@easypayment/medusa-paypal 0.6.4 → 0.6.5

package/.medusa/server/src/admin/index.js

@@ -180,9 +180,6 @@ function AdditionalSettingsTab() {
     )
   ] }) });
 }
-function PayPalApplePayPage() {
-  return /* @__PURE__ */ jsxRuntime.jsx(reactRouterDom.Navigate, { to: "/settings/paypal/connection", replace: true });
-}
 async function adminFetch$1(path, opts = {}) {
   var _a;
   const { method = "GET", body, query } = opts;
@@ -322,6 +319,9 @@ function AdvancedCardPaymentsTab() {
     )
   ] }) });
 }
+function PayPalApplePayPage() {
+  return /* @__PURE__ */ jsxRuntime.jsx(reactRouterDom.Navigate, { to: "/settings/paypal/connection", replace: true });
+}
 const config = adminSdk.defineRouteConfig({
   label: "PayPal Connection",
   hide: true
@@ -1206,14 +1206,14 @@ const routeModule = {
       Component: AdditionalSettingsTab,
       path: "/settings/paypal/additional-settings"
     },
-    {
-      Component: PayPalApplePayPage,
-      path: "/settings/paypal/apple-pay"
-    },
     {
       Component: AdvancedCardPaymentsTab,
       path: "/settings/paypal/advanced-card-payments"
     },
+    {
+      Component: PayPalApplePayPage,
+      path: "/settings/paypal/apple-pay"
+    },
     {
       Component: PayPalConnectionPage,
       path: "/settings/paypal/connection"

package/.medusa/server/src/admin/index.mjs

@@ -179,9 +179,6 @@ function AdditionalSettingsTab() {
     )
   ] }) });
 }
-function PayPalApplePayPage() {
-  return /* @__PURE__ */ jsx(Navigate, { to: "/settings/paypal/connection", replace: true });
-}
 async function adminFetch$1(path, opts = {}) {
   var _a;
   const { method = "GET", body, query } = opts;
@@ -321,6 +318,9 @@ function AdvancedCardPaymentsTab() {
     )
   ] }) });
 }
+function PayPalApplePayPage() {
+  return /* @__PURE__ */ jsx(Navigate, { to: "/settings/paypal/connection", replace: true });
+}
 const config = defineRouteConfig({
   label: "PayPal Connection",
   hide: true
@@ -1205,14 +1205,14 @@ const routeModule = {
       Component: AdditionalSettingsTab,
       path: "/settings/paypal/additional-settings"
     },
-    {
-      Component: PayPalApplePayPage,
-      path: "/settings/paypal/apple-pay"
-    },
     {
       Component: AdvancedCardPaymentsTab,
       path: "/settings/paypal/advanced-card-payments"
     },
+    {
+      Component: PayPalApplePayPage,
+      path: "/settings/paypal/apple-pay"
+    },
     {
       Component: PayPalConnectionPage,
       path: "/settings/paypal/connection"

package/.medusa/server/src/api/store/paypal-complete/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/store/paypal-complete/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAK7E,wBAAsB,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,2BAgEjE"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/store/paypal-complete/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAK7E,wBAAsB,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,2BAmGjE"}

package/.medusa/server/src/api/store/paypal-complete/route.js

@@ -8,17 +8,6 @@ async function POST(req, res) {
         return res.status(400).json({ error: "cart_id is required" });
     }
     try {
-        const paypal = req.scope.resolve("paypal_onboarding");
-        const settings = await paypal.getSettings().catch(() => ({}));
-        const settingsData = settings && typeof settings === "object" && "data" in settings
-            ? (settings.data ?? {})
-            : {};
-        const additionalSettings = (settingsData.additional_settings || {});
-        const paymentAction = typeof additionalSettings.paymentAction === "string"
-            ? additionalSettings.paymentAction
-            : "capture";
-        const sessionStatus = paymentAction === "authorize" ? "authorized" : "captured";
-        const timestampKey = paymentAction === "authorize" ? "authorized_at" : "captured_at";
         const query = req.scope.resolve("query");
         const { data: carts } = await query.graph({
             entity: "cart",
@@ -26,6 +15,7 @@ async function POST(req, res) {
                 "id",
                 "payment_collection.payment_sessions.id",
                 "payment_collection.payment_sessions.data",
+                "payment_collection.payment_sessions.status",
                 "payment_collection.payment_sessions.provider_id",
                 "payment_collection.payment_sessions.created_at",
                 "payment_collection.payment_sessions.amount",
@@ -40,14 +30,52 @@ async function POST(req, res) {
         if (!session) {
             return res.status(400).json({ error: "No PayPal payment session found for cart" });
         }
+        // If already authorized or captured, nothing to do
+        const currentStatus = String(session.status || "");
+        if (currentStatus === "authorized" || currentStatus === "captured") {
+            console.info("[paypal-complete] session already in terminal status:", currentStatus);
+            return res.json({ success: true, session_id: session.id, status: currentStatus });
+        }
         const paymentModule = req.scope.resolve(utils_1.Modules.PAYMENT);
-        await paymentModule.updatePaymentSession({
-            id: session.id,
-            data: { ...(session.data || {}), [timestampKey]: new Date().toISOString() },
-            status: sessionStatus,
-            amount: session.amount,
-            currency_code: session.currency_code,
-        });
+        // Read LIVE session data from DB — gets the latest state written by capture-order
+        // (avoids overwriting authorization_id / capture_id that capture-order just saved)
+        const [liveSession] = await paymentModule.listPaymentSessions({ id: [session.id] }, { take: 1 });
+        const liveData = (liveSession?.data || {});
+        // Determine payment action from settings
+        const paypal = req.scope.resolve("paypal_onboarding");
+        const settings = await paypal.getSettings().catch(() => ({}));
+        const settingsData = settings && typeof settings === "object" && "data" in settings
+            ? (settings.data ?? {})
+            : {};
+        const additionalSettings = (settingsData.additional_settings || {});
+        const paymentAction = typeof additionalSettings.paymentAction === "string"
+            ? additionalSettings.paymentAction
+            : "capture";
+        const timestampKey = paymentAction === "authorize" ? "authorized_at" : "captured_at";
+        // Only write timestamp if not already present — avoids overwriting capture-order's data
+        if (!liveData[timestampKey]) {
+            await paymentModule.updatePaymentSession({
+                id: session.id,
+                data: {
+                    ...liveData,
+                    [timestampKey]: new Date().toISOString(),
+                },
+                amount: liveSession?.amount ?? session.amount,
+                currency_code: liveSession?.currency_code ?? session.currency_code,
+            });
+        }
+        // Trigger Medusa's payment state machine — the only correct way to move
+        // a session from "pending" → "authorized".
+        // Calls the provider's authorizePayment() which checks for
+        // authorization_id / authorized_at in data and returns status: "authorized".
+        try {
+            await paymentModule.authorizePaymentSession(session.id, {});
+            console.info("[paypal-complete] authorizePaymentSession succeeded for session", session.id);
+        }
+        catch (e) {
+            // Throws if session is already authorized/captured — that's expected and fine
+            console.warn("[paypal-complete] authorizePaymentSession non-fatal:", e?.message);
+        }
         return res.json({ success: true, session_id: session.id });
     }
     catch (e) {

package/.medusa/server/src/api/store/paypal-complete/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/store/paypal-complete/route.ts"],"names":[],"mappings":";;AAKA,oBAgEC;AAnED,qDAAmD;AAG5C,KAAK,UAAU,IAAI,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA2B,CAAA;IAEnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAsB,mBAAmB,CAAC,CAAA;QAC1E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,MAAM,YAAY,GAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ;YAC5D,CAAC,CAAC,CAAE,QAA2C,CAAC,IAAI,IAAI,EAAE,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACR,MAAM,kBAAkB,GAAG,CAAC,YAAY,CAAC,mBAAmB,IAAI,EAAE,CAAwB,CAAA;QAC1F,MAAM,aAAa,GACjB,OAAO,kBAAkB,CAAC,aAAa,KAAK,QAAQ;YAClD,CAAC,CAAC,kBAAkB,CAAC,aAAa;YAClC,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,aAAa,GAAG,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAA;QAC/E,MAAM,YAAY,GAAG,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAA;QAEpF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;YACxC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,IAAI;gBACJ,wCAAwC;gBACxC,0CAA0C;gBAC1C,iDAAiD;gBACjD,gDAAgD;gBAChD,4CAA4C;gBAC5C,mDAAmD;aACpD;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;SACzB,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,IAAI,EAAE,CAAA;QACvE,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aAClE,IAAI,CACH,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CACjB,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAChF,CAAC,CAAC,CAAC,CAAA;QAEN,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAA;QACpF,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAO,CAAC,OAAO,CAA0B,CAAA;QACjF,MAAO,aAAqB,CAAC,oBAAoB,CAAC;YAChD,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YAC3E,MAAM,EAAE,aAAoB;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAA;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC,CAAA;IACxE,CAAC;AACH,CAAC"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/store/paypal-complete/route.ts"],"names":[],"mappings":";;AAKA,oBAmGC;AAtGD,qDAAmD;AAG5C,KAAK,UAAU,IAAI,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA2B,CAAA;IAEnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;YACxC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,IAAI;gBACJ,wCAAwC;gBACxC,0CAA0C;gBAC1C,4CAA4C;gBAC5C,iDAAiD;gBACjD,gDAAgD;gBAChD,4CAA4C;gBAC5C,mDAAmD;aACpD;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;SACzB,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,IAAI,EAAE,CAAA;QACvE,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aAClE,IAAI,CACH,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CACjB,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAChF,CAAC,CAAC,CAAC,CAAA;QAEN,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAA;QACpF,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QAClD,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,uDAAuD,EAAE,aAAa,CAAC,CAAA;YACpF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAO,CAAC,OAAO,CAA0B,CAAA;QAEjF,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAC3D,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EACpB,EAAE,IAAI,EAAE,CAAC,EAAE,CACZ,CAAA;QAED,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAwB,CAAA;QAEjE,yCAAyC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAsB,mBAAmB,CAAC,CAAA;QAC1E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,MAAM,YAAY,GAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ;YAC5D,CAAC,CAAC,CAAE,QAA2C,CAAC,IAAI,IAAI,EAAE,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACR,MAAM,kBAAkB,GAAG,CAAC,YAAY,CAAC,mBAAmB,IAAI,EAAE,CAAwB,CAAA;QAC1F,MAAM,aAAa,GACjB,OAAO,kBAAkB,CAAC,aAAa,KAAK,QAAQ;YAClD,CAAC,CAAC,kBAAkB,CAAC,aAAa;YAClC,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,YAAY,GAAG,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAA;QAEpF,wFAAwF;QACxF,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5B,MAAO,aAAqB,CAAC,oBAAoB,CAAC;gBAChD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE;oBACJ,GAAG,QAAQ;oBACX,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACzC;gBACD,MAAM,EAAE,WAAW,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;gBAC7C,aAAa,EAAE,WAAW,EAAE,aAAa,IAAI,OAAO,CAAC,aAAa;aACnE,CAAC,CAAA;QACJ,CAAC;QAED,wEAAwE;QACxE,2CAA2C;QAC3C,2DAA2D;QAC3D,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAO,aAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YACpE,OAAO,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7F,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,8EAA8E;YAC9E,OAAO,CAAC,IAAI,CAAC,sDAAsD,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;QAClF,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC,CAAA;IACxE,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easypayment/medusa-paypal",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Industry-standard PayPal integration for Medusa v2",
   "license": "MIT",
   "main": "./.medusa/server/src/index.js",

package/src/api/store/paypal-complete/route.ts

@@ -11,21 +11,6 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
   }
 
   try {
-    const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
-    const settings = await paypal.getSettings().catch(() => ({}))
-    const settingsData =
-      settings && typeof settings === "object" && "data" in settings
-        ? ((settings as { data?: Record<string, any> }).data ?? {})
-        : {}
-    const additionalSettings = (settingsData.additional_settings || {}) as Record<string, any>
-    const paymentAction =
-      typeof additionalSettings.paymentAction === "string"
-        ? additionalSettings.paymentAction
-        : "capture"
-
-    const sessionStatus = paymentAction === "authorize" ? "authorized" : "captured"
-    const timestampKey = paymentAction === "authorize" ? "authorized_at" : "captured_at"
-
     const query = req.scope.resolve("query")
     const { data: carts } = await query.graph({
       entity: "cart",
@@ -33,6 +18,7 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
         "id",
         "payment_collection.payment_sessions.id",
         "payment_collection.payment_sessions.data",
+        "payment_collection.payment_sessions.status",
         "payment_collection.payment_sessions.provider_id",
         "payment_collection.payment_sessions.created_at",
         "payment_collection.payment_sessions.amount",
@@ -53,18 +39,67 @@ export async function POST(req: MedusaRequest, res: MedusaResponse) {
       return res.status(400).json({ error: "No PayPal payment session found for cart" })
     }
 
+    // If already authorized or captured, nothing to do
+    const currentStatus = String(session.status || "")
+    if (currentStatus === "authorized" || currentStatus === "captured") {
+      console.info("[paypal-complete] session already in terminal status:", currentStatus)
+      return res.json({ success: true, session_id: session.id, status: currentStatus })
+    }
+
     const paymentModule = req.scope.resolve(Modules.PAYMENT) as IPaymentModuleService
-    await (paymentModule as any).updatePaymentSession({
-      id: session.id,
-      data: { ...(session.data || {}), [timestampKey]: new Date().toISOString() },
-      status: sessionStatus as any,
-      amount: session.amount,
-      currency_code: session.currency_code,
-    })
+
+    // Read LIVE session data from DB — gets the latest state written by capture-order
+    // (avoids overwriting authorization_id / capture_id that capture-order just saved)
+    const [liveSession] = await paymentModule.listPaymentSessions(
+      { id: [session.id] },
+      { take: 1 }
+    )
+
+    const liveData = (liveSession?.data || {}) as Record<string, any>
+
+    // Determine payment action from settings
+    const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
+    const settings = await paypal.getSettings().catch(() => ({}))
+    const settingsData =
+      settings && typeof settings === "object" && "data" in settings
+        ? ((settings as { data?: Record<string, any> }).data ?? {})
+        : {}
+    const additionalSettings = (settingsData.additional_settings || {}) as Record<string, any>
+    const paymentAction =
+      typeof additionalSettings.paymentAction === "string"
+        ? additionalSettings.paymentAction
+        : "capture"
+
+    const timestampKey = paymentAction === "authorize" ? "authorized_at" : "captured_at"
+
+    // Only write timestamp if not already present — avoids overwriting capture-order's data
+    if (!liveData[timestampKey]) {
+      await (paymentModule as any).updatePaymentSession({
+        id: session.id,
+        data: {
+          ...liveData,
+          [timestampKey]: new Date().toISOString(),
+        },
+        amount: liveSession?.amount ?? session.amount,
+        currency_code: liveSession?.currency_code ?? session.currency_code,
+      })
+    }
+
+    // Trigger Medusa's payment state machine — the only correct way to move
+    // a session from "pending" → "authorized".
+    // Calls the provider's authorizePayment() which checks for
+    // authorization_id / authorized_at in data and returns status: "authorized".
+    try {
+      await (paymentModule as any).authorizePaymentSession(session.id, {})
+      console.info("[paypal-complete] authorizePaymentSession succeeded for session", session.id)
+    } catch (e: any) {
+      // Throws if session is already authorized/captured — that's expected and fine
+      console.warn("[paypal-complete] authorizePaymentSession non-fatal:", e?.message)
+    }
 
     return res.json({ success: true, session_id: session.id })
   } catch (e: any) {
     console.error("[paypal-complete] error:", e?.message || e)
     return res.status(500).json({ error: e?.message || "Internal error" })
   }
-}
+}