npm - @easypayment/medusa-payment-paypal - Versions diffs - 0.9.24 → 0.9.26 - Mend

@easypayment/medusa-payment-paypal 0.9.24 → 0.9.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (22) hide show

package/src/api/admin/paypal/onboard-complete/route.ts CHANGED Viewed

@@ -1,6 +1,13 @@
 import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
 import type PayPalModuleService from "../../../../modules/paypal/service"
+/**
+ * The PayPal onboarding `return_url` (the page the mini-browser popup lands on)
+ * is the PUBLIC route `GET /store/paypal/onboard-return` — `/admin/*` routes
+ * require an auth token that a top-level popup navigation cannot carry, which
+ * would leave the popup stuck on a 401 page. This admin GET is therefore not part
+ * of the browser flow; it only documents the contract for the POST below.
+ */
 export async function GET(_req: MedusaRequest, res: MedusaResponse) {
   return res.status(405).json({
     message:

package/src/api/store/paypal/onboard-return/route.ts ADDED Viewed

@@ -0,0 +1,88 @@
+import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
+import type PayPalModuleService from "../../../../modules/paypal/service"
+/**
+ * Public PayPal onboarding `return_url`.
+ *
+ * When a seller finishes onboarding, PayPal redirects the mini-browser popup to
+ * this URL as a plain top-level navigation (no auth header / no publishable key),
+ * which is why it must live under the public `/store/paypal/*` namespace rather
+ * than `/admin/*`. Leaving the popup on a raw JSON / 401 / 405 page is exactly
+ * what made the popup appear to "never close".
+ *
+ * This route is the authoritative, partner.js-independent completion path. It:
+ *   1. exchanges PayPal's `authCode` + `sharedId` for seller credentials
+ *      server-side (idempotent — safe even if partner.js's onboardingCallback or
+ *      admin status polling also completes the exchange),
+ *   2. relays whatever query params PayPal appended back to the opener (the
+ *      Medusa Admin connection page) via postMessage so it can refresh
+ *      immediately, and
+ *   3. closes the popup.
+ *
+ * Because the exchange no longer depends on the opener receiving an in-flight
+ * postMessage, onboarding completes (and the admin page flips to "connected" via
+ * its status poll) even when partner.js never fires its callback.
+ */
+export async function GET(req: MedusaRequest, res: MedusaResponse) {
+  const query = (req.query || {}) as Record<string, unknown>
+  const params: Record<string, string> = {}
+  for (const [k, v] of Object.entries(query)) {
+    if (v == null) continue
+    params[k] = Array.isArray(v) ? String(v[0]) : String(v)
+  }
+  // PayPal appends the seller's authorization code + shared id to the return_url
+  // (plus the env we pinned when generating the link). When present, complete the
+  // exchange right here so credentials are saved even if no other path runs.
+  const authCode = params.authCode || params.auth_code
+  const sharedId = params.sharedId || params.shared_id
+  const env =
+    params.env === "sandbox" || params.env === "live" ? params.env : undefined
+  if (authCode && sharedId) {
+    try {
+      const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
+      await paypal.exchangeAndSaveSellerCredentials({ authCode, sharedId, env })
+    } catch (e: unknown) {
+      // Don't break the popup close on failure — relay the params so the opener
+      // (partner.js / admin polling) can still attempt to complete.
+      console.error(
+        "[PayPal] onboard-return exchange failed:",
+        e instanceof Error ? e.message : e
+      )
+    }
+  }
+  // JSON-encode then escape the characters that could break out of the inline
+  // <script> string/tag (including the U+2028/U+2029 separators that are legal in
+  // JSON but illegal in a JS string literal), so the relayed params embed safely.
+  const safePayload = JSON.stringify(params)
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/&/g, "\\u0026")
+    .replace(/[\u2028\u2029]/g, (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0"))
+  const html = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><title>PayPal onboarding complete</title></head>
+<body style="font-family: system-ui, sans-serif; padding: 24px; text-align: center; color: #1f2937;">
+<p>PayPal onboarding complete. You can close this window.</p>
+<script>
+(function () {
+  try {
+    var message = { source: "paypal-onboarding-return", params: ${safePayload} };
+    if (window.opener && !window.opener.closed) {
+      try { window.opener.postMessage(message, "*"); } catch (e) {}
+    }
+  } catch (e) {}
+  // Give the opener a moment to react, then close the popup.
+  setTimeout(function () { try { window.close(); } catch (e) {} }, 600);
+})();
+</script>
+</body>
+</html>`
+  res.setHeader("Content-Type", "text/html; charset=utf-8")
+  res.setHeader("Cache-Control", "no-store")
+  return res.status(200).send(html)
+}

package/src/modules/paypal/service.ts CHANGED Viewed

@@ -495,13 +495,20 @@ class PayPalModuleService extends MedusaService({
   async createOnboardingLink(input?: { email?: string; products?: string[]; env?: Environment }) {
     const { onboarding } = await this.ensureSettingsDefaults()
-    const return_url = `${String(onboarding.backend_url || "").replace(/\/$/, "")}/admin/paypal/onboard-complete`
     // Honor an explicit environment from the caller so the generated link can't
     // depend on a racing "set environment" request having landed first.
     const env =
       input?.env === "sandbox" || input?.env === "live"
         ? input.env
         : await this.getCurrentEnvironment()
+    // The popup lands here after onboarding, as a plain top-level navigation with
+    // no auth token — so it must be the PUBLIC store bridge route, not an
+    // /admin/* route (which would 401 and leave the popup stuck). The bridge
+    // exchanges the auth code for seller credentials server-side, relays the
+    // result to the opener, and closes the popup. We pin the environment in the
+    // URL so the bridge saves credentials under the correct env even though
+    // PayPal's redirect carries no auth/session.
+    const return_url = `${String(onboarding.backend_url || "").replace(/\/$/, "")}/store/paypal/onboard-return?env=${env}`
     const partner_merchant_id = await this.getPartnerMerchantId(env)
     const email = (input?.email || "").trim()
@@ -649,9 +656,23 @@ class PayPalModuleService extends MedusaService({
     sharedId: string
     env?: "sandbox" | "live"
   }) {
-    await this.saveOnboardCallback({ authCode: input.authCode, sharedId: input.sharedId })
     const env = (input.env || (await this.getCurrentEnvironment())) as Environment
+    // Onboarding completion can now arrive via several redundant paths
+    // (partner.js's onboardingCallback in the opener, the return_url bridge that
+    // runs inside the popup, and admin status polling). PayPal's authorization
+    // code is single-use, so a second exchange of the same code would fail with
+    // invalid_grant. If we already exchanged this exact code and hold seller
+    // credentials for this environment, treat the duplicate as a success no-op.
+    const existingRow = await this.getCurrentRow()
+    if (existingRow && existingRow.auth_code === input.authCode) {
+      const existingCreds = this.getEnvCreds(existingRow, env)
+      if (existingCreds.clientId && existingCreds.clientSecret) {
+        return
+      }
+    }
+    await this.saveOnboardCallback({ authCode: input.authCode, sharedId: input.sharedId })
     const baseUrl = env === "live" ? "https://api-m.paypal.com" : "https://api-m.sandbox.paypal.com"
     const { onboarding } = await this.ensureSettingsDefaults()
@@ -686,6 +707,16 @@ class PayPalModuleService extends MedusaService({
     }
     if (!tokenRes.ok) {
+      // Two redundant completion paths can race to exchange the same single-use
+      // code; the loser gets invalid_grant. If credentials were saved in the
+      // meantime (the other path won), the onboarding actually succeeded.
+      const racedRow = await this.getCurrentRow()
+      if (racedRow) {
+        const racedCreds = this.getEnvCreds(racedRow, env)
+        if (racedCreds.clientId && racedCreds.clientSecret) {
+          return
+        }
+      }
       throw new Error(
         `PayPal authorization_code token exchange failed (${tokenRes.status}): ${tokenText || JSON.stringify(tokenJson)}`
       )