@easypayment/medusa-payment-paypal 0.9.25 → 0.9.26

package/src/api/store/paypal/onboard-return/route.ts

@@ -1,4 +1,5 @@
 import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
+import type PayPalModuleService from "../../../../modules/paypal/service"
 
 /**
  * Public PayPal onboarding `return_url`.
@@ -9,16 +10,18 @@ import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
  * than `/admin/*`. Leaving the popup on a raw JSON / 401 / 405 page is exactly
  * what made the popup appear to "never close".
  *
- * This route serves a tiny HTML bridge that runs inside the popup and:
- *   1. relays whatever query params PayPal appended back to the opener
- *      (the Medusa Admin connection page) via postMessage, and
- *   2. closes the popup.
+ * This route is the authoritative, partner.js-independent completion path. It:
+ *   1. exchanges PayPal's `authCode` + `sharedId` for seller credentials
+ *      server-side (idempotent — safe even if partner.js's onboardingCallback or
+ *      admin status polling also completes the exchange),
+ *   2. relays whatever query params PayPal appended back to the opener (the
+ *      Medusa Admin connection page) via postMessage so it can refresh
+ *      immediately, and
+ *   3. closes the popup.
  *
- * The actual credential exchange happens via the admin POST
- * /admin/paypal/onboard-complete (driven by partner.js's onboardingCallback and
- * the admin page's postMessage listener). This page is the safety net that
- * guarantees the popup closes and the admin page re-checks status even if the
- * in-flight PayPal completion message was missed.
+ * Because the exchange no longer depends on the opener receiving an in-flight
+ * postMessage, onboarding completes (and the admin page flips to "connected" via
+ * its status poll) even when partner.js never fires its callback.
  */
 export async function GET(req: MedusaRequest, res: MedusaResponse) {
   const query = (req.query || {}) as Record<string, unknown>
@@ -28,6 +31,28 @@ export async function GET(req: MedusaRequest, res: MedusaResponse) {
     params[k] = Array.isArray(v) ? String(v[0]) : String(v)
   }
 
+  // PayPal appends the seller's authorization code + shared id to the return_url
+  // (plus the env we pinned when generating the link). When present, complete the
+  // exchange right here so credentials are saved even if no other path runs.
+  const authCode = params.authCode || params.auth_code
+  const sharedId = params.sharedId || params.shared_id
+  const env =
+    params.env === "sandbox" || params.env === "live" ? params.env : undefined
+
+  if (authCode && sharedId) {
+    try {
+      const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
+      await paypal.exchangeAndSaveSellerCredentials({ authCode, sharedId, env })
+    } catch (e: unknown) {
+      // Don't break the popup close on failure — relay the params so the opener
+      // (partner.js / admin polling) can still attempt to complete.
+      console.error(
+        "[PayPal] onboard-return exchange failed:",
+        e instanceof Error ? e.message : e
+      )
+    }
+  }
+
   // JSON-encode then escape the characters that could break out of the inline
   // <script> string/tag (including the U+2028/U+2029 separators that are legal in
   // JSON but illegal in a JS string literal), so the relayed params embed safely.

package/src/modules/paypal/service.ts

@@ -495,17 +495,20 @@ class PayPalModuleService extends MedusaService({
 
   async createOnboardingLink(input?: { email?: string; products?: string[]; env?: Environment }) {
     const { onboarding } = await this.ensureSettingsDefaults()
-    // The popup lands here after onboarding, as a plain top-level navigation with
-    // no auth token — so it must be the PUBLIC store bridge route, not an
-    // /admin/* route (which would 401 and leave the popup stuck). The bridge
-    // relays the result to the opener and closes the popup.
-    const return_url = `${String(onboarding.backend_url || "").replace(/\/$/, "")}/store/paypal/onboard-return`
     // Honor an explicit environment from the caller so the generated link can't
     // depend on a racing "set environment" request having landed first.
     const env =
       input?.env === "sandbox" || input?.env === "live"
         ? input.env
         : await this.getCurrentEnvironment()
+    // The popup lands here after onboarding, as a plain top-level navigation with
+    // no auth token — so it must be the PUBLIC store bridge route, not an
+    // /admin/* route (which would 401 and leave the popup stuck). The bridge
+    // exchanges the auth code for seller credentials server-side, relays the
+    // result to the opener, and closes the popup. We pin the environment in the
+    // URL so the bridge saves credentials under the correct env even though
+    // PayPal's redirect carries no auth/session.
+    const return_url = `${String(onboarding.backend_url || "").replace(/\/$/, "")}/store/paypal/onboard-return?env=${env}`
     const partner_merchant_id = await this.getPartnerMerchantId(env)
 
     const email = (input?.email || "").trim()
@@ -653,9 +656,23 @@ class PayPalModuleService extends MedusaService({
     sharedId: string
     env?: "sandbox" | "live"
   }) {
-    await this.saveOnboardCallback({ authCode: input.authCode, sharedId: input.sharedId })
-
     const env = (input.env || (await this.getCurrentEnvironment())) as Environment
+
+    // Onboarding completion can now arrive via several redundant paths
+    // (partner.js's onboardingCallback in the opener, the return_url bridge that
+    // runs inside the popup, and admin status polling). PayPal's authorization
+    // code is single-use, so a second exchange of the same code would fail with
+    // invalid_grant. If we already exchanged this exact code and hold seller
+    // credentials for this environment, treat the duplicate as a success no-op.
+    const existingRow = await this.getCurrentRow()
+    if (existingRow && existingRow.auth_code === input.authCode) {
+      const existingCreds = this.getEnvCreds(existingRow, env)
+      if (existingCreds.clientId && existingCreds.clientSecret) {
+        return
+      }
+    }
+
+    await this.saveOnboardCallback({ authCode: input.authCode, sharedId: input.sharedId })
     const baseUrl = env === "live" ? "https://api-m.paypal.com" : "https://api-m.sandbox.paypal.com"
 
     const { onboarding } = await this.ensureSettingsDefaults()
@@ -690,6 +707,16 @@ class PayPalModuleService extends MedusaService({
     }
 
     if (!tokenRes.ok) {
+      // Two redundant completion paths can race to exchange the same single-use
+      // code; the loser gets invalid_grant. If credentials were saved in the
+      // meantime (the other path won), the onboarding actually succeeded.
+      const racedRow = await this.getCurrentRow()
+      if (racedRow) {
+        const racedCreds = this.getEnvCreds(racedRow, env)
+        if (racedCreds.clientId && racedCreds.clientSecret) {
+          return
+        }
+      }
       throw new Error(
         `PayPal authorization_code token exchange failed (${tokenRes.status}): ${tokenText || JSON.stringify(tokenJson)}`
       )