@easypayment/medusa-payment-paypal 0.9.4 → 0.9.6

package/src/modules/paypal/payment-provider/webhook-utils.ts

@@ -52,6 +52,15 @@ function resolveAmount(resource: any): number | undefined {
   return Number.isFinite(parsed) ? parsed : undefined
 }
 
+function resolveCurrencyCode(resource: any): string | undefined {
+  const amount =
+    resource?.amount ||
+    resource?.purchase_units?.[0]?.amount ||
+    resource?.purchase_units?.[0]?.payments?.captures?.[0]?.amount ||
+    resource?.purchase_units?.[0]?.payments?.authorizations?.[0]?.amount
+  return amount?.currency_code || undefined
+}
+
 function resolveEventType(payload: ProviderWebhookPayload["payload"]) {
   const raw = payload as { event_type?: string; eventType?: string }
   return raw?.event_type || raw?.eventType

package/src/modules/paypal/service.ts

@@ -22,6 +22,7 @@ class PayPalModuleService extends MedusaService({
   PayPalWebhookEvent,
 }) {
   protected cfg = getPayPalConfig()
+  private tokenRefreshPromise: Promise<string> | null = null
 
   private get bnCode(): string {
     return this.cfg.bnCode || "MBJTechnolabs_SI_SPB"
@@ -142,10 +143,14 @@ class PayPalModuleService extends MedusaService({
     }
   }
 
-  private extractSellerEmail(...candidates: any[]): string | null {
+  private extractSellerEmail(...candidates: unknown[]): string | null {
     const queue = [...candidates]
+    const seen = new WeakSet<object>()
+    const MAX_ITERATIONS = 500
 
-    while (queue.length > 0) {
+    let iterations = 0
+    while (queue.length > 0 && iterations < MAX_ITERATIONS) {
+      iterations++
       const value = queue.shift()
       if (!value) {
         continue
@@ -159,34 +164,41 @@ class PayPalModuleService extends MedusaService({
         continue
       }
 
+      if (typeof value !== "object") {
+        continue
+      }
+
+      if (seen.has(value as object)) {
+        continue
+      }
+      seen.add(value as object)
+
       if (Array.isArray(value)) {
         queue.push(...value)
         continue
       }
 
-      if (typeof value === "object") {
-        const obj = value as Record<string, any>
-        const prioritized = [
-          obj.email,
-          obj.primary_email,
-          obj.merchant_email,
-          obj.email_address,
-          obj.account_email,
-          obj.contact_email,
-          obj.value,
-          obj.address,
-        ]
-        queue.push(...prioritized)
-
-        for (const [k, v] of Object.entries(obj)) {
-          const key = String(k).toLowerCase()
-          if (key.includes("email") || key.includes("address")) {
-            queue.push(v)
-          }
+      const obj = value as Record<string, unknown>
+      const prioritized = [
+        obj.email,
+        obj.primary_email,
+        obj.merchant_email,
+        obj.email_address,
+        obj.account_email,
+        obj.contact_email,
+        obj.value,
+        obj.address,
+      ]
+      queue.push(...prioritized)
+
+      for (const [k, v] of Object.entries(obj)) {
+        const key = String(k).toLowerCase()
+        if (key.includes("email") || key.includes("address")) {
+          queue.push(v)
         }
-
-        queue.push(...Object.values(obj))
       }
+
+      queue.push(...Object.values(obj))
     }
 
     return null
@@ -477,8 +489,7 @@ class PayPalModuleService extends MedusaService({
 
     const products = input?.products?.length ? input.products : ["PPCP"]
 
-    products.forEach((p, i) => {
-      form.append(`products[${i}]`, p)
+    products.forEach((p) => {
       form.append("products[]", p)
     })
 
@@ -758,16 +769,10 @@ class PayPalModuleService extends MedusaService({
 
     const nextCreds = {
       client_id: input.clientId,
-      clientId: input.clientId,
       client_secret: input.clientSecret,
-      clientSecret: input.clientSecret,
-      merchantId: nextSellerMerchantId,
       merchant_id: nextSellerMerchantId,
-      payer_id: nextSellerMerchantId,
       seller_merchant_id: nextSellerMerchantId,
-      sellerMerchantId: nextSellerMerchantId,
       seller_email: nextSellerEmail,
-      sellerEmail: nextSellerEmail,
     }
 
     if (!row) {
@@ -1082,19 +1087,31 @@ class PayPalModuleService extends MedusaService({
 
   async getAppAccessToken(): Promise<string> {
     const row = await this.getCurrentRow()
-    const env = await this.getCurrentEnvironment()
-    const creds = await this.getActiveCredentials()
 
     if (!row) {
       throw new Error("PayPal connection row not found. Please complete onboarding.")
     }
 
-    const expiresAt = row.app_access_token_expires_at ? new Date(row.app_access_token_expires_at as any) : null
+    const expiresAt = row.app_access_token_expires_at ? new Date(row.app_access_token_expires_at as string) : null
     if (row.app_access_token && expiresAt) {
       const msLeft = expiresAt.getTime() - Date.now()
-      if (msLeft > 2 * 60 * 1000) return row.app_access_token
+      if (msLeft > 2 * 60 * 1000) return row.app_access_token as string
+    }
+
+    if (this.tokenRefreshPromise) {
+      return this.tokenRefreshPromise
     }
 
+    this.tokenRefreshPromise = this.refreshAccessToken(row).finally(() => {
+      this.tokenRefreshPromise = null
+    })
+
+    return this.tokenRefreshPromise
+  }
+
+  private async refreshAccessToken(row: { id: string }): Promise<string> {
+    const env = await this.getCurrentEnvironment()
+    const creds = await this.getActiveCredentials()
     const baseUrl = env === "live" ? "https://api-m.paypal.com" : "https://api-m.sandbox.paypal.com"
     const basic = Buffer.from(`${creds.client_id}:${creds.client_secret}`).toString("base64")
 
@@ -1109,19 +1126,23 @@ class PayPalModuleService extends MedusaService({
         "PayPal-Partner-Attribution-Id": this.bnCode,
       },
       body,
+      signal: AbortSignal.timeout(30_000),
     })
 
     const json = await res.json().catch(() => ({}))
     if (!res.ok) throw new Error(`PayPal client_credentials failed (${res.status}): ${JSON.stringify(json)}`)
 
-    const accessToken = String(json.access_token)
+    const accessToken = String(json.access_token || "")
+    if (!accessToken) {
+      throw new Error("PayPal client_credentials succeeded but access_token is missing.")
+    }
     const expiresIn = Number(json.expires_in || 3600)
     const newExpiresAt = new Date(Date.now() + expiresIn * 1000)
 
     await this.updatePayPalConnections({
       id: row.id,
       app_access_token: accessToken,
-      app_access_token_expires_at: newExpiresAt as any,
+      app_access_token_expires_at: newExpiresAt as unknown as Date,
     })
 
     return accessToken
@@ -1232,39 +1253,26 @@ class PayPalModuleService extends MedusaService({
       throw new Error("PayPal orderId is required")
     }
 
-    const creds = await this.getActiveCredentials()
+    const env = await this.getCurrentEnvironment()
     const base =
-      creds.environment === "live"
+      env === "live"
         ? "https://api-m.paypal.com"
         : "https://api-m.sandbox.paypal.com"
-    const auth = Buffer.from(`${creds.client_id}:${creds.client_secret}`).toString("base64")
 
-    const tokenResp = await fetch(`${base}/v1/oauth2/token`, {
-      method: "POST",
-      headers: {
-        Authorization: `Basic ${auth}`,
-        "Content-Type": "application/x-www-form-urlencoded",
-        "PayPal-Partner-Attribution-Id": this.bnCode,
-      },
-      body: "grant_type=client_credentials",
-    })
-
-    const tokenText = await tokenResp.text()
-    if (!tokenResp.ok) {
-      throw new Error(`PayPal token error (${tokenResp.status}): ${tokenText}`)
-    }
-
-    const tokenJson = JSON.parse(tokenText)
-    const accessToken = String(tokenJson.access_token)
+    const accessToken = await this.getAppAccessToken()
 
-    const resp = await fetch(`${base}/v2/checkout/orders/${orderId}`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
-        "PayPal-Partner-Attribution-Id": this.bnCode,
-      },
-    })
+    const resp = await fetch(
+      `${base}/v2/checkout/orders/${encodeURIComponent(orderId)}`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json",
+          "PayPal-Partner-Attribution-Id": this.bnCode,
+        },
+        signal: AbortSignal.timeout(30_000),
+      }
+    )
 
     const text = await resp.text()
     if (!resp.ok) {
@@ -1303,7 +1311,12 @@ class PayPalModuleService extends MedusaService({
       return { created: true, event: created }
     } catch (error: any) {
       const message = String(error?.message || "")
-      if (message.includes("paypal_webhook_event_event_id_unique") || message.includes("unique")) {
+      const code = String(error?.code || "")
+      if (
+        message.includes("paypal_webhook_event_event_id_unique") ||
+        code === "23505" ||
+        (message.includes("unique") && message.includes("event_id"))
+      ) {
         const existing = await this.listPayPalWebhookEvents({ event_id: input.event_id })
         return { created: false, event: existing?.[0] ?? null }
       }

package/src/modules/paypal/types/config.ts

@@ -1,3 +1,5 @@
+import { randomBytes } from "crypto"
+
 export type PayPalModuleConfig = {
   partnerServiceUrl: string
   partnerJsUrl: string
@@ -13,17 +15,31 @@ const STATIC_CFG: PayPalModuleConfig = {
   partnerServiceUrl: "https://mbjtechnolabs.com/ppcp-seller-onboarding/seller-onboarding.php?from=medusa",
   partnerJsUrl: "https://www.paypal.com/webapps/merchantboarding/js/lib/lightbox/partner.js",
   backendUrl: "http://localhost:9000",
-  sellerNonce: "a1233wtergfsdt4365tzrshgfbaewa36AGa1233wtergfsdt4365tzrshgfbaewa36AG",
+  sellerNonce: "",
   bnCode: "MBJTechnolabs_SI_SPB",
   partnerMerchantIdSandbox: "K6QLN2LPGQRHL",
   partnerMerchantIdLive: "GT5R877JNBPLL",
   alertWebhookUrls: [],
 }
 
+function generateSellerNonce(): string {
+  return randomBytes(32).toString("hex")
+}
+
 export function getPayPalConfig(): PayPalModuleConfig {
+  const backendUrl = process.env.MEDUSA_BACKEND_URL || STATIC_CFG.backendUrl
+
   return {
     ...STATIC_CFG,
-    backendUrl: process.env.MEDUSA_BACKEND_URL || STATIC_CFG.backendUrl,
+    partnerServiceUrl:
+      process.env.PAYPAL_PARTNER_SERVICE_URL || STATIC_CFG.partnerServiceUrl,
+    backendUrl,
+    sellerNonce:
+      process.env.PAYPAL_SELLER_NONCE || generateSellerNonce(),
+    partnerMerchantIdSandbox:
+      process.env.PAYPAL_PARTNER_MERCHANT_ID_SANDBOX || STATIC_CFG.partnerMerchantIdSandbox,
+    partnerMerchantIdLive:
+      process.env.PAYPAL_PARTNER_MERCHANT_ID_LIVE || STATIC_CFG.partnerMerchantIdLive,
     alertWebhookUrls:
       (process.env.PAYPAL_ALERT_WEBHOOK_URLS || "")
         .split(",")

package/src/modules/paypal/utils/paypal-auth.ts

@@ -21,6 +21,7 @@ export async function getPayPalAccessToken(opts: {
       "PayPal-Partner-Attribution-Id": BN_CODE,
     },
     body: "grant_type=client_credentials",
+    signal: AbortSignal.timeout(30_000),
   })
   const text = await resp.text()
   if (!resp.ok) {

package/src/modules/paypal/webhook-processor.ts

@@ -297,11 +297,14 @@ export async function processPayPalWebhookEvent(
   if (!cartId) {
     try {
       const paymentModule = container.resolve(Modules.PAYMENT) as any
-      const allSessions = await paymentModule.listPaymentSessions({
-        provider_id: ["pp_paypal_paypal", "pp_paypal_card_paypal_card"],
-      })
-      const matchedSession = (allSessions || []).find((s: any) => {
-        const pp = ((s.data || {}) as Record<string, any>).paypal || {}
+      const allSessions = await paymentModule.listPaymentSessions(
+        {
+          provider_id: ["pp_paypal_paypal", "pp_paypal_card_paypal_card"],
+        },
+        { take: 200 }
+      )
+      const matchedSession = (allSessions || []).find((s: Record<string, unknown>) => {
+        const pp = ((s.data || {}) as Record<string, unknown>).paypal as Record<string, unknown> || {}
         if (orderId && pp.order_id === orderId) return true
         if (captureId && pp.capture_id === captureId) return true
         return false

package/src/subscribers/paypal-order-invoice.ts

@@ -89,7 +89,7 @@ export default async function paypalOrderInvoiceHandler({
     let currentInvoiceId = ""
     try {
       const statusResp = await fetch(
-        `${base}/v2/checkout/orders/${paypalOrderId}`,
+        `${base}/v2/checkout/orders/${encodeURIComponent(paypalOrderId)}`,
         { headers: { Authorization: `Bearer ${accessToken}` } }
       )
       if (statusResp.ok) {
@@ -129,7 +129,7 @@ export default async function paypalOrderInvoiceHandler({
     }
 
     const patchResp = await fetch(
-      `${base}/v2/checkout/orders/${paypalOrderId}`,
+      `${base}/v2/checkout/orders/${encodeURIComponent(paypalOrderId)}`,
       {
         method: "PATCH",
         headers: {
@@ -138,8 +138,8 @@ export default async function paypalOrderInvoiceHandler({
         },
         body: JSON.stringify([
           {
-            op: "replace",
-            path: "/purchase_units/@reference_id=='default'/invoice_id",
+            op: currentInvoiceId ? "replace" : "add",
+            path: "/purchase_units/0/invoice_id",
             value: invoiceId,
           },
         ]),