@easypayment/medusa-payment-paypal 0.9.4 → 0.9.6

package/src/admin/routes/settings/paypal/paypal-settings/page.tsx

@@ -1,38 +1,9 @@
-import React, { useEffect, useRef, useState } from "react"
+import React, { useCallback, useEffect, useRef, useState } from "react"
 import PayPalTabs from "../_components/Tabs"
-
-type AdminFetchOptions = {
-  method?: "GET" | "POST" | "PUT" | "DELETE" | "PATCH"
-  body?: Record<string, unknown>
-  query?: Record<string, string>
-}
-
-async function adminFetch<T = unknown>(path: string, opts: AdminFetchOptions = {}): Promise<T> {
-  const { method = "GET", body, query } = opts
-  let url = path
-  if (query && Object.keys(query).length > 0) {
-    const params = new URLSearchParams(query)
-    url = `${path}?${params.toString()}`
-  }
-  const headers: Record<string, string> = { Accept: "application/json" }
-  if (body !== undefined) headers["Content-Type"] = "application/json"
-  if (typeof window !== "undefined") {
-    const token = (window as any).__medusa__?.token
-    if (token) headers["Authorization"] = `Bearer ${token}`
-  }
-  const res = await fetch(url, {
-    method, headers, credentials: "include",
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  })
-  const text = await res.text().catch(() => "")
-  if (!res.ok) {
-    if (res.status === 401) throw new Error("Unauthorized (401) - session may have expired. Please reload and log in again.")
-    if (res.status === 403) throw new Error("Forbidden (403) - you do not have permission to perform this action.")
-    throw new Error(text || `Request failed with status ${res.status}`)
-  }
-  if (!text) return {} as T
-  try { return JSON.parse(text) as T } catch { return {} as T }
-}
+import SectionCard from "../_components/SectionCard"
+import FieldRow from "../_components/FieldRow"
+import Toast, { ToastState } from "../_components/Toast"
+import { adminFetch } from "../_utils/adminFetch"
 
 type ButtonColor = "gold" | "blue" | "silver" | "black" | "white"
 type ButtonShape = "rect" | "pill"
@@ -79,51 +50,6 @@ const LABEL_OPTIONS: { value: ButtonLabel; label: string }[] = [
   { value: "pay", label: "Pay" },
 ]
 
-function SectionCard({
-  title,
-  description,
-  children,
-  right,
-}: {
-  title: string
-  description?: string
-  children: React.ReactNode
-  right?: React.ReactNode
-}) {
-  return (
-    <div className="rounded-xl border border-ui-border-base bg-ui-bg-base shadow-sm">
-      <div className="flex items-start justify-between gap-4 border-b border-ui-border-base p-4">
-        <div>
-          <div className="text-base font-semibold text-ui-fg-base">{title}</div>
-          {description ? <div className="mt-1 text-sm text-ui-fg-subtle">{description}</div> : null}
-        </div>
-        {right}
-      </div>
-      <div className="p-4">{children}</div>
-    </div>
-  )
-}
-
-function FieldRow({
-  label,
-  hint,
-  children,
-}: {
-  label: string
-  hint?: React.ReactNode
-  children: React.ReactNode
-}) {
-  return (
-    <div className="grid grid-cols-12 items-start gap-4 py-3">
-      <div className="col-span-12 md:col-span-4">
-        <div className="text-sm font-medium text-ui-fg-base">{label}</div>
-        {hint ? <div className="mt-1 text-xs text-ui-fg-subtle">{hint}</div> : null}
-      </div>
-      <div className="col-span-12 md:col-span-8">{children}</div>
-    </div>
-  )
-}
-
 export default function PayPalSettingsTab() {
   const [form, setForm] = useState<PayPalSettingsForm>({
     enabled: true,
@@ -137,9 +63,11 @@ export default function PayPalSettingsTab() {
   })
   const [loading, setLoading] = useState(false)
   const [saving, setSaving] = useState(false)
-  const [toast, setToast] = useState<{ type: "success" | "error"; message: string } | null>(null)
+  const [toast, setToast] = useState<ToastState>(null)
   const didInit = useRef(false)
 
+  const dismissToast = useCallback(() => setToast(null), [])
+
   useEffect(() => {
     if (didInit.current) return
     didInit.current = true
@@ -184,16 +112,14 @@ export default function PayPalSettingsTab() {
           ...saved,
         }))
       }
-      setToast({ type: "success", message: "Settings saved" })
-      window.setTimeout(() => setToast(null), 2500)
+      setToast({ kind: "success", message: "Settings saved" })
     } catch (e: unknown) {
       setToast({
-        type: "error",
+        kind: "error",
         message:
           (e instanceof Error ? e.message : "") ||
           "Failed to save settings.",
       })
-      window.setTimeout(() => setToast(null), 3500)
     } finally {
       setSaving(false)
     }
@@ -213,17 +139,7 @@ export default function PayPalSettingsTab() {
 
         <PayPalTabs />
 
-        {toast ? (
-          <div
-            className="fixed right-6 top-6 z-50 rounded-md border border-ui-border-base bg-ui-bg-base px-4 py-3 text-sm shadow-lg"
-            role="status"
-            aria-live="polite"
-          >
-            <span className={toast.type === "success" ? "text-ui-fg-base" : "text-ui-fg-error"}>
-              {toast.message}
-            </span>
-          </div>
-        ) : null}
+        <Toast toast={toast} onClose={dismissToast} />
 
         <SectionCard
           title="PayPal Settings"
@@ -255,8 +171,9 @@ export default function PayPalSettingsTab() {
               </label>
             </FieldRow>
 
-            <FieldRow label="Title">
+            <FieldRow label="Title" htmlFor="pp-title">
               <input
+                id="pp-title"
                 value={form.title}
                 onChange={(e) => setForm((p) => ({ ...p, title: e.target.value }))}
                 className="w-full rounded-md border border-ui-border-base bg-ui-bg-base px-3 py-2 text-sm text-ui-fg-base outline-none focus:ring-2 focus:ring-ui-border-interactive"
@@ -273,8 +190,9 @@ export default function PayPalSettingsTab() {
         >
           <div className="divide-y divide-ui-border-base">
 
-            <FieldRow label="Button Color">
+            <FieldRow label="Button Color" htmlFor="pp-btn-color">
               <select
+                id="pp-btn-color"
                 value={form.buttonColor}
                 onChange={(e) => setForm((p) => ({ ...p, buttonColor: e.target.value as ButtonColor }))}
                 className="w-full rounded-md border border-ui-border-base bg-ui-bg-base px-3 py-2 text-sm text-ui-fg-base outline-none focus:ring-2 focus:ring-ui-border-interactive"
@@ -287,8 +205,9 @@ export default function PayPalSettingsTab() {
               </select>
             </FieldRow>
 
-            <FieldRow label="Button Shape">
+            <FieldRow label="Button Shape" htmlFor="pp-btn-shape">
               <select
+                id="pp-btn-shape"
                 value={form.buttonShape}
                 onChange={(e) => setForm((p) => ({ ...p, buttonShape: e.target.value as ButtonShape }))}
                 className="w-full rounded-md border border-ui-border-base bg-ui-bg-base px-3 py-2 text-sm text-ui-fg-base outline-none focus:ring-2 focus:ring-ui-border-interactive"
@@ -301,8 +220,9 @@ export default function PayPalSettingsTab() {
               </select>
             </FieldRow>
 
-            <FieldRow label="Button Width">
+            <FieldRow label="Button Width" htmlFor="pp-btn-width">
               <select
+                id="pp-btn-width"
                 value={form.buttonWidth}
                 onChange={(e) => setForm((p) => ({ ...p, buttonWidth: e.target.value as ButtonWidth }))}
                 className="w-full rounded-md border border-ui-border-base bg-ui-bg-base px-3 py-2 text-sm text-ui-fg-base outline-none focus:ring-2 focus:ring-ui-border-interactive"
@@ -315,8 +235,9 @@ export default function PayPalSettingsTab() {
               </select>
             </FieldRow>
 
-            <FieldRow label="Button Height">
+            <FieldRow label="Button Height" htmlFor="pp-btn-height">
               <select
+                id="pp-btn-height"
                 value={String(form.buttonHeight)}
                 onChange={(e) => setForm((p) => ({ ...p, buttonHeight: Number(e.target.value) }))}
                 className="w-full rounded-md border border-ui-border-base bg-ui-bg-base px-3 py-2 text-sm text-ui-fg-base outline-none focus:ring-2 focus:ring-ui-border-interactive"
@@ -329,8 +250,9 @@ export default function PayPalSettingsTab() {
               </select>
             </FieldRow>
 
-            <FieldRow label="Button Label">
+            <FieldRow label="Button Label" htmlFor="pp-btn-label">
               <select
+                id="pp-btn-label"
                 value={form.buttonLabel}
                 onChange={(e) => setForm((p) => ({ ...p, buttonLabel: e.target.value as ButtonLabel }))}
                 className="w-full rounded-md border border-ui-border-base bg-ui-bg-base px-3 py-2 text-sm text-ui-fg-base outline-none focus:ring-2 focus:ring-ui-border-interactive"

package/src/api/admin/payment-collections/[id]/payment-sessions/route.ts

@@ -7,18 +7,35 @@ type CreatePaymentSessionBody = {
   customer_id?: string
 }
 
+const ALLOWED_PROVIDERS = new Set([
+  "pp_paypal_paypal",
+  "pp_paypal_card_paypal_card",
+])
+
 export async function POST(req: MedusaRequest, res: MedusaResponse) {
   const collectionId = req.params.id
   const { provider_id, data, customer_id } = req.body as CreatePaymentSessionBody
 
-  const { result } = await createPaymentSessionsWorkflow(req.scope).run({
-    input: {
-      payment_collection_id: collectionId,
-      provider_id,
-      customer_id,
-      data,
-    },
-  })
+  if (!provider_id || !ALLOWED_PROVIDERS.has(provider_id)) {
+    return res.status(400).json({ message: "Invalid or unsupported provider_id" })
+  }
+
+  if (!collectionId || typeof collectionId !== "string") {
+    return res.status(400).json({ message: "Invalid collection id" })
+  }
+
+  try {
+    const { result } = await createPaymentSessionsWorkflow(req.scope).run({
+      input: {
+        payment_collection_id: collectionId,
+        provider_id,
+        customer_id,
+        data,
+      },
+    })
 
-  res.status(200).json({ payment_session: result })
+    res.status(200).json({ payment_session: result })
+  } catch {
+    res.status(500).json({ message: "Failed to create payment session" })
+  }
 }

package/src/api/admin/paypal/disconnect/route.ts

@@ -2,7 +2,13 @@ import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
 import type PayPalModuleService from "../../../../modules/paypal/service"
 
 export async function POST(req: MedusaRequest, res: MedusaResponse) {
-  const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
-  await paypal.disconnect()
-  return res.json({ ok: true })
+  try {
+    const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
+    await paypal.disconnect()
+    return res.json({ ok: true })
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e)
+    console.error("[PayPal] disconnect failed:", message)
+    return res.status(500).json({ message: "Failed to disconnect PayPal" })
+  }
 }

package/src/api/admin/paypal/environment/route.ts

@@ -19,7 +19,7 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     await paypal.setEnvironment(env)
     const status = await paypal.getStatus()
     return res.json(status)
-  } catch (e: any) {
-    return res.status(500).json({ message: e?.message || "Unknown error" })
+  } catch {
+    return res.status(500).json({ message: "Failed to update environment" })
   }
 }

package/src/api/admin/paypal/onboard-complete/route.ts

@@ -25,10 +25,11 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     })
 
     return res.json({ ok: true })
-  } catch (e: any) {
-    console.error("[PayPal] onboard-complete failed", e)
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e)
+    console.error("[PayPal] onboard-complete failed:", message)
     return res.status(500).json({
-      message: e?.message || "Failed to exchange and save PayPal credentials",
+      message: "Failed to exchange and save PayPal credentials",
     })
   }
 }

package/src/api/admin/paypal/onboarding-link/route.ts

@@ -33,7 +33,7 @@ export async function POST(req: AuthenticatedMedusaRequest, res: MedusaResponse)
   } catch (e: any) {
     console.error("[paypal_onboarding] onboarding-link error:", e?.message || e, e?.stack)
     return res.status(500).json({
-      message: e?.message || "Unknown error",
+      message: "Failed to generate PayPal onboarding link",
     })
   }
 }

package/src/api/admin/paypal/onboarding-status/route.ts

@@ -6,12 +6,12 @@ export async function GET(req: MedusaRequest, res: MedusaResponse) {
     const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
     const status = await paypal.getStatus()
     return res.json(status)
-  } catch (e: any) {
-    console.error("[paypal_onboarding] onboarding-status error:", e?.message || e, e?.stack)
-    return res.json({
-      environment: "live",
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e)
+    console.error("[paypal_onboarding] onboarding-status error:", message)
+    return res.status(500).json({
       status: "disconnected",
-      error: e?.message || "Unknown error",
+      message: "Failed to retrieve PayPal status",
     })
   }
 }

package/src/api/admin/paypal/save-credentials/route.ts

@@ -6,17 +6,32 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
   const body = req.body as {
     clientId?: string
     clientSecret?: string
-    environment?: "sandbox" | "live"
+    environment?: string
   }
 
-  if (!body?.clientId || !body?.clientSecret) {
-    return res.status(400).json({ message: "Missing clientId/clientSecret" })
+  if (!body?.clientId || typeof body.clientId !== "string" || body.clientId.length > 200) {
+    return res.status(400).json({ message: "Invalid or missing clientId" })
   }
 
-  await paypal.saveAndHydrateSellerCredentials({
-    clientId: body.clientId,
-    clientSecret: body.clientSecret,
-    environment: body.environment,
-  })
-  return res.json({ ok: true })
+  if (!body?.clientSecret || typeof body.clientSecret !== "string" || body.clientSecret.length > 200) {
+    return res.status(400).json({ message: "Invalid or missing clientSecret" })
+  }
+
+  const environment =
+    body.environment === "sandbox" || body.environment === "live"
+      ? body.environment
+      : undefined
+
+  try {
+    await paypal.saveAndHydrateSellerCredentials({
+      clientId: body.clientId.trim(),
+      clientSecret: body.clientSecret.trim(),
+      environment,
+    })
+    return res.json({ ok: true })
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e)
+    console.error("[PayPal] save-credentials failed:", message)
+    return res.status(500).json({ message: "Failed to save PayPal credentials" })
+  }
 }

package/src/api/admin/paypal/settings/route.ts

@@ -2,13 +2,44 @@ import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
 import type PayPalModuleService from "../../../../modules/paypal/service"
 
 export async function GET(req: MedusaRequest, res: MedusaResponse) {
-  const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
-  return res.json(await paypal.getSettings())
+  try {
+    const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
+    return res.json(await paypal.getSettings())
+  } catch (e: unknown) {
+    console.error("[PayPal] settings GET failed:", e instanceof Error ? e.message : e)
+    return res.status(500).json({ message: "Failed to load PayPal settings" })
+  }
 }
 
+const ALLOWED_SETTINGS_KEYS = new Set([
+  "additional_settings",
+  "paypal_settings",
+  "advanced_card_payments",
+  "pay_later_messaging",
+  "apple_pay",
+  "google_pay",
+  "api_details",
+])
+
 export async function POST(req: MedusaRequest, res: MedusaResponse) {
   const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
 
-  const patch = (req.body && typeof req.body === "object") ? (req.body as Record<string, any>) : {}
-  return res.json(await paypal.saveSettings(patch))
+  const raw = (req.body && typeof req.body === "object") ? (req.body as Record<string, unknown>) : {}
+  const patch: Record<string, unknown> = {}
+  for (const key of Object.keys(raw)) {
+    if (ALLOWED_SETTINGS_KEYS.has(key)) {
+      patch[key] = raw[key]
+    }
+  }
+
+  if (Object.keys(patch).length === 0) {
+    return res.status(400).json({ message: "No valid settings fields provided" })
+  }
+
+  try {
+    return res.json(await paypal.saveSettings(patch as Record<string, Record<string, unknown>>))
+  } catch (e: unknown) {
+    console.error("[PayPal] settings POST failed:", e instanceof Error ? e.message : e)
+    return res.status(500).json({ message: "Failed to save PayPal settings" })
+  }
 }

package/src/api/admin/paypal/status/route.ts

@@ -2,11 +2,16 @@ import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
 import type PayPalModuleService from "../../../../modules/paypal/service"
 
 export async function GET(req: MedusaRequest, res: MedusaResponse) {
-  const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
+  try {
+    const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
 
-  const q = (req.query || {}) as Record<string, any>
-  const envParam = (q.environment || q.env) as string | undefined
-  const env = envParam === "live" ? "live" : envParam === "sandbox" ? "sandbox" : undefined
+    const q = (req.query || {}) as Record<string, any>
+    const envParam = (q.environment || q.env) as string | undefined
+    const env = envParam === "live" ? "live" : envParam === "sandbox" ? "sandbox" : undefined
 
-  return res.json(await paypal.getStatus(env))
+    return res.json(await paypal.getStatus(env))
+  } catch (e: unknown) {
+    console.error("[PayPal] status GET failed:", e instanceof Error ? e.message : e)
+    return res.status(500).json({ message: "Failed to retrieve PayPal status" })
+  }
 }

package/src/api/store/paypal/capture-order/route.ts

@@ -8,6 +8,8 @@ import { isPayPalProviderId } from "../../../../modules/paypal/utils/provider-id
 
 const BN_CODE = "MBJTechnolabs_SI_SPB"
 
+const PAYPAL_ORDER_ID_RE = /^[A-Z0-9]{10,25}$/
+
 type Body = {
   cart_id: string
   order_id: string
@@ -188,6 +190,27 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
       return res.status(400).json({ message: "cart_id and order_id are required" })
     }
 
+    if (typeof cartId !== "string" || !cartId.startsWith("cart_")) {
+      return res.status(400).json({ message: "Invalid cart_id format" })
+    }
+
+    if (!PAYPAL_ORDER_ID_RE.test(orderId)) {
+      return res.status(400).json({ message: "Invalid order_id format" })
+    }
+
+    const session = await findPayPalSessionForCart(cartId, scope)
+    if (session) {
+      const sessionOrderId = String(
+        (session.session_data?.paypal as Record<string, unknown>)?.order_id ||
+        session.session_data?.order_id || ""
+      )
+      if (sessionOrderId && sessionOrderId !== orderId) {
+        return res.status(400).json({
+          message: "order_id does not match the payment session for this cart",
+        })
+      }
+    }
+
     const existingCapture = await getExistingCapture(cartId, orderId, scope)
     if (existingCapture) {
       return res.json({ capture: existingCapture })
@@ -207,10 +230,11 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
         : "capture"
 
     const requestId = resolveIdempotencyKey(req, "capture-order", `pp-capture-${orderId}`)
+    const safeOrderId = encodeURIComponent(orderId)
     const endpoint =
       paymentAction === "authorize"
-        ? `${base}/v2/checkout/orders/${orderId}/authorize`
-        : `${base}/v2/checkout/orders/${orderId}/capture`
+        ? `${base}/v2/checkout/orders/${safeOrderId}/authorize`
+        : `${base}/v2/checkout/orders/${safeOrderId}/capture`
 
     const ppResp = await fetch(endpoint, {
       method: "POST",
@@ -260,6 +284,6 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
       await paypal.recordMetric("capture_order_failed")
     } catch {
     }
-    return res.status(500).json({ message: e?.message || "Failed to capture PayPal order" })
+    return res.status(500).json({ message: "Failed to capture PayPal order" })
   }
 }

package/src/api/store/paypal/config/route.ts

@@ -94,7 +94,7 @@ export async function GET(req: MedusaRequest, res: MedusaResponse) {
       button_height: paypalSettings.buttonHeight ?? 45,
       button_label: paypalSettings.buttonLabel || "paypal",
     })
-  } catch (e: any) {
-    return res.status(500).json({ message: e?.message || "Failed to load PayPal config" })
+  } catch {
+    return res.status(500).json({ message: "Failed to load PayPal config" })
   }
 }

package/src/api/store/paypal/create-order/route.ts

@@ -111,10 +111,14 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     const cartId = body.cart_id
     const isCardPayment = !!(body as any).is_card_payment
 
-    if (!cartId) {
+    if (!cartId || typeof cartId !== "string") {
       return res.status(400).json({ message: "cart_id is required" })
     }
 
+    if (!cartId.startsWith("cart_")) {
+      return res.status(400).json({ message: "Invalid cart_id format" })
+    }
+
     const existingOrderId = await getExistingPayPalOrderId(req, cartId)
     if (existingOrderId) {
       return res.json({ id: existingOrderId })
@@ -290,11 +294,13 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     )
     const roundedItemSumFixed = parseFloat(roundedItemSum.toFixed(exponent))
 
-    const adjustedItemTotal = roundedItemSumFixed
+    const finalPurchaseItems = purchaseItemsRaw.map((item: any) => item.paypalItem)
 
-    const diff = parseFloat((adjustedItemTotal - roundedItemSumFixed).toFixed(exponent))
+    const adjustedItemTotal = sendItemDetails && finalPurchaseItems.length > 0
+      ? roundedItemSumFixed
+      : subtotalMajor
 
-    const finalPurchaseItems = purchaseItemsRaw.map((item: any) => item.paypalItem)
+    const diff = parseFloat((subtotalMajor - roundedItemSumFixed).toFixed(exponent))
 
     if (Math.abs(diff) > 0.000001 && sendItemDetails && finalPurchaseItems.length > 0) {
       finalPurchaseItems.push({
@@ -438,12 +444,12 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
       await paypal.recordMetric("create_order_failed")
     } catch {
     }
-    const message = e?.message || "Failed to create PayPal order"
-    const status = message.includes("PayPal does not support currency")
-      ? 400
-      : message.includes("PayPal is configured for")
-        ? 400
-        : 500
+    const rawMessage = e?.message || ""
+    const isCurrencyError =
+      rawMessage.includes("PayPal does not support currency") ||
+      rawMessage.includes("PayPal is configured for")
+    const status = isCurrencyError ? 400 : 500
+    const message = isCurrencyError ? rawMessage : "Failed to create PayPal order"
     return res.status(status).json({ message })
   }
 }

package/src/api/store/paypal/settings/route.ts

@@ -11,9 +11,9 @@ export async function GET(req: MedusaRequest, res: MedusaResponse) {
 
     return res.json({
       paymentAction: additionalSettings.paymentAction === "authorize" ? "authorize" : "capture",
-      advancedCardEnabled: advancedCard.enabled === true,
+      advancedCardEnabled: advancedCard.enabled !== false,
     })
-  } catch (e: any) {
-    return res.status(500).json({ message: e?.message || "Failed to load PayPal settings" })
+  } catch {
+    return res.status(500).json({ message: "Failed to load PayPal settings" })
   }
 }

package/src/api/store/paypal/webhook/route.ts

@@ -140,6 +140,16 @@ async function verifyWebhookSignature(
     webhook_event: body,
   }
 
+  const certUrl = verifyPayload.cert_url
+  if (
+    certUrl &&
+    !certUrl.startsWith("https://www.paypal.com/") &&
+    !certUrl.startsWith("https://api-m.paypal.com/") &&
+    !certUrl.startsWith("https://api-m.sandbox.paypal.com/")
+  ) {
+    throw new Error("Invalid paypal-cert-url: must originate from paypal.com")
+  }
+
   const missing = Object.entries(verifyPayload)
     .filter(([k, v]) => k !== "webhook_id" && k !== "webhook_event" && !v)
     .map(([k]) => k)
@@ -208,7 +218,7 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     console.error("[PayPal] webhook: signature verification failed:", e?.message)
     return res
       .status(401)
-      .json({ message: e?.message || "Webhook signature verification failed" })
+      .json({ message: "Webhook signature verification failed" })
   }
 
   const eventVersion = normalizeEventVersion(payload)
@@ -316,10 +326,10 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     await paypal.recordMetric("webhook_failed").catch(() => {})
 
     if (!retryable) {
-      return res.status(200).json({ ok: false, message: e?.message })
+      return res.status(200).json({ ok: false, message: "Webhook processing failed" })
     }
     return res
       .status(500)
-      .json({ message: e?.message || "PayPal webhook processing error" })
+      .json({ message: "PayPal webhook processing error" })
   }
 }

package/src/api/store/paypal-complete/route.ts

@@ -6,8 +6,12 @@ import type PayPalModuleService from "../../../modules/paypal/service"
 export async function POST(req: MedusaRequest, res: MedusaResponse) {
   const { cart_id } = req.body as { cart_id: string }
 
-  if (!cart_id) {
-    return res.status(400).json({ error: "cart_id is required" })
+  if (!cart_id || typeof cart_id !== "string") {
+    return res.status(400).json({ message: "cart_id is required" })
+  }
+
+  if (!cart_id.startsWith("cart_")) {
+    return res.status(400).json({ message: "Invalid cart_id format" })
   }
 
   try {
@@ -36,7 +40,7 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
       )[0]
 
     if (!session) {
-      return res.status(400).json({ error: "No PayPal payment session found for cart" })
+      return res.status(400).json({ message: "No PayPal payment session found for cart" })
     }
 
     const currentStatus = String(session.status || "")
@@ -90,6 +94,6 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
     return res.json({ success: true, session_id: session.id })
   } catch (e: any) {
     console.error("[paypal-complete] error:", e?.message || e)
-    return res.status(500).json({ error: e?.message || "Internal error" })
+    return res.status(500).json({ message: "Internal error" })
   }
 }