@easypayment/medusa-payment-paypal 0.9.16 → 0.9.18

package/.medusa/server/src/modules/paypal/utils/payment-session.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findPayPalSessionForCart = findPayPalSessionForCart;
+exports.getStoredPayPalOrderId = getStoredPayPalOrderId;
+exports.updatePayPalSessionData = updatePayPalSessionData;
+const utils_1 = require("@medusajs/framework/utils");
+const provider_ids_1 = require("./provider-ids");
+/**
+ * Resolve the cart's active PayPal payment session (wallet or card). When a
+ * cart has more than one PayPal session, the most recently created one wins —
+ * both create-order and capture-order rely on this same selection so they
+ * always read and write the same session.
+ */
+async function findPayPalSessionForCart(cartId, scope) {
+    try {
+        const query = scope.resolve("query");
+        const { data: carts } = await query.graph({
+            entity: "cart",
+            fields: [
+                "id",
+                "payment_collection.payment_sessions.id",
+                "payment_collection.payment_sessions.data",
+                "payment_collection.payment_sessions.status",
+                "payment_collection.payment_sessions.provider_id",
+                "payment_collection.payment_sessions.created_at",
+            ],
+            filters: { id: cartId },
+        });
+        const cart = carts?.[0];
+        const sessions = cart?.payment_collection?.payment_sessions || [];
+        const session = sessions
+            .filter((s) => (0, provider_ids_1.isPayPalProviderId)(s.provider_id))
+            .sort((a, b) => new Date(b.created_at || 0).getTime() - new Date(a.created_at || 0).getTime())[0];
+        if (!session)
+            return null;
+        return {
+            session_id: session.id,
+            session_data: (session.data || {}),
+            session_status: session.status,
+        };
+    }
+    catch (e) {
+        console.warn("[PayPal] findPayPalSessionForCart failed:", e?.message);
+        return null;
+    }
+}
+/**
+ * Read the PayPal order id stored on a session's `data`. Accepts both the
+ * canonical `data.paypal.order_id` and the legacy top-level `data.order_id`.
+ * Returns null when none is present.
+ */
+function getStoredPayPalOrderId(sessionData) {
+    const paypal = (sessionData?.paypal || {});
+    const id = String(paypal.order_id || sessionData?.order_id || "");
+    return id || null;
+}
+/**
+ * Shallow-merge `extraData` into a payment session's `data`, preserving the
+ * session's amount/currency. Callers that update the nested `paypal` object are
+ * responsible for spreading its existing keys (see `getStoredPayPalOrderId`).
+ */
+async function updatePayPalSessionData(sessionId, extraData, scope) {
+    try {
+        const paymentModule = scope.resolve(utils_1.Modules.PAYMENT);
+        const [existing] = await paymentModule.listPaymentSessions({ id: [sessionId] }, { take: 1 });
+        const mergedData = { ...(existing?.data || {}), ...extraData };
+        await paymentModule.updatePaymentSession({
+            id: sessionId,
+            data: mergedData,
+            amount: existing?.amount,
+            currency_code: existing?.currency_code,
+        });
+    }
+    catch (e) {
+        console.error("[PayPal] updatePayPalSessionData failed:", e?.message);
+    }
+}
+//# sourceMappingURL=payment-session.js.map

package/.medusa/server/src/modules/paypal/utils/payment-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-session.js","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/payment-session.ts"],"names":[],"mappings":";;AA2BA,4DAsCC;AAOD,wDAMC;AAOD,0DAkBC;AAtGD,qDAAmD;AACnD,iDAAmD;AAmBnD;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,KAAU;IAEV,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;YACxC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,IAAI;gBACJ,wCAAwC;gBACxC,0CAA0C;gBAC1C,4CAA4C;gBAC5C,iDAAiD;gBACjD,gDAAgD;aACjD;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SACxB,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,QAAQ,GAAG,IAAI,EAAE,kBAAkB,EAAE,gBAAgB,IAAI,EAAE,CAAA;QACjE,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAA,iCAAkB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;aACrD,IAAI,CACH,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CACjB,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAChF,CAAC,CAAC,CAAC,CAAA;QAEN,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QAEzB,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAwB;YACzD,cAAc,EAAE,OAAO,CAAC,MAAM;SAC/B,CAAA;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;QACrE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,WAAwC;IAExC,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAA4B,CAAA;IACrE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;IACjE,OAAO,EAAE,IAAI,IAAI,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,SAA8B,EAC9B,KAAU;IAEV,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAO,CAAC,OAAO,CAA0B,CAAA;QAC7E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5F,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,CAAA;QAC9D,MAAO,aAAqB,CAAC,oBAAoB,CAAC;YAChD,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,QAAQ,EAAE,MAAM;YACxB,aAAa,EAAE,QAAQ,EAAE,aAAa;SACvC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}

package/.medusa/server/src/modules/paypal/utils/secret-crypto.d.ts

@@ -2,7 +2,8 @@ export declare function isSecretEncryptionEnabled(): boolean;
 export declare function isEncrypted(value: unknown): boolean;
 /**
  * Encrypt a secret for storage. Returns the input unchanged when no key is
- * configured or when the value is empty/already encrypted.
+ * configured or when the value is empty/already encrypted. Always writes the
+ * current (v2) format.
  */
 export declare function encryptSecret<T extends string | null | undefined>(value: T): T | string;
 /**

package/.medusa/server/src/modules/paypal/utils/secret-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-crypto.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/secret-crypto.ts"],"names":[],"mappings":"AAuCA,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAavF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAsBvF"}
+{"version":3,"file":"secret-crypto.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/secret-crypto.ts"],"names":[],"mappings":"AAuFA,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAevF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CA+BvF"}

package/.medusa/server/src/modules/paypal/utils/secret-crypto.js

@@ -13,14 +13,33 @@ const crypto_1 = require("crypto");
  * default), both functions are the identity — behavior is byte-for-byte
  * unchanged, so existing deployments are unaffected.
  *
- * Format: `enc:v1:<iv_b64>:<tag_b64>:<ciphertext_b64>` using AES-256-GCM
- * (authenticated, so tampering is detected on decrypt). Legacy plaintext values
- * (no prefix) are returned as-is on decrypt, so secrets stored before
- * encryption was enabled keep working and are upgraded on the next save.
+ * Format (current): `enc:v2:<salt_b64>:<iv_b64>:<tag_b64>:<ciphertext_b64>`
+ * using AES-256-GCM with a key derived via **scrypt** over the env key and a
+ * random per-secret salt. scrypt is a memory-hard KDF, so even a low-entropy
+ * passphrase resists brute-force/rainbow-table attacks (the previous unsalted,
+ * single-pass SHA-256 did not).
+ *
+ * Format (legacy): `enc:v1:<iv_b64>:<tag_b64>:<ciphertext_b64>` with an
+ * unsalted SHA-256 key. Still decryptable so secrets written before the KDF
+ * upgrade keep working; they are transparently upgraded to v2 on the next save.
+ *
+ * Legacy plaintext values (no prefix) are returned as-is on decrypt.
  */
-const PREFIX = "enc:v1:";
+const PREFIX_V2 = "enc:v2:";
+const PREFIX_V1 = "enc:v1:";
+// scrypt cost parameters. N=2^14 with r=8 needs ~16MB (128*N*r), which stays
+// under Node's default 32MB scrypt memory limit while imposing a meaningful
+// per-derivation cost. Derived keys are cached, so this runs at most once per
+// (env key, salt) pair rather than on every encrypt/decrypt.
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const KEY_LEN = 32;
+const SALT_LEN = 16;
 let cachedRaw;
-let cachedKey = null;
+let cachedRawKey = null;
+let legacyV1Key = null;
+const v2KeyCache = new Map();
 /**
  * `@types/node` 22.0-22.6 typed `Buffer` as `Buffer<ArrayBufferLike>`, which is
  * rejected where the `crypto` APIs and `Buffer.concat` expect a plain
@@ -29,38 +48,68 @@ let cachedKey = null;
  * behavior, and stays valid on every other `@types/node` / TypeScript version.
  */
 const bytes = (view) => view;
-function getKey() {
+/** The raw env key (trimmed), or null when encryption is disabled. */
+function getRawKey() {
     const raw = (process.env.PAYPAL_ENCRYPTION_KEY || "").trim();
     if (raw !== cachedRaw) {
         cachedRaw = raw;
-        // Accept a key of any length/format; derive a stable 32-byte AES key.
-        cachedKey = raw ? (0, crypto_1.createHash)("sha256").update(raw).digest() : null;
+        cachedRawKey = raw || null;
+        // The unsalted SHA-256 key is only needed to decrypt legacy v1 values.
+        legacyV1Key = raw ? (0, crypto_1.createHash)("sha256").update(raw).digest() : null;
+        v2KeyCache.clear();
+    }
+    return cachedRawKey;
+}
+/** Derive (and cache) the AES key for a v2 secret from the env key + salt. */
+function deriveV2Key(raw, salt) {
+    const cacheKey = `${raw}::${salt.toString("base64")}`;
+    let key = v2KeyCache.get(cacheKey);
+    if (!key) {
+        key = (0, crypto_1.scryptSync)(raw, bytes(salt), KEY_LEN, {
+            N: SCRYPT_N,
+            r: SCRYPT_R,
+            p: SCRYPT_P,
+        });
+        v2KeyCache.set(cacheKey, key);
     }
-    return cachedKey;
+    return key;
+}
+function gcmDecrypt(key, ivB64, tagB64, ctB64) {
+    const decipher = (0, crypto_1.createDecipheriv)("aes-256-gcm", bytes(key), bytes(Buffer.from(ivB64, "base64")));
+    decipher.setAuthTag(bytes(Buffer.from(tagB64, "base64")));
+    const plaintext = Buffer.concat([
+        bytes(decipher.update(bytes(Buffer.from(ctB64, "base64")))),
+        bytes(decipher.final()),
+    ]);
+    return plaintext.toString("utf8");
 }
 function isSecretEncryptionEnabled() {
-    return getKey() !== null;
+    return getRawKey() !== null;
 }
 function isEncrypted(value) {
-    return typeof value === "string" && value.startsWith(PREFIX);
+    return (typeof value === "string" &&
+        (value.startsWith(PREFIX_V2) || value.startsWith(PREFIX_V1)));
 }
 /**
  * Encrypt a secret for storage. Returns the input unchanged when no key is
- * configured or when the value is empty/already encrypted.
+ * configured or when the value is empty/already encrypted. Always writes the
+ * current (v2) format.
  */
 function encryptSecret(value) {
     if (!value) {
         return value;
     }
-    const key = getKey();
-    if (!key || isEncrypted(value)) {
+    const raw = getRawKey();
+    if (!raw || isEncrypted(value)) {
         return value;
     }
+    const salt = (0, crypto_1.randomBytes)(SALT_LEN);
+    const key = deriveV2Key(raw, salt);
     const iv = (0, crypto_1.randomBytes)(12);
     const cipher = (0, crypto_1.createCipheriv)("aes-256-gcm", bytes(key), bytes(iv));
     const ciphertext = Buffer.concat([bytes(cipher.update(String(value), "utf8")), bytes(cipher.final())]);
     const tag = cipher.getAuthTag();
-    return `${PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ciphertext.toString("base64")}`;
+    return `${PREFIX_V2}${salt.toString("base64")}:${iv.toString("base64")}:${tag.toString("base64")}:${ciphertext.toString("base64")}`;
 }
 /**
  * Decrypt a stored secret. Returns non-encrypted (legacy plaintext) values
@@ -71,21 +120,28 @@ function decryptSecret(value) {
     if (!value || !isEncrypted(value)) {
         return value;
     }
-    const key = getKey();
-    if (!key) {
+    const raw = getRawKey();
+    if (!raw) {
         throw new Error("PayPal secret is encrypted but PAYPAL_ENCRYPTION_KEY is not set. Restore the key to decrypt stored credentials.");
     }
-    const body = String(value).slice(PREFIX.length);
+    if (String(value).startsWith(PREFIX_V2)) {
+        const body = String(value).slice(PREFIX_V2.length);
+        const [saltB64, ivB64, tagB64, ctB64] = body.split(":");
+        if (!saltB64 || !ivB64 || !tagB64 || !ctB64) {
+            throw new Error("PayPal secret ciphertext is malformed.");
+        }
+        const key = deriveV2Key(raw, Buffer.from(saltB64, "base64"));
+        return gcmDecrypt(key, ivB64, tagB64, ctB64);
+    }
+    // Legacy v1 (unsalted SHA-256 key).
+    const body = String(value).slice(PREFIX_V1.length);
     const [ivB64, tagB64, ctB64] = body.split(":");
     if (!ivB64 || !tagB64 || !ctB64) {
         throw new Error("PayPal secret ciphertext is malformed.");
     }
-    const decipher = (0, crypto_1.createDecipheriv)("aes-256-gcm", bytes(key), bytes(Buffer.from(ivB64, "base64")));
-    decipher.setAuthTag(bytes(Buffer.from(tagB64, "base64")));
-    const plaintext = Buffer.concat([
-        bytes(decipher.update(bytes(Buffer.from(ctB64, "base64")))),
-        bytes(decipher.final()),
-    ]);
-    return plaintext.toString("utf8");
+    if (!legacyV1Key) {
+        throw new Error("PayPal secret is encrypted but PAYPAL_ENCRYPTION_KEY is not set.");
+    }
+    return gcmDecrypt(legacyV1Key, ivB64, tagB64, ctB64);
 }
 //# sourceMappingURL=secret-crypto.js.map

package/.medusa/server/src/modules/paypal/utils/secret-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-crypto.js","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/secret-crypto.ts"],"names":[],"mappings":";;AAuCA,8DAEC;AAED,kCAEC;AAMD,sCAaC;AAOD,sCAsBC;AA7FD,mCAAkF;AAElF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,IAAI,SAA6B,CAAA;AACjC,IAAI,SAAS,GAAkB,IAAI,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,IAA6B,CAAA;AAEzE,SAAS,MAAM;IACb,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,CAAA;QACf,sEAAsE;QACtE,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,MAAM,EAAE,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED,SAAgB,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAsC,KAAQ;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IACtG,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC/B,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;AACvG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAsC,KAAQ;IACzE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;KACxB,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC"}
+{"version":3,"file":"secret-crypto.js","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/secret-crypto.ts"],"names":[],"mappings":";;AAuFA,8DAEC;AAED,kCAKC;AAOD,sCAeC;AAOD,sCA+BC;AA5JD,mCAA8F;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,SAAS,GAAG,SAAS,CAAA;AAC3B,MAAM,SAAS,GAAG,SAAS,CAAA;AAE3B,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,OAAO,GAAG,EAAE,CAAA;AAClB,MAAM,QAAQ,GAAG,EAAE,CAAA;AAEnB,IAAI,SAA6B,CAAA;AACjC,IAAI,YAAY,GAAkB,IAAI,CAAA;AACtC,IAAI,WAAW,GAAkB,IAAI,CAAA;AACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,IAA6B,CAAA;AAEzE,sEAAsE;AACtE,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,CAAA;QACf,YAAY,GAAG,GAAG,IAAI,IAAI,CAAA;QAC1B,uEAAuE;QACvE,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACpE,UAAU,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAC5C,MAAM,QAAQ,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACrD,IAAI,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAA,mBAAU,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE;YAC1C,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;SACZ,CAAC,CAAA;QACF,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,MAAc,EAAE,KAAa;IAC3E,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;KACxB,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,SAAS,EAAE,KAAK,IAAI,CAAA;AAC7B,CAAC;AAED,SAAgB,WAAW,CAAC,KAAc;IACxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAsC,KAAQ;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IACtG,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC/B,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;AACrI,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAsC,KAAQ;IACzE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC5D,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IAED,oCAAoC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AACtD,CAAC"}

package/.medusa/server/src/modules/paypal/utils/webhook-verify.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Helpers for calling PayPal's `verify-webhook-signature` API correctly.
+ *
+ * PayPal computes the expected signature over the EXACT bytes it transmitted.
+ * Re-serializing the parsed body (`JSON.stringify(req.body)`) can change those
+ * bytes — key ordering, non-ASCII escaping (`José` vs `José`), number and
+ * whitespace formatting — which makes verification intermittently return
+ * FAILURE for legitimate webhooks. When the original raw body is available we
+ * inject it verbatim as `webhook_event`; otherwise we fall back to serializing
+ * the parsed body so behavior never regresses.
+ */
+/** Normalize Medusa's `req.rawBody` (a Buffer when `preserveRawBody` is set) to a string. */
+export declare function rawBodyToString(rawBody: unknown): string | null;
+/**
+ * Compose the JSON request body for `verify-webhook-signature`.
+ *
+ * `fields` are the transmission headers + webhook_id; `webhookEventJson` is the
+ * raw webhook body verbatim (preferred) or a serialized fallback. Undefined /
+ * null header values are omitted. The webhook event is concatenated as raw JSON
+ * (not re-encoded) so the bytes PayPal hashes match what it signed.
+ */
+export declare function composeVerifyRequestBody(fields: Record<string, string | undefined | null>, webhookEventJson: string): string;
+/**
+ * Pick the bytes to use for `webhook_event`: the raw body when present and
+ * non-blank, otherwise a JSON serialization of the parsed body.
+ */
+export declare function resolveWebhookEventJson(rawBody: string | null | undefined, parsedBody: unknown): string;
+//# sourceMappingURL=webhook-verify.d.ts.map

package/.medusa/server/src/modules/paypal/utils/webhook-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/webhook-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAc/D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,EACjD,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,UAAU,EAAE,OAAO,GAClB,MAAM,CAKR"}

package/.medusa/server/src/modules/paypal/utils/webhook-verify.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Helpers for calling PayPal's `verify-webhook-signature` API correctly.
+ *
+ * PayPal computes the expected signature over the EXACT bytes it transmitted.
+ * Re-serializing the parsed body (`JSON.stringify(req.body)`) can change those
+ * bytes — key ordering, non-ASCII escaping (`José` vs `José`), number and
+ * whitespace formatting — which makes verification intermittently return
+ * FAILURE for legitimate webhooks. When the original raw body is available we
+ * inject it verbatim as `webhook_event`; otherwise we fall back to serializing
+ * the parsed body so behavior never regresses.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rawBodyToString = rawBodyToString;
+exports.composeVerifyRequestBody = composeVerifyRequestBody;
+exports.resolveWebhookEventJson = resolveWebhookEventJson;
+/** Normalize Medusa's `req.rawBody` (a Buffer when `preserveRawBody` is set) to a string. */
+function rawBodyToString(rawBody) {
+    if (rawBody == null) {
+        return null;
+    }
+    if (typeof rawBody === "string") {
+        return rawBody.length > 0 ? rawBody : null;
+    }
+    if (Buffer.isBuffer(rawBody)) {
+        return rawBody.length > 0 ? rawBody.toString("utf8") : null;
+    }
+    if (rawBody instanceof Uint8Array) {
+        return rawBody.length > 0 ? Buffer.from(rawBody).toString("utf8") : null;
+    }
+    return null;
+}
+/**
+ * Compose the JSON request body for `verify-webhook-signature`.
+ *
+ * `fields` are the transmission headers + webhook_id; `webhookEventJson` is the
+ * raw webhook body verbatim (preferred) or a serialized fallback. Undefined /
+ * null header values are omitted. The webhook event is concatenated as raw JSON
+ * (not re-encoded) so the bytes PayPal hashes match what it signed.
+ */
+function composeVerifyRequestBody(fields, webhookEventJson) {
+    const head = Object.entries(fields)
+        .filter(([, v]) => v !== undefined && v !== null)
+        .map(([k, v]) => `${JSON.stringify(k)}:${JSON.stringify(v)}`)
+        .join(",");
+    return `{${head}${head ? "," : ""}"webhook_event":${webhookEventJson}}`;
+}
+/**
+ * Pick the bytes to use for `webhook_event`: the raw body when present and
+ * non-blank, otherwise a JSON serialization of the parsed body.
+ */
+function resolveWebhookEventJson(rawBody, parsedBody) {
+    if (typeof rawBody === "string" && rawBody.trim().length > 0) {
+        return rawBody;
+    }
+    return JSON.stringify(parsedBody ?? {});
+}
+//# sourceMappingURL=webhook-verify.js.map

package/.medusa/server/src/modules/paypal/utils/webhook-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.js","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/webhook-verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAGH,0CAcC;AAUD,4DASC;AAMD,0DAQC;AAhDD,6FAA6F;AAC7F,SAAgB,eAAe,CAAC,OAAgB;IAC9C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,YAAY,UAAU,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CACtC,MAAiD,EACjD,gBAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,gBAAgB,GAAG,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,OAAkC,EAClC,UAAmB;IAEnB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easypayment/medusa-payment-paypal",
-  "version": "0.9.16",
+  "version": "0.9.18",
   "description": "PayPal integration for Medusa v2",
   "author": "EasyPayment Plugins",
   "license": "MIT",

package/src/admin/routes/settings/paypal/connection/page.tsx

@@ -24,8 +24,9 @@ declare global {
     PAYPAL?: {
       apps?: {
         Signup?: {
-          miniBrowser?: { init: () => void }
-          MiniBrowser?: { closeFlow?: () => void }
+          miniBrowser?: { init?: () => void; closeFlow?: () => void }
+          MiniBrowser?: { init?: () => void; closeFlow?: () => void }
+          render?: () => void
         }
       }
     }
@@ -158,22 +159,86 @@ export default function PayPalConnectionPage() {
     if (connState !== "ready" || !finalUrl) return
 
     const scriptUrl = PARTNER_JS_URLS[env]
+    let cancelled = false
+    let pollTimer: ReturnType<typeof setTimeout> | undefined
+
+    // PayPal's partner.js wires the mini-browser handler to its own
+    // DOMContentLoaded listener. Inside the Medusa admin (a React SPA) that
+    // event fired long before this route mounted, so partner.js never scans the
+    // button and the click falls through to the plain target="_blank" anchor —
+    // which opens PayPal onboarding in a NEW TAB instead of the popup.
+    //
+    // To fix this we load partner.js only after the anchor exists with its real
+    // href, then explicitly run PayPal's initializer so it discovers the button
+    // and intercepts the click into the mini-browser popup.
+    const initPartner = (attempt = 0) => {
+      if (cancelled) return
+
+      const signup = window.PAYPAL?.apps?.Signup
+      const target =
+        signup?.miniBrowser && typeof signup.miniBrowser.init === "function"
+          ? signup.miniBrowser
+          : signup?.MiniBrowser && typeof signup.MiniBrowser.init === "function"
+            ? signup.MiniBrowser
+            : null
+
+      if (target?.init) {
+        try {
+          target.init()
+        } catch (e) {
+          console.error("[paypal] partner.js init failed:", e)
+        }
+        return
+      }
+
+      if (typeof signup?.render === "function") {
+        try {
+          signup.render()
+        } catch (e) {
+          console.error("[paypal] partner.js render failed:", e)
+        }
+        return
+      }
+
+      // The namespace may not be populated the instant onload fires; retry
+      // briefly before giving up.
+      if (attempt < 40) {
+        pollTimer = setTimeout(() => initPartner(attempt + 1), 50)
+        return
+      }
+
+      // Last resort: partner.js exposed no initializer we recognise. Re-fire
+      // DOMContentLoaded so any listener it registered runs against the
+      // now-present button.
+      try {
+        document.dispatchEvent(new Event("DOMContentLoaded"))
+      } catch {}
+    }
 
+    // Remove any stale copy + namespace so the fresh load re-scans the current
+    // button (href/environment may have changed since the last render).
     const existingScript = document.getElementById("paypal-partner-js")
     if (existingScript) {
       existingScript.parentNode?.removeChild(existingScript)
     }
     if (window.PAYPAL?.apps?.Signup) {
-      delete (window.PAYPAL.apps as any).Signup
+      try {
+        delete (window.PAYPAL.apps as any).Signup
+      } catch {}
     }
 
     const ppScript = document.createElement("script")
     ppScript.id = "paypal-partner-js"
     ppScript.src = scriptUrl
     ppScript.async = true
+    ppScript.onload = () => initPartner()
     document.body.appendChild(ppScript)
 
     return () => {
+      cancelled = true
+      if (pollTimer) {
+        clearTimeout(pollTimer)
+      }
       if (ppScript.parentNode) {
         ppScript.parentNode.removeChild(ppScript)
       }
@@ -472,15 +537,6 @@ export default function PayPalConnectionPage() {
                 <div>
                   <div className="text-sm text-green-600 bg-green-50 p-3 rounded border border-green-200">
                     ✅ Successfully connected to PayPal!
-                    <a
-                      target="_blank"
-                      data-paypal-button="true"
-                      data-paypal-onboard-complete="onboardingCallback"
-                      href="#"
-                      style={{ display: "none" }}
-                    >
-                      PayPal
-                    </a>
                   </div>
                   <div className="mt-3 rounded-md border border-ui-border-base bg-ui-bg-subtle p-3 text-xs text-ui-fg-subtle">
                     <div className="font-medium text-ui-fg-base">

package/src/api/middlewares.ts

@@ -2,6 +2,15 @@ import { defineMiddlewares } from "@medusajs/framework/http"
 
 export default defineMiddlewares({
   routes: [
+    {
+      // Keep the exact bytes PayPal signed (`req.rawBody`) so webhook signature
+      // verification hashes the original payload, not a re-serialized copy. This
+      // entry must precede the "/store/paypal/:path*" catch-all below.
+      matcher: "/store/paypal/webhook",
+      method: ["POST"],
+      bodyParser: { preserveRawBody: true },
+      middlewares: [],
+    },
     {
       matcher: "/store/paypal-complete",
       middlewares: [],

package/src/api/store/paypal/capture-order/route.ts

@@ -1,11 +1,15 @@
 import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
-import type { IPaymentModuleService, Logger } from "@medusajs/framework/types"
-import { ContainerRegistrationKeys, Modules } from "@medusajs/framework/utils"
+import type { Logger } from "@medusajs/framework/types"
+import { ContainerRegistrationKeys } from "@medusajs/framework/utils"
 import { randomUUID } from "crypto"
 import type PayPalModuleService from "../../../../modules/paypal/service"
 import { getPayPalApiBase } from "../../../../modules/paypal/utils/paypal-auth"
 import { paypalFetch } from "../../../../modules/paypal/utils/paypal-fetch"
-import { isPayPalProviderId } from "../../../../modules/paypal/utils/provider-ids"
+import {
+  findPayPalSessionForCart,
+  getStoredPayPalOrderId,
+  updatePayPalSessionData,
+} from "../../../../modules/paypal/utils/payment-session"
 
 const BN_CODE = "MBJTechnolabs_SI_SPB"
 
@@ -29,70 +33,6 @@ function resolveIdempotencyKey(req: MedusaRequest, suffix: string, fallback: str
   return fallback || `pp-${suffix}-${randomUUID()}`
 }
 
-async function findPayPalSessionForCart(
-  cartId: string,
-  scope: any
-): Promise<{
-  session_id: string
-  session_data: Record<string, any>
-  session_status: string
-} | null> {
-  try {
-    const query = scope.resolve("query")
-    const { data: carts } = await query.graph({
-      entity: "cart",
-      fields: [
-        "id",
-        "payment_collection.payment_sessions.id",
-        "payment_collection.payment_sessions.data",
-        "payment_collection.payment_sessions.status",
-        "payment_collection.payment_sessions.provider_id",
-        "payment_collection.payment_sessions.created_at",
-      ],
-      filters: { id: cartId },
-    })
-    const cart = carts?.[0]
-    const sessions = cart?.payment_collection?.payment_sessions || []
-    const session = sessions
-      .filter((s: any) => isPayPalProviderId(s.provider_id))
-      .sort(
-        (a: any, b: any) =>
-          new Date(b.created_at || 0).getTime() - new Date(a.created_at || 0).getTime()
-      )[0]
-
-    if (!session) return null
-
-    return {
-      session_id: session.id,
-      session_data: (session.data || {}) as Record<string, any>,
-      session_status: session.status,
-    }
-  } catch (e: any) {
-    console.warn("[PayPal] findPayPalSessionForCart failed:", e?.message)
-    return null
-  }
-}
-
-async function updatePayPalSessionData(
-  sessionId: string,
-  extraData: Record<string, any>,
-  scope: any
-): Promise<void> {
-  try {
-    const paymentModule = scope.resolve(Modules.PAYMENT) as IPaymentModuleService
-    const [existing] = await paymentModule.listPaymentSessions({ id: [sessionId] }, { take: 1 })
-    const mergedData = { ...(existing?.data || {}), ...extraData }
-    await (paymentModule as any).updatePaymentSession({
-      id: sessionId,
-      data: mergedData,
-      amount: existing?.amount,
-      currency_code: existing?.currency_code,
-    })
-  } catch (e: any) {
-    console.error("[PayPal] updatePayPalSessionData failed:", e?.message)
-  }
-}
-
 async function attachPayPalCaptureToSession(
   cartId: string,
   orderId: string,
@@ -202,10 +142,7 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     // create-order). This prevents capturing an arbitrary, caller-supplied
     // order_id against the merchant account.
     const session = await findPayPalSessionForCart(cartId, scope)
-    const sessionOrderId = String(
-      (session?.session_data?.paypal as Record<string, unknown>)?.order_id ||
-      session?.session_data?.order_id || ""
-    )
+    const sessionOrderId = getStoredPayPalOrderId(session?.session_data)
     if (!session || !sessionOrderId) {
       return res.status(409).json({
         message: "No PayPal order is associated with this cart's payment session",