefined>(value: T): T | string {
+  if (!value || !isEncrypted(value)) {
+    return value
+  }
+  const key = getKey()
+  if (!key) {
+    throw new Error(
+      "PayPal secret is encrypted but PAYPAL_ENCRYPTION_KEY is not set. Restore the key to decrypt stored credentials."
+    )
+  }
+  const body = String(value).slice(PREFIX.length)
+  const [ivB64, tagB64, ctB64] = body.split(":")
+  if (!ivB64 || !tagB64 || !ctB64) {
+    throw new Error("PayPal secret ciphertext is malformed.")
+  }
+  const decipher = createDecipheriv("aes-256-gcm", bytes(key), bytes(Buffer.from(ivB64, "base64")))
+  decipher.setAuthTag(bytes(Buffer.from(tagB64, "base64")))
+  const plaintext = Buffer.concat([
+    bytes(decipher.update(bytes(Buffer.from(ctB64, "base64")))),
+    bytes(decipher.final()),
+  ])
+  return plaintext.toString("utf8")
+}

package/src/modules/paypal/webhook-processor.ts

@@ -1,6 +1,6 @@
 import type { MedusaContainer } from "@medusajs/framework/types"
 import { Modules } from "@medusajs/framework/utils"
-import { isPayPalProviderId } from "./utils/provider-ids"
+import { isPayPalProviderId, PAYPAL_PROVIDER_IDS } from "./utils/provider-ids"
 
 
 export const EVENT_STATUS_MAP: Record<
@@ -143,7 +143,10 @@ export function extractIdentifiers(
     refundId = String(resource?.id || "").trim() || null
     orderId = String(related?.order_id || "").trim() || null
     captureId = String(related?.capture_id || "").trim() || null
-    cartId = null
+    // The refund resource carries the capture's custom_id (the cart id) when it
+    // was set on the purchase unit — use it so refunds resolve directly instead
+    // of always falling back to a session scan.
+    cartId = String(resource?.custom_id || "").trim() || null
   }
 
   return { orderId, captureId, refundId, cartId }
@@ -294,21 +297,35 @@ export async function processPayPalWebhookEvent(
 
   let cartId = rawCartId
 
-  if (!cartId) {
+  if (!cartId && (orderId || captureId)) {
     try {
       const paymentModule = container.resolve(Modules.PAYMENT) as any
-      const allSessions = await paymentModule.listPaymentSessions(
-        {
-          provider_id: ["pp_paypal_paypal", "pp_paypal_card_paypal_card"],
-        },
-        { take: 200 }
-      )
-      const matchedSession = (allSessions || []).find((s: Record<string, unknown>) => {
-        const pp = ((s.data || {}) as Record<string, unknown>).paypal as Record<string, unknown> || {}
-        if (orderId && pp.order_id === orderId) return true
-        if (captureId && pp.capture_id === captureId) return true
-        return false
-      })
+      // Fallback when the webhook resource carries no custom_id: locate the
+      // PayPal session whose stored data matches this order_id / capture_id.
+      // Paginate to exhaustion rather than scanning a single fixed page — on a
+      // busy store the matching session is frequently beyond the first page, so
+      // a hard cap would silently drop capture/refund status updates.
+      const PAGE_SIZE = 200
+      const MAX_PAGES = 100 // safety bound (20k sessions) against a misbehaving driver
+      let matchedSession: Record<string, unknown> | null = null
+
+      for (let page = 0; page < MAX_PAGES && !matchedSession; page++) {
+        const sessions = await paymentModule.listPaymentSessions(
+          { provider_id: [...PAYPAL_PROVIDER_IDS] },
+          { take: PAGE_SIZE, skip: page * PAGE_SIZE }
+        )
+        if (!sessions || sessions.length === 0) break
+        matchedSession =
+          sessions.find((s: Record<string, unknown>) => {
+            const pp =
+              (((s.data || {}) as Record<string, unknown>).paypal as Record<string, unknown>) || {}
+            if (orderId && pp.order_id === orderId) return true
+            if (captureId && pp.capture_id === captureId) return true
+            return false
+          }) || null
+        if (sessions.length < PAGE_SIZE) break
+      }
+
       if (matchedSession?.payment_collection_id) {
         const colls = await paymentModule.listPaymentCollections(
           { id: [matchedSession.payment_collection_id] },

package/src/subscribers/paypal-order-invoice.ts

@@ -1,6 +1,7 @@
 import type { SubscriberArgs, SubscriberConfig } from "@medusajs/framework"
 import type PayPalModuleService from "../modules/paypal/service"
-import { getPayPalAccessToken } from "../modules/paypal/utils/paypal-auth"
+import { getPayPalApiBase } from "../modules/paypal/utils/paypal-auth"
+import { paypalFetch } from "../modules/paypal/utils/paypal-fetch"
 import { isPayPalProviderId } from "../modules/paypal/utils/provider-ids"
 
 const PATCHABLE_STATUSES = new Set(["CREATED", "APPROVED", "SAVED"])
@@ -83,12 +84,13 @@ export default async function paypalOrderInvoiceHandler({
     if (!invoiceId) return
 
     const creds = await paypal.getActiveCredentials()
-    const { accessToken, base } = await getPayPalAccessToken(creds)
+    const base = getPayPalApiBase(creds.environment)
+    const accessToken = await paypal.getAppAccessToken()
 
     let paypalOrderStatus = ""
     let currentInvoiceId = ""
     try {
-      const statusResp = await fetch(
+      const statusResp = await paypalFetch(
         `${base}/v2/checkout/orders/${encodeURIComponent(paypalOrderId)}`,
         { headers: { Authorization: `Bearer ${accessToken}` } }
       )
@@ -128,7 +130,7 @@ export default async function paypalOrderInvoiceHandler({
       return
     }
 
-    const patchResp = await fetch(
+    const patchResp = await paypalFetch(
       `${base}/v2/checkout/orders/${encodeURIComponent(paypalOrderId)}`,
       {
         method: "PATCH",