@easypayment/medusa-payment-paypal 0.9.4 → 0.9.6

package/src/modules/paypal/clients/paypal-seller.client.ts

@@ -30,7 +30,7 @@ export class PayPalSellerClient {
   }
 
   async getOrder(orderId: string) {
-    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders/${orderId}`, {
+    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
       method: "GET",
       headers: this.headers(),
     })
@@ -40,7 +40,7 @@ export class PayPalSellerClient {
   }
 
   async captureOrder(orderId: string) {
-    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders/${orderId}/capture`, {
+    const res = await fetch(`${this.baseUrl()}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`, {
       method: "POST",
       headers: this.headers(),
     })
@@ -50,7 +50,7 @@ export class PayPalSellerClient {
   }
 
   async refundCapture(captureId: string, body?: any) {
-    const res = await fetch(`${this.baseUrl()}/v2/payments/captures/${captureId}/refund`, {
+    const res = await fetch(`${this.baseUrl()}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
       method: "POST",
       headers: this.headers(),
       body: body ? JSON.stringify(body) : "{}",

package/src/modules/paypal/migrations/20270101090000_set_paypal_environment_default_live.ts

@@ -1,4 +1,4 @@
-import { Migration } from "@mikro-orm/migrations"
+import { Migration } from "@medusajs/framework/mikro-orm/migrations"
 
 export class Migration20270101090000 extends Migration {
   override async up(): Promise<void> {

package/src/modules/paypal/migrations/20270102090000_add_paypal_seller_email.ts

@@ -1,4 +1,4 @@
-import { Migration } from "@mikro-orm/migrations"
+import { Migration } from "@medusajs/framework/mikro-orm/migrations"
 
 export class Migration20270102090000 extends Migration {
   override async up(): Promise<void> {

package/src/modules/paypal/migrations/20270103090000_add_paypal_seller_merchant_id.ts

@@ -1,4 +1,4 @@
-import { Migration } from "@mikro-orm/migrations"
+import { Migration } from "@medusajs/framework/mikro-orm/migrations"
 
 export class Migration20270103090000 extends Migration {
   override async up(): Promise<void> {

package/src/modules/paypal/migrations/20270202000000_align_nullable_defaults.ts

@@ -0,0 +1,44 @@
+import { Migration } from "@medusajs/framework/mikro-orm/migrations"
+
+export class Migration20270202000000 extends Migration {
+  async up(): Promise<void> {
+    this.addSql(
+      `ALTER TABLE IF EXISTS "paypal_connection" ALTER COLUMN "metadata" DROP NOT NULL;`
+    )
+    this.addSql(
+      `ALTER TABLE IF EXISTS "paypal_webhook_event" ALTER COLUMN "payload" DROP NOT NULL;`
+    )
+    this.addSql(
+      `ALTER TABLE IF EXISTS "paypal_metric" ALTER COLUMN "data" DROP NOT NULL;`
+    )
+    this.addSql(
+      `CREATE INDEX IF NOT EXISTS "idx_paypal_connection_status" ON "paypal_connection" ("status", "created_at" DESC);`
+    )
+    this.addSql(
+      `CREATE INDEX IF NOT EXISTS "idx_paypal_webhook_event_type" ON "paypal_webhook_event" ("event_type");`
+    )
+  }
+
+  async down(): Promise<void> {
+    this.addSql(
+      `UPDATE "paypal_connection" SET "metadata" = '{}'::jsonb WHERE "metadata" IS NULL;`
+    )
+    this.addSql(
+      `ALTER TABLE IF EXISTS "paypal_connection" ALTER COLUMN "metadata" SET NOT NULL;`
+    )
+    this.addSql(
+      `UPDATE "paypal_webhook_event" SET "payload" = '{}'::jsonb WHERE "payload" IS NULL;`
+    )
+    this.addSql(
+      `ALTER TABLE IF EXISTS "paypal_webhook_event" ALTER COLUMN "payload" SET NOT NULL;`
+    )
+    this.addSql(
+      `UPDATE "paypal_metric" SET "data" = '{}'::jsonb WHERE "data" IS NULL;`
+    )
+    this.addSql(
+      `ALTER TABLE IF EXISTS "paypal_metric" ALTER COLUMN "data" SET NOT NULL;`
+    )
+    this.addSql(`DROP INDEX IF EXISTS "idx_paypal_connection_status";`)
+    this.addSql(`DROP INDEX IF EXISTS "idx_paypal_webhook_event_type";`)
+  }
+}

package/src/modules/paypal/models/paypal_connection.ts

@@ -3,8 +3,8 @@ import { model } from "@medusajs/framework/utils"
 const PayPalConnection = model.define("paypal_connection", {
   id: model.id().primaryKey(),
 
-  environment: model.text(),
-  status: model.text(),
+  environment: model.text().default("live"),
+  status: model.text().default("disconnected"),
 
   shared_id: model.text().nullable(),
   auth_code: model.text().nullable(),
@@ -17,7 +17,7 @@ const PayPalConnection = model.define("paypal_connection", {
   app_access_token: model.text().nullable(),
   app_access_token_expires_at: model.dateTime().nullable(),
 
-  metadata: model.json().nullable(),
+  metadata: model.json().default({}),
 })
 
 export default PayPalConnection

package/src/modules/paypal/models/paypal_metric.ts

@@ -3,7 +3,7 @@ import { model } from "@medusajs/framework/utils"
 const PayPalMetric = model.define("paypal_metric", {
   id: model.id().primaryKey(),
   name: model.text().unique(),
-  data: model.json().nullable(),
+  data: model.json().default({}),
 })
 
 export default PayPalMetric

package/src/modules/paypal/models/paypal_webhook_event.ts

@@ -13,7 +13,7 @@ const PayPalWebhookEvent = model.define("paypal_webhook_event", {
   processed_at: model.dateTime().nullable(),
   last_error: model.text().nullable(),
   resource_id: model.text().nullable(),
-  payload: model.json().nullable(),
+  payload: model.json().default({}),
 })
 
 export default PayPalWebhookEvent

package/src/modules/paypal/payment-provider/card-service.ts

@@ -25,7 +25,7 @@ import type {
   WebhookActionResult,
 } from "@medusajs/framework/types"
 import { getPayPalWebhookActionAndData } from "./webhook-utils"
-import { formatAmountForPayPal, getCurrencyExponent } from "../utils/amounts"
+import { formatAmountForPayPal } from "../utils/amounts"
 import {
   assertPayPalCurrencySupported,
   normalizeCurrencyCode,
@@ -68,24 +68,10 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
   private async resolveSettings() {
     const paypal = this.resolvePayPalService()
     if (!paypal) {
-      try {
-        const { Pool: _SettingsPool } = require("pg")
-        const _sPool = new _SettingsPool({ connectionString: process.env.DATABASE_URL })
-        const _sResult = await _sPool
-          .query("SELECT data FROM paypal_settings ORDER BY created_at DESC LIMIT 1")
-          .finally(() => _sPool.end())
-        const _sData = _sResult.rows[0]?.data || {}
-        return {
-          additionalSettings: (_sData.additional_settings || {}) as Record<string, any>,
-          advancedCardSettings: (_sData.advanced_card_payments || {}) as Record<string, any>,
-          apiDetails: (_sData.api_details || {}) as Record<string, any>,
-        }
-      } catch {
-        return {
-          additionalSettings: {} as Record<string, any>,
-          advancedCardSettings: {} as Record<string, any>,
-          apiDetails: {} as Record<string, any>,
-        }
+      return {
+        additionalSettings: {} as Record<string, any>,
+        advancedCardSettings: {} as Record<string, any>,
+        apiDetails: {} as Record<string, any>,
       }
     }
     const settings = await paypal.getSettings().catch(() => ({}))
@@ -110,60 +96,21 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
 
   private async getPayPalAccessToken() {
     const paypal = this.resolvePayPalService()
-    let client_id: string
-    let client_secret: string
-    let environment: string
-
     if (!paypal) {
-      const { Pool: _FbPool } = require("pg")
-      const _fbPool = new _FbPool({ connectionString: process.env.DATABASE_URL })
-      const _fbResult = await _fbPool
-        .query(
-          "SELECT metadata, environment, seller_client_id, seller_client_secret FROM paypal_connection WHERE status='connected' ORDER BY created_at DESC LIMIT 1"
-        )
-        .finally(() => _fbPool.end())
-      const _fbRow = _fbResult.rows[0]
-      if (!_fbRow) throw new Error("No active PayPal connection found in DB")
-      environment = _fbRow.environment || "sandbox"
-      const _fbCreds = (_fbRow.metadata?.credentials?.[environment]) || {}
-      client_id = _fbCreds.client_id || _fbRow.seller_client_id
-      client_secret = _fbCreds.client_secret || _fbRow.seller_client_secret
-      console.info("[PayPal Card] getPayPalAccessToken fallback via DB for env:", environment)
-    } else {
-      const creds = await paypal.getActiveCredentials()
-      client_id = creds.client_id
-      client_secret = creds.client_secret
-      environment = creds.environment
+      throw new Error("PayPal service is not available. Cannot obtain access token without a valid PayPal connection.")
     }
-
+    const creds = await paypal.getActiveCredentials()
     const base =
-      environment === "live"
+      creds.environment === "live"
         ? "https://api-m.paypal.com"
         : "https://api-m.sandbox.paypal.com"
-    const auth = Buffer.from(`${client_id}:${client_secret}`).toString("base64")
-
-    const resp = await fetch(`${base}/v1/oauth2/token`, {
-      method: "POST",
-      headers: {
-        Authorization: `Basic ${auth}`,
-        "Content-Type": "application/x-www-form-urlencoded",
-        "PayPal-Partner-Attribution-Id": BN_CODE,
-      },
-      body: "grant_type=client_credentials",
-    })
-
-    const text = await resp.text()
-    if (!resp.ok) {
-      throw new Error(`PayPal token error (${resp.status}): ${text}`)
-    }
-
-    const json = JSON.parse(text)
-    return { accessToken: String(json.access_token), base }
+    const accessToken = await paypal.getAppAccessToken()
+    return { accessToken, base }
   }
 
   private async getOrderDetails(orderId: string) {
     const { accessToken, base } = await this.getPayPalAccessToken()
-    const resp = await fetch(`${base}/v2/checkout/orders/${orderId}`, {
+    const resp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -422,7 +369,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
     if (existingAuthorization) {
       authorization = order
     } else {
-      const authorizeResp = await fetch(`${base}/v2/checkout/orders/${orderId}/authorize`, {
+      const authorizeResp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -513,7 +460,7 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
       order?.intent || paypalData.order?.intent || data.intent || ""
     ).toUpperCase()
     if (!authorizationId && resolvedIntent === "AUTHORIZE") {
-      const authorizeResp = await fetch(`${base}/v2/checkout/orders/${orderId}/authorize`, {
+      const authorizeResp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -541,13 +488,12 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
       data.is_final_capture ??
       data.final_capture ??
       undefined
-    const captureExponent = getCurrencyExponent(currencyCode || "EUR")
     const capturePayload =
       amount > 0
         ? {
             amount: {
               currency_code: currencyCode || "EUR",
-              value: amount.toFixed(captureExponent),
+              value: formatAmountForPayPal(amount, currencyCode || "EUR"),
             },
             ...(typeof isFinalCapture === "boolean"
               ? { is_final_capture: isFinalCapture }
@@ -560,8 +506,8 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
           }
 
     const captureUrl = authorizationId
-      ? `${base}/v2/payments/authorizations/${authorizationId}/capture`
-      : `${base}/v2/checkout/orders/${orderId}/capture`
+      ? `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/capture`
+      : `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`
 
     const ppResp = await fetch(captureUrl, {
       method: "POST",
@@ -613,9 +559,108 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
 
   async cancelPayment(_input: CancelPaymentInput): Promise<CancelPaymentOutput> {
     const data = (_input.data || {}) as Record<string, any>
+    const paypalData = (data.paypal || {}) as Record<string, any>
+    const orderId = String(paypalData.order_id || data.order_id || "")
+    const captureId = String(paypalData.capture_id || data.capture_id || "")
+    const storedAuthorizationId = String(
+      paypalData.authorization_id || data.authorization_id || ""
+    )
+
+    const order = orderId ? await this.getOrderDetails(orderId) : null
+    const intent = String(order?.intent || "").toUpperCase()
+    const authorizationId =
+      order?.purchase_units?.[0]?.payments?.authorizations?.[0]?.id ||
+      storedAuthorizationId
+
+    if (intent === "AUTHORIZE" && authorizationId) {
+      const { accessToken, base } = await this.getPayPalAccessToken()
+      const requestId = this.getIdempotencyKey(_input, `void-${authorizationId}`)
+
+      const resp = await fetch(
+        `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/void`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+            "PayPal-Request-Id": requestId,
+            "PayPal-Partner-Attribution-Id": BN_CODE,
+          },
+        }
+      )
+
+      if (!resp.ok) {
+        const text = await resp.text()
+        const debugId = resp.headers.get("paypal-debug-id")
+        throw new Error(
+          `PayPal void error (${resp.status}): ${text}${
+            debugId ? ` debug_id=${debugId}` : ""
+          }`
+        )
+      }
+    } else if (captureId) {
+      const { accessToken, base } = await this.getPayPalAccessToken()
+      const requestId = this.getIdempotencyKey(_input, `refund-${captureId}`)
+
+      const resp = await fetch(
+        `${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+            "PayPal-Request-Id": requestId,
+            "PayPal-Partner-Attribution-Id": BN_CODE,
+          },
+          body: JSON.stringify({}),
+        }
+      )
+
+      if (!resp.ok) {
+        const text = await resp.text()
+        const debugId = resp.headers.get("paypal-debug-id")
+        throw new Error(
+          `PayPal refund error (${resp.status}): ${text}${
+            debugId ? ` debug_id=${debugId}` : ""
+          }`
+        )
+      }
+
+      const refund = await resp.json().catch(() => ({}))
+      const existingRefunds = Array.isArray(paypalData.refunds) ? paypalData.refunds : []
+      const refundEntry = {
+        id: refund?.id,
+        status: refund?.status,
+        amount: refund?.amount,
+        raw: refund,
+      }
+
+      return {
+        data: {
+          ...(data || {}),
+          paypal: {
+            ...paypalData,
+            order: order || undefined,
+            authorization_id: authorizationId || storedAuthorizationId,
+            capture_id: captureId || paypalData.capture_id,
+            refund_id: refund?.id,
+            refund_status: refund?.status,
+            refunds: [...existingRefunds, refundEntry],
+          },
+          canceled_at: new Date().toISOString(),
+        },
+      }
+    }
+
     return {
       data: {
         ...(data || {}),
+        paypal: {
+          ...paypalData,
+          order: order || undefined,
+          authorization_id: authorizationId || storedAuthorizationId,
+          capture_id: captureId || paypalData.capture_id,
+        },
         canceled_at: new Date().toISOString(),
       },
     }
@@ -626,32 +671,27 @@ class PayPalAdvancedCardProvider extends AbstractPaymentProvider<Options> {
     const paypalData = (data.paypal || {}) as Record<string, any>
     const captureId = String(paypalData.capture_id || data.capture_id || "")
     if (!captureId) {
-      return {
-        data: {
-          ...(data || {}),
-          refunded_at: new Date().toISOString(),
-        },
-      }
+      throw new Error("PayPal capture_id is required to refund payment. No capture found in session data.")
     }
 
     const requestId = this.getIdempotencyKey(_input, `refund-${captureId}`)
     const amount = Number(data.amount ?? 0)
+    const currencyOverride = await this.resolveCurrencyOverride()
     const currencyCode = normalizeCurrencyCode(
-      data.currency_code || process.env.PAYPAL_CURRENCY || "EUR"
+      data.currency_code || currencyOverride || "EUR"
     )
     const { accessToken, base } = await this.getPayPalAccessToken()
-    const refundExponent = getCurrencyExponent(currencyCode)
     const refundPayload: Record<string, any> =
       amount > 0
         ? {
             amount: {
               currency_code: currencyCode,
-              value: amount.toFixed(refundExponent),
+              value: formatAmountForPayPal(amount, currencyCode),
             },
           }
         : {}
 
-    const resp = await fetch(`${base}/v2/payments/captures/${captureId}/refund`, {
+    const resp = await fetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,

package/src/modules/paypal/payment-provider/service.ts

@@ -68,28 +68,15 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
   async resolveSettings() {
     const paypal = this.resolvePayPalService()
     if (!paypal) {
-      try {
-        const { Pool: _SettingsPool } = require("pg")
-        const _sPool = new _SettingsPool({ connectionString: process.env.DATABASE_URL })
-        const _sResult = await _sPool
-          .query("SELECT data FROM paypal_settings ORDER BY created_at DESC LIMIT 1")
-          .finally(() => _sPool.end())
-        const _sData = _sResult.rows[0]?.data || {}
-        return {
-          additionalSettings: (_sData.additional_settings || {}) as Record<string, unknown>,
-          apiDetails: (_sData.api_details || {}) as Record<string, unknown>,
-        }
-      } catch {
-        return {
-          additionalSettings: {} as Record<string, unknown>,
-          apiDetails: {} as Record<string, unknown>,
-        }
+      return {
+        additionalSettings: {} as Record<string, unknown>,
+        apiDetails: {} as Record<string, unknown>,
       }
     }
     const settings = await paypal.getSettings().catch(() => ({}))
     const data =
       settings && typeof settings === "object" && "data" in settings
-        ? ((settings as any).data ?? {})
+        ? ((settings as { data?: Record<string, unknown> }).data ?? {})
         : {}
     return {
       additionalSettings: (data.additional_settings || {}) as Record<string, unknown>,
@@ -108,66 +95,22 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
   private async getPayPalAccessToken() {
     const paypal = this.resolvePayPalService()
     if (!paypal) {
-      const { Pool: _FbPool } = require("pg")
-      const _fbPool = new _FbPool({ connectionString: process.env.DATABASE_URL })
-      const _fbResult = await _fbPool
-        .query(
-          "SELECT metadata, environment, seller_client_id, seller_client_secret FROM paypal_connection WHERE status='connected' ORDER BY created_at DESC LIMIT 1"
-        )
-        .finally(() => _fbPool.end())
-      const _fbRow = _fbResult.rows[0]
-      if (!_fbRow) throw new Error("No active PayPal connection found in DB")
-      const _fbEnv = _fbRow.environment || "sandbox"
-      const _fbCreds =
-        (_fbRow.metadata && _fbRow.metadata.credentials && _fbRow.metadata.credentials[_fbEnv]) || {}
-      const _fbId = _fbCreds.client_id || _fbRow.seller_client_id
-      const _fbSec = _fbCreds.client_secret || _fbRow.seller_client_secret
-      const _fbBase =
-        _fbEnv === "live" ? "https://api-m.paypal.com" : "https://api-m.sandbox.paypal.com"
-      const _fbAuth = Buffer.from(`${_fbId}:${_fbSec}`).toString("base64")
-      const _fbResp = await fetch(`${_fbBase}/v1/oauth2/token`, {
-        method: "POST",
-        headers: {
-          Authorization: `Basic ${_fbAuth}`,
-          "Content-Type": "application/x-www-form-urlencoded",
-          "PayPal-Partner-Attribution-Id": BN_CODE,
-        },
-        body: "grant_type=client_credentials",
-      })
-      const _fbText = await _fbResp.text()
-      if (!_fbResp.ok) throw new Error(`PayPal token error (${_fbResp.status}): ${_fbText}`)
-      const _fbJson = JSON.parse(_fbText)
-      return { accessToken: String(_fbJson.access_token), base: _fbBase }
+      throw new Error(
+        "PayPal module service is unavailable. Ensure the paypal module is registered."
+      )
     }
     const creds = await paypal.getActiveCredentials()
     const base =
       creds.environment === "live"
         ? "https://api-m.paypal.com"
         : "https://api-m.sandbox.paypal.com"
-    const auth = Buffer.from(`${creds.client_id}:${creds.client_secret}`).toString("base64")
-
-    const resp = await fetch(`${base}/v1/oauth2/token`, {
-      method: "POST",
-      headers: {
-        Authorization: `Basic ${auth}`,
-        "Content-Type": "application/x-www-form-urlencoded",
-        "PayPal-Partner-Attribution-Id": BN_CODE,
-      },
-      body: "grant_type=client_credentials",
-    })
-
-    const text = await resp.text()
-    if (!resp.ok) {
-      throw new Error(`PayPal token error (${resp.status}): ${text}`)
-    }
-
-    const json = JSON.parse(text)
-    return { accessToken: String(json.access_token), base }
+    const accessToken = await paypal.getAppAccessToken()
+    return { accessToken, base }
   }
 
   private async getOrderDetails(orderId: string) {
     const { accessToken, base } = await this.getPayPalAccessToken()
-    const resp = await fetch(`${base}/v2/checkout/orders/${orderId}`, {
+    const resp = await fetch(`${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -488,7 +431,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         authorization = order
       } else {
         const authorizeResp = await fetch(
-          `${base}/v2/checkout/orders/${newOrderId}/authorize`,
+          `${base}/v2/checkout/orders/${encodeURIComponent(newOrderId)}/authorize`,
           {
             method: "POST",
             headers: {
@@ -671,7 +614,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
 
       if (!authorizationId && resolvedIntent === "AUTHORIZE") {
         const authorizeResp = await fetch(
-          `${base}/v2/checkout/orders/${orderId}/authorize`,
+          `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/authorize`,
           {
             method: "POST",
             headers: {
@@ -701,13 +644,15 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         data.is_final_capture ??
         data.final_capture ??
         undefined
-      const captureExponent = getCurrencyExponent(currencyCode || "EUR")
+      const captureValue = amount > 0
+        ? formatAmountForPayPal(amount, currencyCode || "EUR")
+        : null
       const capturePayload =
-        amount > 0
+        captureValue
           ? {
               amount: {
                 currency_code: currencyCode || "EUR",
-                value: amount.toFixed(captureExponent),
+                value: captureValue,
               },
               ...(typeof isFinalCapture === "boolean"
                 ? { is_final_capture: isFinalCapture }
@@ -720,8 +665,8 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
             }
 
       const captureUrl = authorizationId
-        ? `${base}/v2/payments/authorizations/${authorizationId}/capture`
-        : `${base}/v2/checkout/orders/${orderId}/capture`
+        ? `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/capture`
+        : `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`
 
       const ppResp = await fetch(captureUrl, {
         method: "POST",
@@ -801,12 +746,9 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
       paypalData.refund_reason_code || data.refund_reason_code || data.reason_code || ""
     ).trim()
     if (!captureId) {
-      return {
-        data: {
-          ...(input.data || {}),
-          refunded_at: new Date().toISOString(),
-        },
-      }
+      throw new Error(
+        "PayPal capture_id is required to refund payment. No capture found in session data."
+      )
     }
 
     const requestId = this.getIdempotencyKey(input, `refund-${captureId}`)
@@ -816,11 +758,10 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
       data.currency_code || currencyOverride || "EUR"
     )
 
-    const exponent = currencyCode.toUpperCase() === "JPY" ? 0
-      : ["BHD", "JOD", "KWD", "OMR", "TND"].includes(currencyCode.toUpperCase()) ? 3
-      : 2
     const refundAmount = Number(input.amount ?? 0)
-    const refundValue = refundAmount > 0 ? refundAmount.toFixed(exponent) : null
+    const refundValue = refundAmount > 0
+      ? formatAmountForPayPal(refundAmount, currencyCode)
+      : null
 
     let debugId: string | null = null
 
@@ -840,7 +781,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         refundPayload.note_to_payer = refundReason
       }
 
-      const ppResp = await fetch(`${base}/v2/payments/captures/${captureId}/refund`, {
+      const ppResp = await fetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -931,7 +872,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         const requestId = this.getIdempotencyKey(input, `void-${authorizationId}`)
 
         const resp = await fetch(
-          `${base}/v2/payments/authorizations/${authorizationId}/void`,
+          `${base}/v2/payments/authorizations/${encodeURIComponent(authorizationId)}/void`,
           {
             method: "POST",
             headers: {
@@ -962,7 +903,7 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
         const { accessToken, base } = await this.getPayPalAccessToken()
         const requestId = this.getIdempotencyKey(input, `refund-${captureId}`)
 
-        const resp = await fetch(`${base}/v2/payments/captures/${captureId}/refund`, {
+        const resp = await fetch(`${base}/v2/payments/captures/${encodeURIComponent(captureId)}/refund`, {
           method: "POST",
           headers: {
             Authorization: `Bearer ${accessToken}`,
@@ -991,11 +932,24 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
           amount: refund?.amount,
           raw: refund,
         }
-        paypalData.refund_id = refund?.id
-        paypalData.refund_status = refund?.status
-        paypalData.refunds = [...existingRefunds, refundEntry]
 
         await this.recordSuccess("cancel_refund_success")
+
+        return {
+          data: {
+            ...(input.data || {}),
+            paypal: {
+              ...((input.data || {}).paypal as Record<string, unknown>),
+              order: order || undefined,
+              authorization_id: authorizationId || storedAuthorizationId,
+              capture_id: captureId || paypalData.capture_id,
+              refund_id: refund?.id,
+              refund_status: refund?.status,
+              refunds: [...existingRefunds, refundEntry],
+            },
+            canceled_at: new Date().toISOString(),
+          },
+        }
       }
 
       return {
@@ -1006,9 +960,6 @@ class PayPalPaymentProvider extends AbstractPaymentProvider<Options> {
             order: order || undefined,
             authorization_id: authorizationId || storedAuthorizationId,
             capture_id: captureId || paypalData.capture_id,
-            refund_id: paypalData.refund_id,
-            refund_status: paypalData.refund_status,
-            refunds: paypalData.refunds,
           },
           canceled_at: new Date().toISOString(),
         },