order-management 0.0.95 → 0.0.96

package/.medusa/server/src/api/middlewares/block-refund-until-return-received.js

@@ -3,27 +3,39 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.blockRefundUntilReturnReceived = blockRefundUntilReturnReceived;
 const utils_1 = require("@medusajs/framework/utils");
 const refund_receive_guard_1 = require("../../helpers/refund-receive-guard");
+function getKnex(req) {
+    return req.scope.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+}
 function paymentIdFromRequest(req) {
     const raw = req.params?.id;
-    const id = typeof raw === "string" ? raw.trim() : "";
-    return id || undefined;
+    const fromParams = typeof raw === "string" ? raw.trim() : "";
+    if (fromParams) {
+        return fromParams;
+    }
+    // Wildcard matchers (/admin/payments/*/refund) do not populate :id
+    const path = (typeof req.originalUrl === "string" && req.originalUrl) ||
+        (typeof req.url === "string" && req.url) ||
+        (typeof req.path === "string" && req.path) ||
+        "";
+    const match = path.match(/\/admin\/payments\/([^/?#]+)\/refund/i);
+    const fromPath = match?.[1]?.trim();
+    return fromPath || undefined;
 }
 async function resolveOrderIdForPayment(paymentId, req) {
     const paymentModule = req.scope.resolve(utils_1.Modules.PAYMENT);
-    const payments = await paymentModule.listPayments({ id: [paymentId] }, { relations: ["payment_session"], take: 1 });
+    const payments = await paymentModule.listPayments({ id: [paymentId] }, { take: 1 });
     const paymentList = Array.isArray(payments) ? payments : [];
     const paymentRow = paymentList[0];
     if (!paymentRow) {
         return null;
     }
-    const sessionObj = paymentRow.payment_session;
-    let collectionId = paymentRow.payment_collection_id?.trim() ||
-        sessionObj?.payment_collection_id?.trim() ||
-        null;
+    let collectionId = paymentRow.payment_collection_id?.trim() || null;
     if (!collectionId && typeof paymentRow.payment_session_id === "string") {
         const sessionId = paymentRow.payment_session_id.trim();
         if (sessionId) {
-            const sessions = await paymentModule.listPaymentSessions({ id: [sessionId] }).catch(() => []);
+            const sessions = await paymentModule
+                .listPaymentSessions({ id: [sessionId] })
+                .catch(() => []);
             const sessionList = Array.isArray(sessions) ? sessions : [];
             const session = sessionList[0];
             if (session?.payment_collection_id) {
@@ -34,34 +46,114 @@ async function resolveOrderIdForPayment(paymentId, req) {
     if (!collectionId) {
         return null;
     }
-    const remoteQuery = req.scope.resolve(utils_1.ContainerRegistrationKeys.REMOTE_QUERY);
-    const pcQuery = (0, utils_1.remoteQueryObjectFromString)({
-        entryPoint: "payment_collection",
-        fields: ["id", "order.id"],
-        filters: { id: [collectionId] },
+    try {
+        const knex = getKnex(req);
+        const rows = await knex("order_payment_collection")
+            .select("order_id")
+            .where("payment_collection_id", collectionId)
+            .whereNull("deleted_at")
+            .limit(1);
+        const orderId = rows?.[0]?.order_id;
+        if (typeof orderId === "string" && orderId.trim()) {
+            return orderId.trim();
+        }
+    }
+    catch {
+        // Fall through
+    }
+    return null;
+}
+async function loadRmaForOrder(orderId, req) {
+    const knex = getKnex(req);
+    const returnRows = (await knex("return")
+        .select(["id", "status", "exchange_id"])
+        .where("order_id", orderId)
+        .whereNull("deleted_at"));
+    const returns = returnRows
+        .filter((row) => typeof row.id === "string")
+        .map((row) => ({
+        id: row.id,
+        status: row.status,
+        exchange_id: row.exchange_id ?? null,
+    }));
+    const exchangeRows = (await knex("order_exchange")
+        .select(["id", "canceled_at", "return_id"])
+        .where("order_id", orderId)
+        .whereNull("deleted_at"));
+    const exchanges = exchangeRows
+        .filter((row) => typeof row.id === "string")
+        .map((row) => {
+        const returnId = row.return_id ?? null;
+        const linked = (returnId ? returns.find((r) => r.id === returnId) : null) ?? null;
+        return {
+            id: row.id,
+            canceled_at: row.canceled_at ?? null,
+            return_id: returnId,
+            return: linked,
+        };
     });
-    const pcRows = await remoteQuery(pcQuery);
-    const pcList = Array.isArray(pcRows) ? pcRows : pcRows ? [pcRows] : [];
-    const firstPc = pcList[0];
-    let orderId = firstPc?.order?.id ?? null;
-    if (!orderId) {
-        const orderQuery = (0, utils_1.remoteQueryObjectFromString)({
-            entryPoint: "order",
-            fields: ["id", "payment_collections.id"],
-            filters: { payment_collections: { id: [collectionId] } },
-        });
-        const orderRows = await remoteQuery(orderQuery).catch(() => []);
-        const orderList = Array.isArray(orderRows) ? orderRows : orderRows ? [orderRows] : [];
-        const firstOrder = orderList[0];
-        orderId = firstOrder?.id ?? null;
+    return { returns, exchanges };
+}
+async function loadWalletSettleEvidence(orderId, req) {
+    const knex = getKnex(req);
+    let orderTransactions = [];
+    try {
+        const txRows = (await knex("order_transaction")
+            .select(["reference", "reference_id"])
+            .where("order_id", orderId)
+            .whereNull("deleted_at"));
+        orderTransactions = txRows
+            .filter((row) => (row.reference ?? "").trim() === "refund")
+            .map((row) => ({
+            reference: row.reference,
+            reference_id: row.reference_id,
+        }));
     }
-    return orderId;
+    catch {
+        orderTransactions = [];
+    }
+    const paymentRefunds = [];
+    try {
+        const result = await knex.raw(`
+      SELECT r.created_by, r.note, r.metadata
+      FROM refund r
+      INNER JOIN payment p ON p.id = r.payment_id AND p.deleted_at IS NULL
+      INNER JOIN order_payment_collection opc
+        ON opc.payment_collection_id = p.payment_collection_id
+        AND opc.deleted_at IS NULL
+      WHERE opc.order_id = ?
+        AND r.deleted_at IS NULL
+      `, [orderId]);
+        const rows = (result && typeof result === "object" && "rows" in result
+            ? result.rows
+            : Array.isArray(result)
+                ? result
+                : []);
+        for (const row of rows) {
+            paymentRefunds.push({
+                created_by: row.created_by,
+                note: row.note,
+                metadata: row.metadata ?? null,
+            });
+        }
+    }
+    catch {
+        // Soft-fail: still enforce return/exchange checks
+    }
+    return { orderTransactions, paymentRefunds };
 }
 /**
- * Block Medusa core POST /admin/payments/:id/refund while any return on the order
- * is still unreceived. Receive-and-refund inside core workflows is not HTTP and is unaffected.
+ * Block Medusa core POST /admin/payments/:id/refund while return/exchange is
+ * unreceived, or when the order was already settled to the customer wallet.
  */
 async function blockRefundUntilReturnReceived(req, res, next) {
+    // Dual matchers can both hit; only evaluate once per request.
+    const checkedKey = "__om_refund_rma_checked";
+    const reqFlags = req;
+    if (reqFlags[checkedKey]) {
+        return next();
+    }
+    reqFlags[checkedKey] = true;
     const paymentId = paymentIdFromRequest(req);
     if (!paymentId) {
         return next();
@@ -69,29 +161,36 @@ async function blockRefundUntilReturnReceived(req, res, next) {
     try {
         const orderId = await resolveOrderIdForPayment(paymentId, req);
         if (!orderId) {
-            return next();
+            res.status(400).json({
+                message: (0, refund_receive_guard_1.refundBlockedOrderUnresolvedMessage)(),
+                type: "NOT_ALLOWED",
+            });
+            return;
         }
-        const orderModule = req.scope.resolve(utils_1.Modules.ORDER);
-        const returns = await orderModule.listReturns({ order_id: orderId }, { take: 100 });
-        const returnList = Array.isArray(returns) ? returns : [];
-        const blocking = (0, refund_receive_guard_1.getUnreceivedReturnBlockingRefund)(returnList.map((row) => ({
-            id: row.id,
-            status: row.status,
-        })));
-        if (!blocking) {
+        const { returns: returnList, exchanges: exchangeList } = await loadRmaForOrder(orderId, req);
+        const { orderTransactions, paymentRefunds } = await loadWalletSettleEvidence(orderId, req);
+        const decision = (0, refund_receive_guard_1.shouldBlockRefundForRma)({
+            returns: returnList,
+            exchanges: exchangeList,
+            orderTransactions,
+            paymentRefunds,
+        });
+        if (!decision.blocked) {
             return next();
         }
         res.status(400).json({
-            message: (0, refund_receive_guard_1.refundBlockedByReturnMessage)(blocking.status ?? "requested"),
+            message: decision.message,
             type: "NOT_ALLOWED",
         });
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : "Failed to validate refund against return status";
+        const message = err instanceof Error
+            ? err.message
+            : "Failed to validate refund against return status";
         res.status(500).json({
             message,
             type: "INTERNAL_ERROR",
         });
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmxvY2stcmVmdW5kLXVudGlsLXJldHVybi1yZWNlaXZlZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvbWlkZGxld2FyZXMvYmxvY2stcmVmdW5kLXVudGlsLXJldHVybi1yZWNlaXZlZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQTJGQSx3RUE0Q0M7QUE3SEQscURBQTJHO0FBQzNHLDZFQUcyQztBQUUzQyxTQUFTLG9CQUFvQixDQUFDLEdBQWtCO0lBQzlDLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFBO0lBQzFCLE1BQU0sRUFBRSxHQUFHLE9BQU8sR0FBRyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUE7SUFDcEQsT0FBTyxFQUFFLElBQUksU0FBUyxDQUFBO0FBQ3hCLENBQUM7QUFFRCxLQUFLLFVBQVUsd0JBQXdCLENBQ3JDLFNBQWlCLEVBQ2pCLEdBQWtCO0lBRWxCLE1BQU0sYUFBYSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUF3QixlQUFPLENBQUMsT0FBTyxDQUFDLENBQUE7SUFDL0UsTUFBTSxRQUFRLEdBQUcsTUFBTSxhQUFhLENBQUMsWUFBWSxDQUMvQyxFQUFFLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEVBQ25CLEVBQUUsU0FBUyxFQUFFLENBQUMsaUJBQWlCLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQzVDLENBQUE7SUFDRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtJQUMzRCxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsQ0FBQyxDQUFtRCxDQUFBO0lBQ25GLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNoQixPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7SUFFRCxNQUFNLFVBQVUsR0FBRyxVQUFVLENBQUMsZUFBaUUsQ0FBQTtJQUMvRixJQUFJLFlBQVksR0FDYixVQUFVLENBQUMscUJBQTRDLEVBQUUsSUFBSSxFQUFFO1FBQ2hFLFVBQVUsRUFBRSxxQkFBcUIsRUFBRSxJQUFJLEVBQUU7UUFDekMsSUFBSSxDQUFBO0lBRU4sSUFBSSxDQUFDLFlBQVksSUFBSSxPQUFPLFVBQVUsQ0FBQyxrQkFBa0IsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN2RSxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUMsa0JBQWtCLENBQUMsSUFBSSxFQUFFLENBQUE7UUFDdEQsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNkLE1BQU0sUUFBUSxHQUFHLE1BQU0sYUFBYSxDQUFDLG1CQUFtQixDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQTtZQUM3RixNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtZQUMzRCxNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsQ0FBQyxDQUFtRCxDQUFBO1lBQ2hGLElBQUksT0FBTyxFQUFFLHFCQUFxQixFQUFFLENBQUM7Z0JBQ25DLFlBQVksR0FBRyxPQUFPLENBQUMscUJBQXFCLENBQUE7WUFDOUMsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ2xCLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUVELE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUNuQyxpQ0FBeUIsQ0FBQyxZQUFZLENBQ3ZDLENBQUE7SUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFBLG1DQUEyQixFQUFDO1FBQzFDLFVBQVUsRUFBRSxvQkFBb0I7UUFDaEMsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLFVBQVUsQ0FBQztRQUMxQixPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsRUFBRTtLQUNoQyxDQUFDLENBQUE7SUFDRixNQUFNLE1BQU0sR0FBRyxNQUFNLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQTtJQUN6QyxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFBO0lBQ3RFLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQW1ELENBQUE7SUFDM0UsSUFBSSxPQUFPLEdBQUcsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLElBQUksSUFBSSxDQUFBO0lBRXhDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE1BQU0sVUFBVSxHQUFHLElBQUEsbUNBQTJCLEVBQUM7WUFDN0MsVUFBVSxFQUFFLE9BQU87WUFDbkIsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLHdCQUF3QixDQUFDO1lBQ3hDLE9BQU8sRUFBRSxFQUFFLG1CQUFtQixFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRTtTQUN6RCxDQUFDLENBQUE7UUFDRixNQUFNLFNBQVMsR0FBRyxNQUFNLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUE7UUFDL0QsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtRQUNyRixNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFnQyxDQUFBO1FBQzlELE9BQU8sR0FBRyxVQUFVLEVBQUUsRUFBRSxJQUFJLElBQUksQ0FBQTtJQUNsQyxDQUFDO0lBRUQsT0FBTyxPQUFPLENBQUE7QUFDaEIsQ0FBQztBQUVEOzs7R0FHRztBQUNJLEtBQUssVUFBVSw4QkFBOEIsQ0FDbEQsR0FBa0IsRUFDbEIsR0FBbUIsRUFDbkIsSUFBd0I7SUFFeEIsTUFBTSxTQUFTLEdBQUcsb0JBQW9CLENBQUMsR0FBRyxDQUFDLENBQUE7SUFDM0MsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2YsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUNmLENBQUM7SUFFRCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxNQUFNLHdCQUF3QixDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQTtRQUM5RCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixPQUFPLElBQUksRUFBRSxDQUFBO1FBQ2YsQ0FBQztRQUVELE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFzQixlQUFPLENBQUMsS0FBSyxDQUFDLENBQUE7UUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxXQUFXLENBQUMsV0FBVyxDQUMzQyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQXVELEVBQzFFLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxDQUNkLENBQUE7UUFDRCxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtRQUN4RCxNQUFNLFFBQVEsR0FBRyxJQUFBLHdEQUFpQyxFQUNoRCxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZCLEVBQUUsRUFBRSxHQUFHLENBQUMsRUFBRTtZQUNWLE1BQU0sRUFBRyxHQUEyQixDQUFDLE1BQU07U0FDNUMsQ0FBQyxDQUFDLENBQ0osQ0FBQTtRQUVELElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDZixDQUFDO1FBRUQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDbkIsT0FBTyxFQUFFLElBQUEsbURBQTRCLEVBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSxXQUFXLENBQUM7WUFDckUsSUFBSSxFQUFFLGFBQWE7U0FDcEIsQ0FBQyxDQUFBO0lBQ0osQ0FBQztJQUFDLE9BQU8sR0FBWSxFQUFFLENBQUM7UUFDdEIsTUFBTSxPQUFPLEdBQUcsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsaURBQWlELENBQUE7UUFDdEcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDbkIsT0FBTztZQUNQLElBQUksRUFBRSxnQkFBZ0I7U0FDdkIsQ0FBQyxDQUFBO0lBQ0osQ0FBQztBQUNILENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmxvY2stcmVmdW5kLXVudGlsLXJldHVybi1yZWNlaXZlZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvbWlkZGxld2FyZXMvYmxvY2stcmVmdW5kLXVudGlsLXJldHVybi1yZWNlaXZlZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQXNQQSx3RUErREM7QUEvU0QscURBR2tDO0FBQ2xDLDZFQU8yQztBQTBCM0MsU0FBUyxPQUFPLENBQUMsR0FBa0I7SUFDakMsT0FBTyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBVyxpQ0FBeUIsQ0FBQyxhQUFhLENBQUMsQ0FBQTtBQUM3RSxDQUFDO0FBRUQsU0FBUyxvQkFBb0IsQ0FBQyxHQUFrQjtJQUM5QyxNQUFNLEdBQUcsR0FBRyxHQUFHLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQTtJQUMxQixNQUFNLFVBQVUsR0FBRyxPQUFPLEdBQUcsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFBO0lBQzVELElBQUksVUFBVSxFQUFFLENBQUM7UUFDZixPQUFPLFVBQVUsQ0FBQTtJQUNuQixDQUFDO0lBQ0QsbUVBQW1FO0lBQ25FLE1BQU0sSUFBSSxHQUNSLENBQUMsT0FBTyxHQUFHLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDO1FBQ3hELENBQUMsT0FBTyxHQUFHLENBQUMsR0FBRyxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDO1FBQ3hDLENBQUMsT0FBTyxHQUFHLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDO1FBQzFDLEVBQUUsQ0FBQTtJQUNKLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQTtJQUNqRSxNQUFNLFFBQVEsR0FBRyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQTtJQUNuQyxPQUFPLFFBQVEsSUFBSSxTQUFTLENBQUE7QUFDOUIsQ0FBQztBQUVELEtBQUssVUFBVSx3QkFBd0IsQ0FDckMsU0FBaUIsRUFDakIsR0FBa0I7SUFFbEIsTUFBTSxhQUFhLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQXdCLGVBQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQTtJQUMvRSxNQUFNLFFBQVEsR0FBRyxNQUFNLGFBQWEsQ0FBQyxZQUFZLENBQy9DLEVBQUUsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLEVBQUUsRUFDbkIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQ1osQ0FBQTtJQUNELE1BQU0sV0FBVyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFBO0lBQzNELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxDQUFDLENBRW5CLENBQUE7SUFDYixJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDaEIsT0FBTyxJQUFJLENBQUE7SUFDYixDQUFDO0lBRUQsSUFBSSxZQUFZLEdBQ2IsVUFBVSxDQUFDLHFCQUE0QyxFQUFFLElBQUksRUFBRSxJQUFJLElBQUksQ0FBQTtJQUUxRSxJQUFJLENBQUMsWUFBWSxJQUFJLE9BQU8sVUFBVSxDQUFDLGtCQUFrQixLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sU0FBUyxHQUFHLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUN0RCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ2QsTUFBTSxRQUFRLEdBQUcsTUFBTSxhQUFhO2lCQUNqQyxtQkFBbUIsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7aUJBQ3hDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQTtZQUNsQixNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtZQUMzRCxNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsQ0FBQyxDQUVoQixDQUFBO1lBQ2IsSUFBSSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsQ0FBQztnQkFDbkMsWUFBWSxHQUFHLE9BQU8sQ0FBQyxxQkFBcUIsQ0FBQTtZQUM5QyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEIsT0FBTyxJQUFJLENBQUE7SUFDYixDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ3pCLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLDBCQUEwQixDQUFDO2FBQ2hELE1BQU0sQ0FBQyxVQUFVLENBQUM7YUFDbEIsS0FBSyxDQUFDLHVCQUF1QixFQUFFLFlBQVksQ0FBQzthQUM1QyxTQUFTLENBQUMsWUFBWSxDQUFDO2FBQ3ZCLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUNYLE1BQU0sT0FBTyxHQUFHLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLFFBQVEsQ0FBQTtRQUNuQyxJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUNsRCxPQUFPLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUN2QixDQUFDO0lBQ0gsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLGVBQWU7SUFDakIsQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFBO0FBQ2IsQ0FBQztBQUVELEtBQUssVUFBVSxlQUFlLENBQzVCLE9BQWUsRUFDZixHQUFrQjtJQUtsQixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUE7SUFFekIsTUFBTSxVQUFVLEdBQUcsQ0FBQyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUM7U0FDckMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxhQUFhLENBQUMsQ0FBQztTQUN2QyxLQUFLLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQztTQUMxQixTQUFTLENBQUMsWUFBWSxDQUFDLENBSXhCLENBQUE7SUFFRixNQUFNLE9BQU8sR0FBMkIsVUFBVTtTQUMvQyxNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLE9BQU8sR0FBRyxDQUFDLEVBQUUsS0FBSyxRQUFRLENBQUM7U0FDM0MsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2IsRUFBRSxFQUFFLEdBQUcsQ0FBQyxFQUFZO1FBQ3BCLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtRQUNsQixXQUFXLEVBQUUsR0FBRyxDQUFDLFdBQVcsSUFBSSxJQUFJO0tBQ3JDLENBQUMsQ0FBQyxDQUFBO0lBRUwsTUFBTSxZQUFZLEdBQUcsQ0FBQyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztTQUMvQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1NBQzFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDO1NBQzFCLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FJeEIsQ0FBQTtJQUVGLE1BQU0sU0FBUyxHQUE2QixZQUFZO1NBQ3JELE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxHQUFHLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQztTQUMzQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRTtRQUNYLE1BQU0sUUFBUSxHQUFHLEdBQUcsQ0FBQyxTQUFTLElBQUksSUFBSSxDQUFBO1FBQ3RDLE1BQU0sTUFBTSxHQUNWLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUE7UUFDcEUsT0FBTztZQUNMLEVBQUUsRUFBRSxHQUFHLENBQUMsRUFBWTtZQUNwQixXQUFXLEVBQUUsR0FBRyxDQUFDLFdBQVcsSUFBSSxJQUFJO1lBQ3BDLFNBQVMsRUFBRSxRQUFRO1lBQ25CLE1BQU0sRUFBRSxNQUFNO1NBQ2YsQ0FBQTtJQUNILENBQUMsQ0FBQyxDQUFBO0lBRUosT0FBTyxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsQ0FBQTtBQUMvQixDQUFDO0FBRUQsS0FBSyxVQUFVLHdCQUF3QixDQUNyQyxPQUFlLEVBQ2YsR0FBa0I7SUFLbEIsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFBO0lBRXpCLElBQUksaUJBQWlCLEdBQXFDLEVBQUUsQ0FBQTtJQUM1RCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQU0sSUFBSSxDQUFDLG1CQUFtQixDQUFDO2FBQzVDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxjQUFjLENBQUMsQ0FBQzthQUNyQyxLQUFLLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQzthQUMxQixTQUFTLENBQUMsWUFBWSxDQUFDLENBR3hCLENBQUE7UUFDRixpQkFBaUIsR0FBRyxNQUFNO2FBQ3ZCLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLFFBQVEsQ0FBQzthQUMxRCxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDYixTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVM7WUFDeEIsWUFBWSxFQUFFLEdBQUcsQ0FBQyxZQUFZO1NBQy9CLENBQUMsQ0FBQyxDQUFBO0lBQ1AsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLGlCQUFpQixHQUFHLEVBQUUsQ0FBQTtJQUN4QixDQUFDO0lBRUQsTUFBTSxjQUFjLEdBQWtDLEVBQUUsQ0FBQTtJQUN4RCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQzNCOzs7Ozs7Ozs7T0FTQyxFQUNELENBQUMsT0FBTyxDQUFDLENBQ1YsQ0FBQTtRQUNELE1BQU0sSUFBSSxHQUFHLENBQ1gsTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxNQUFNLElBQUksTUFBTTtZQUN0RCxDQUFDLENBQUUsTUFBOEIsQ0FBQyxJQUFJO1lBQ3RDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztnQkFDckIsQ0FBQyxDQUFDLE1BQU07Z0JBQ1IsQ0FBQyxDQUFDLEVBQUUsQ0FLUixDQUFBO1FBQ0YsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUN2QixjQUFjLENBQUMsSUFBSSxDQUFDO2dCQUNsQixVQUFVLEVBQUUsR0FBRyxDQUFDLFVBQVU7Z0JBQzFCLElBQUksRUFBRSxHQUFHLENBQUMsSUFBSTtnQkFDZCxRQUFRLEVBQUUsR0FBRyxDQUFDLFFBQVEsSUFBSSxJQUFJO2FBQy9CLENBQUMsQ0FBQTtRQUNKLENBQUM7SUFDSCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1Asa0RBQWtEO0lBQ3BELENBQUM7SUFFRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsY0FBYyxFQUFFLENBQUE7QUFDOUMsQ0FBQztBQUVEOzs7R0FHRztBQUNJLEtBQUssVUFBVSw4QkFBOEIsQ0FDbEQsR0FBa0IsRUFDbEIsR0FBbUIsRUFDbkIsSUFBd0I7SUFFeEIsOERBQThEO0lBQzlELE1BQU0sVUFBVSxHQUFHLHlCQUFrQyxDQUFBO0lBQ3JELE1BQU0sUUFBUSxHQUFHLEdBRWhCLENBQUE7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE9BQU8sSUFBSSxFQUFFLENBQUE7SUFDZixDQUFDO0lBQ0QsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLElBQUksQ0FBQTtJQUUzQixNQUFNLFNBQVMsR0FBRyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUMzQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDZixPQUFPLElBQUksRUFBRSxDQUFBO0lBQ2YsQ0FBQztJQUVELElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLE1BQU0sd0JBQXdCLENBQUMsU0FBUyxFQUFFLEdBQUcsQ0FBQyxDQUFBO1FBQzlELElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO2dCQUNuQixPQUFPLEVBQUUsSUFBQSwwREFBbUMsR0FBRTtnQkFDOUMsSUFBSSxFQUFFLGFBQWE7YUFDcEIsQ0FBQyxDQUFBO1lBQ0YsT0FBTTtRQUNSLENBQUM7UUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsWUFBWSxFQUFFLEdBQ3BELE1BQU0sZUFBZSxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQTtRQUVyQyxNQUFNLEVBQUUsaUJBQWlCLEVBQUUsY0FBYyxFQUFFLEdBQUcsTUFBTSx3QkFBd0IsQ0FDMUUsT0FBTyxFQUNQLEdBQUcsQ0FDSixDQUFBO1FBRUQsTUFBTSxRQUFRLEdBQUcsSUFBQSw4Q0FBdUIsRUFBQztZQUN2QyxPQUFPLEVBQUUsVUFBVTtZQUNuQixTQUFTLEVBQUUsWUFBWTtZQUN2QixpQkFBaUI7WUFDakIsY0FBYztTQUNmLENBQUMsQ0FBQTtRQUVGLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEIsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUNmLENBQUM7UUFFRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNuQixPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU87WUFDekIsSUFBSSxFQUFFLGFBQWE7U0FDcEIsQ0FBQyxDQUFBO0lBQ0osQ0FBQztJQUFDLE9BQU8sR0FBWSxFQUFFLENBQUM7UUFDdEIsTUFBTSxPQUFPLEdBQ1gsR0FBRyxZQUFZLEtBQUs7WUFDbEIsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPO1lBQ2IsQ0FBQyxDQUFDLGlEQUFpRCxDQUFBO1FBQ3ZELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ25CLE9BQU87WUFDUCxJQUFJLEVBQUUsZ0JBQWdCO1NBQ3ZCLENBQUMsQ0FBQTtJQUNKLENBQUM7QUFDSCxDQUFDIn0=

package/.medusa/server/src/api/middlewares.js

@@ -8,24 +8,30 @@ exports.default = (0, http_1.defineMiddlewares)({
     routes: [
         {
             matcher: "/admin/payments/:id/refund",
-            method: "POST",
+            methods: ["POST"],
+            middlewares: [block_refund_until_return_received_1.blockRefundUntilReturnReceived],
+        },
+        {
+            // Wildcard fallback when :id matchers are skipped
+            matcher: "/admin/payments/*/refund",
+            methods: ["POST"],
             middlewares: [block_refund_until_return_received_1.blockRefundUntilReturnReceived],
         },
         {
             matcher: "/store/returns",
-            method: "POST",
+            methods: ["POST"],
             middlewares: [(0, http_1.validateAndTransformBody)(validators_1.StoreCreateReturnSchema)],
         },
         {
             matcher: "/store/orders/cancel/:order_id",
-            method: "POST",
+            methods: ["POST"],
             middlewares: [(0, http_1.validateAndTransformBody)(cancel_order_1.StoreCancelOrderBodySchema)],
         },
         {
             matcher: "/store/guest-orders/:id/cancel",
-            method: "POST",
+            methods: ["POST"],
             middlewares: [(0, http_1.validateAndTransformBody)(cancel_order_1.StoreCancelOrderBodySchema)],
         },
     ],
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbURBR2lDO0FBQ2pDLHlHQUFpRztBQUNqRywyREFBb0U7QUFDcEUsa0VBQTRFO0FBRTVFLGtCQUFlLElBQUEsd0JBQWlCLEVBQUM7SUFDL0IsTUFBTSxFQUFFO1FBQ047WUFDRSxPQUFPLEVBQUUsNEJBQTRCO1lBQ3JDLE1BQU0sRUFBRSxNQUFNO1lBQ2QsV0FBVyxFQUFFLENBQUMsbUVBQThCLENBQUM7U0FDOUM7UUFDRDtZQUNFLE9BQU8sRUFBRSxnQkFBZ0I7WUFDekIsTUFBTSxFQUFFLE1BQU07WUFDZCxXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLG9DQUF1QixDQUFDLENBQUM7U0FDakU7UUFDRDtZQUNFLE9BQU8sRUFBRSxnQ0FBZ0M7WUFDekMsTUFBTSxFQUFFLE1BQU07WUFDZCxXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLHlDQUEwQixDQUFDLENBQUM7U0FDcEU7UUFDRDtZQUNFLE9BQU8sRUFBRSxnQ0FBZ0M7WUFDekMsTUFBTSxFQUFFLE1BQU07WUFDZCxXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLHlDQUEwQixDQUFDLENBQUM7U0FDcEU7S0FDRjtDQUNGLENBQUMsQ0FBQSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbURBR2lDO0FBQ2pDLHlHQUFpRztBQUNqRywyREFBb0U7QUFDcEUsa0VBQTRFO0FBRTVFLGtCQUFlLElBQUEsd0JBQWlCLEVBQUM7SUFDL0IsTUFBTSxFQUFFO1FBQ047WUFDRSxPQUFPLEVBQUUsNEJBQTRCO1lBQ3JDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUUsQ0FBQyxtRUFBOEIsQ0FBQztTQUM5QztRQUNEO1lBQ0Usa0RBQWtEO1lBQ2xELE9BQU8sRUFBRSwwQkFBMEI7WUFDbkMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRSxDQUFDLG1FQUE4QixDQUFDO1NBQzlDO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsZ0JBQWdCO1lBQ3pCLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLG9DQUF1QixDQUFDLENBQUM7U0FDakU7UUFDRDtZQUNFLE9BQU8sRUFBRSxnQ0FBZ0M7WUFDekMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRSxDQUFDLElBQUEsK0JBQXdCLEVBQUMseUNBQTBCLENBQUMsQ0FBQztTQUNwRTtRQUNEO1lBQ0UsT0FBTyxFQUFFLGdDQUFnQztZQUN6QyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSwrQkFBd0IsRUFBQyx5Q0FBMEIsQ0FBQyxDQUFDO1NBQ3BFO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==

package/.medusa/server/src/helpers/refund-receive-guard.js

@@ -1,17 +1,64 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.refundBlockedByReturnMessage = refundBlockedByReturnMessage;
+exports.refundBlockedByExchangeMessage = refundBlockedByExchangeMessage;
+exports.refundBlockedByWalletSettleMessage = refundBlockedByWalletSettleMessage;
+exports.refundBlockedOrderUnresolvedMessage = refundBlockedOrderUnresolvedMessage;
+exports.isWalletSettleOrderTransaction = isWalletSettleOrderTransaction;
+exports.isWalletSettlePaymentRefund = isWalletSettlePaymentRefund;
+exports.orderHasWalletSettle = orderHasWalletSettle;
 exports.getUnreceivedReturnBlockingRefund = getUnreceivedReturnBlockingRefund;
+exports.shouldBlockRefundForRma = shouldBlockRefundForRma;
 exports.assertReturnReceivedForRefund = assertReturnReceivedForRefund;
 exports.canProcessRefundForReturn = canProcessRefundForReturn;
 const utils_1 = require("@medusajs/framework/utils");
 const return_exchange_guard_1 = require("./return-exchange-guard");
+const WALLET_SETTLE_REFERENCE_PREFIXES = [
+    "wallet:exchange:",
+    "wallet:return:",
+    "wallet:payment:",
+];
 /**
  * Message when a refund is attempted before the return is fully received.
  */
 function refundBlockedByReturnMessage(status) {
     return `Cannot process a refund while the return is ${status}. Receive the returned items first.`;
 }
+function refundBlockedByExchangeMessage() {
+    return "Cannot process a refund while an exchange is in progress. Receive the returned items first.";
+}
+function refundBlockedByWalletSettleMessage() {
+    return "Cannot process a payment refund; this order was already settled to the customer wallet.";
+}
+function refundBlockedOrderUnresolvedMessage() {
+    return "Cannot process a refund: unable to resolve the order for this payment. Verify the payment is linked to an order.";
+}
+function isWalletSettleOrderTransaction(tx) {
+    if ((tx.reference ?? "").trim() !== "refund") {
+        return false;
+    }
+    const refId = (tx.reference_id ?? "").trim();
+    return WALLET_SETTLE_REFERENCE_PREFIXES.some((prefix) => refId.startsWith(prefix));
+}
+function isWalletSettlePaymentRefund(refund) {
+    if (refund.created_by === "wallet_settle") {
+        return true;
+    }
+    if (refund.metadata?.wallet_settle === true) {
+        return true;
+    }
+    const note = refund.note ?? "";
+    return note.startsWith("wallet_settle:");
+}
+function orderHasWalletSettle(input) {
+    if ((input.orderTransactions ?? []).some(isWalletSettleOrderTransaction)) {
+        return true;
+    }
+    if ((input.paymentRefunds ?? []).some(isWalletSettlePaymentRefund)) {
+        return true;
+    }
+    return false;
+}
 /**
  * First unreceived return that must block a refund (`open` | `requested` | `partially_received`).
  * Exchange-linked returns are included — refunds are blocked until items are received.
@@ -24,6 +71,60 @@ function getUnreceivedReturnBlockingRefund(returns) {
     }
     return null;
 }
+/**
+ * Whether admin payment refund should be blocked for open RMA or prior wallet settle.
+ */
+function shouldBlockRefundForRma(input) {
+    if (orderHasWalletSettle({
+        orderTransactions: input.orderTransactions,
+        paymentRefunds: input.paymentRefunds,
+    })) {
+        return {
+            blocked: true,
+            reason: "wallet_settle",
+            message: refundBlockedByWalletSettleMessage(),
+        };
+    }
+    const blockingReturn = getUnreceivedReturnBlockingRefund(input.returns);
+    if (blockingReturn) {
+        return {
+            blocked: true,
+            reason: "return",
+            message: refundBlockedByReturnMessage(blockingReturn.status ?? "requested"),
+            returnId: blockingReturn.id,
+            status: blockingReturn.status ?? undefined,
+        };
+    }
+    for (const exchange of input.exchanges) {
+        let linked = exchange.return ?? null;
+        if (!linked && exchange.return_id) {
+            linked =
+                input.returns.find((r) => r.id === exchange.return_id) ?? null;
+        }
+        const linkedForGuard = linked
+            ? {
+                id: linked.id,
+                status: linked.status ?? undefined,
+                exchange_id: linked.exchange_id,
+            }
+            : null;
+        if ((0, return_exchange_guard_1.isActiveExchange)({
+            id: exchange.id,
+            canceled_at: exchange.canceled_at,
+            return_id: exchange.return_id,
+            return: linkedForGuard,
+        }, linkedForGuard)) {
+            return {
+                blocked: true,
+                reason: "exchange",
+                message: refundBlockedByExchangeMessage(),
+                exchangeId: exchange.id,
+                status: linked?.status ?? undefined,
+            };
+        }
+    }
+    return { blocked: false };
+}
 /**
  * Throw NOT_ALLOWED when this return is still unreceived.
  * No return / already received / canceled → allow.
@@ -45,4 +146,4 @@ function canProcessRefundForReturn(input) {
         Boolean(input.has_mapping) &&
         !input.is_refunded);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVmdW5kLXJlY2VpdmUtZ3VhcmQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvaGVscGVycy9yZWZ1bmQtcmVjZWl2ZS1ndWFyZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQVdBLG9FQUVDO0FBTUQsOEVBU0M7QUFNRCxzRUFhQztBQUtELDhEQVVDO0FBOURELHFEQUF1RDtBQUN2RCxtRUFBOEQ7QUFPOUQ7O0dBRUc7QUFDSCxTQUFnQiw0QkFBNEIsQ0FBQyxNQUFjO0lBQ3pELE9BQU8sK0NBQStDLE1BQU0scUNBQXFDLENBQUE7QUFDbkcsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQWdCLGlDQUFpQyxDQUMvQyxPQUErQjtJQUUvQixLQUFLLE1BQU0sR0FBRyxJQUFJLE9BQU8sRUFBRSxDQUFDO1FBQzFCLElBQUksSUFBQSw0Q0FBb0IsRUFBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNyQyxPQUFPLEdBQUcsQ0FBQTtRQUNaLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUE7QUFDYixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsU0FBZ0IsNkJBQTZCLENBQzNDLEdBQTRDO0lBRTVDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNULE9BQU07SUFDUixDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUEsNENBQW9CLEVBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdEMsT0FBTTtJQUNSLENBQUM7SUFDRCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUM3Qiw0QkFBNEIsQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFJLFdBQVcsQ0FBQyxDQUN4RCxDQUFBO0FBQ0gsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0IseUJBQXlCLENBQUMsS0FJekM7SUFDQyxPQUFPLENBQ0wsS0FBSyxDQUFDLE1BQU0sS0FBSyxVQUFVO1FBQzNCLE9BQU8sQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO1FBQzFCLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FDbkIsQ0FBQTtBQUNILENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVmdW5kLXJlY2VpdmUtZ3VhcmQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvaGVscGVycy9yZWZ1bmQtcmVjZWl2ZS1ndWFyZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWtEQSxvRUFFQztBQUVELHdFQUVDO0FBRUQsZ0ZBRUM7QUFFRCxrRkFFQztBQUVELHdFQVVDO0FBRUQsa0VBV0M7QUFFRCxvREFXQztBQU1ELDhFQVNDO0FBS0QsMERBbUVDO0FBTUQsc0VBYUM7QUFLRCw4REFVQztBQS9ORCxxREFBdUQ7QUFDdkQsbUVBR2dDO0FBcUNoQyxNQUFNLGdDQUFnQyxHQUFHO0lBQ3ZDLGtCQUFrQjtJQUNsQixnQkFBZ0I7SUFDaEIsaUJBQWlCO0NBQ1QsQ0FBQTtBQUVWOztHQUVHO0FBQ0gsU0FBZ0IsNEJBQTRCLENBQUMsTUFBYztJQUN6RCxPQUFPLCtDQUErQyxNQUFNLHFDQUFxQyxDQUFBO0FBQ25HLENBQUM7QUFFRCxTQUFnQiw4QkFBOEI7SUFDNUMsT0FBTyw2RkFBNkYsQ0FBQTtBQUN0RyxDQUFDO0FBRUQsU0FBZ0Isa0NBQWtDO0lBQ2hELE9BQU8seUZBQXlGLENBQUE7QUFDbEcsQ0FBQztBQUVELFNBQWdCLG1DQUFtQztJQUNqRCxPQUFPLGtIQUFrSCxDQUFBO0FBQzNILENBQUM7QUFFRCxTQUFnQiw4QkFBOEIsQ0FDNUMsRUFBa0M7SUFFbEMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDN0MsT0FBTyxLQUFLLENBQUE7SUFDZCxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUMsWUFBWSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFBO0lBQzVDLE9BQU8sZ0NBQWdDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FDdEQsS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FDekIsQ0FBQTtBQUNILENBQUM7QUFFRCxTQUFnQiwyQkFBMkIsQ0FDekMsTUFBbUM7SUFFbkMsSUFBSSxNQUFNLENBQUMsVUFBVSxLQUFLLGVBQWUsRUFBRSxDQUFDO1FBQzFDLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLFFBQVEsRUFBRSxhQUFhLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDNUMsT0FBTyxJQUFJLENBQUE7SUFDYixDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUE7SUFDOUIsT0FBTyxJQUFJLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLENBQUE7QUFDMUMsQ0FBQztBQUVELFNBQWdCLG9CQUFvQixDQUFDLEtBR3BDO0lBQ0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsOEJBQThCLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLENBQUM7UUFDbkUsT0FBTyxJQUFJLENBQUE7SUFDYixDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUE7QUFDZCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsU0FBZ0IsaUNBQWlDLENBQy9DLE9BQStCO0lBRS9CLEtBQUssTUFBTSxHQUFHLElBQUksT0FBTyxFQUFFLENBQUM7UUFDMUIsSUFBSSxJQUFBLDRDQUFvQixFQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ3JDLE9BQU8sR0FBRyxDQUFBO1FBQ1osQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQTtBQUNiLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLHVCQUF1QixDQUFDLEtBS3ZDO0lBQ0MsSUFDRSxvQkFBb0IsQ0FBQztRQUNuQixpQkFBaUIsRUFBRSxLQUFLLENBQUMsaUJBQWlCO1FBQzFDLGNBQWMsRUFBRSxLQUFLLENBQUMsY0FBYztLQUNyQyxDQUFDLEVBQ0YsQ0FBQztRQUNELE9BQU87WUFDTCxPQUFPLEVBQUUsSUFBSTtZQUNiLE1BQU0sRUFBRSxlQUFlO1lBQ3ZCLE9BQU8sRUFBRSxrQ0FBa0MsRUFBRTtTQUM5QyxDQUFBO0lBQ0gsQ0FBQztJQUVELE1BQU0sY0FBYyxHQUFHLGlDQUFpQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQTtJQUN2RSxJQUFJLGNBQWMsRUFBRSxDQUFDO1FBQ25CLE9BQU87WUFDTCxPQUFPLEVBQUUsSUFBSTtZQUNiLE1BQU0sRUFBRSxRQUFRO1lBQ2hCLE9BQU8sRUFBRSw0QkFBNEIsQ0FDbkMsY0FBYyxDQUFDLE1BQU0sSUFBSSxXQUFXLENBQ3JDO1lBQ0QsUUFBUSxFQUFFLGNBQWMsQ0FBQyxFQUFFO1lBQzNCLE1BQU0sRUFBRSxjQUFjLENBQUMsTUFBTSxJQUFJLFNBQVM7U0FDM0MsQ0FBQTtJQUNILENBQUM7SUFFRCxLQUFLLE1BQU0sUUFBUSxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUN2QyxJQUFJLE1BQU0sR0FBZ0MsUUFBUSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUE7UUFDakUsSUFBSSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDbEMsTUFBTTtnQkFDSixLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksSUFBSSxDQUFBO1FBQ2xFLENBQUM7UUFDRCxNQUFNLGNBQWMsR0FBRyxNQUFNO1lBQzNCLENBQUMsQ0FBQztnQkFDRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUU7Z0JBQ2IsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksU0FBUztnQkFDbEMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXO2FBQ2hDO1lBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTtRQUNSLElBQ0UsSUFBQSx3Q0FBZ0IsRUFDZDtZQUNFLEVBQUUsRUFBRSxRQUFRLENBQUMsRUFBRTtZQUNmLFdBQVcsRUFBRSxRQUFRLENBQUMsV0FBVztZQUNqQyxTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVM7WUFDN0IsTUFBTSxFQUFFLGNBQWM7U0FDdkIsRUFDRCxjQUFjLENBQ2YsRUFDRCxDQUFDO1lBQ0QsT0FBTztnQkFDTCxPQUFPLEVBQUUsSUFBSTtnQkFDYixNQUFNLEVBQUUsVUFBVTtnQkFDbEIsT0FBTyxFQUFFLDhCQUE4QixFQUFFO2dCQUN6QyxVQUFVLEVBQUUsUUFBUSxDQUFDLEVBQUU7Z0JBQ3ZCLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxJQUFJLFNBQVM7YUFDcEMsQ0FBQTtRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQTtBQUMzQixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsU0FBZ0IsNkJBQTZCLENBQzNDLEdBQTRDO0lBRTVDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNULE9BQU07SUFDUixDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUEsNENBQW9CLEVBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdEMsT0FBTTtJQUNSLENBQUM7SUFDRCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUM3Qiw0QkFBNEIsQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFJLFdBQVcsQ0FBQyxDQUN4RCxDQUFBO0FBQ0gsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0IseUJBQXlCLENBQUMsS0FJekM7SUFDQyxPQUFPLENBQ0wsS0FBSyxDQUFDLE1BQU0sS0FBSyxVQUFVO1FBQzNCLE9BQU8sQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO1FBQzFCLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FDbkIsQ0FBQTtBQUNILENBQUMifQ==

package/README.md

@@ -245,7 +245,6 @@ curl "http://localhost:9000/admin/orders/order_123/refund-context" \
 | Swaps routes | `/swaps`, `/swaps/:id` | Exchange listing/detail pages | Search, filters, reject/cancel exchange; uses `/admin/swaps*`. |
 | Payments routes | `/payments`, `/payments/:id` | Transaction list + detail pages | Filter transactions and inspect gateway payload. |
 | Refunds routes | `/refunds`, `/refunds/:id` | Refund list + detail pages | Filter by status/provider/date/amount; view computed refund context. |
-| `order-refund-context-widget` | `order.details.after` | Refund context panel | Order checkout payment method (including guest orders), refund calculation (product amount, return charge, processed final refund), edit refund mode/details/images, upload images, mark refunded. |
 | `order-gift-items-widget` | `order.details.side.after` | Gift item widget | Reads gift metadata and downloads generated gift card image. |
 
 ## Models & Entities
@@ -592,7 +591,7 @@ The plugin includes a `refund_payment_mapping` module: one row per return linkin
   - `PUT /admin/refund-payment-mapping/:return_id` — update admin-only fields. Body: `{ refund_mode?: "offline" | "online" | null, images?: string[], details?: string | null }` (partial; only provided keys are updated).
   - `POST /admin/refund-payment-mapping/:return_id/mark-refunded` — set `is_refunded = true` (idempotent). Requires Medusa return status `received`; otherwise `400 NOT_ALLOWED`. Already-refunded mappings still succeed without re-checking receive status.
 - **Receive-before-refund guard**: Middleware on Medusa core `POST /admin/payments/:id/refund` rejects the request with `400 NOT_ALLOWED` when the order has any return in `open`, `requested`, or `partially_received` (including exchange-linked returns). Message: `Cannot process a refund while the return is {status}. Receive the returned items first.` Orders with no return, or only `received` / `canceled` returns, are not blocked.
-- **Order detail integration**: `GET /admin/orders/:order_id/refund-context` — aggregated read returning `return_id`, `return_status`, `can_process_refund` (`true` only when status is `received` and the mapping exists and is not already refunded), `order_payment` (checkout `provider_id`, human-readable `label`, `is_cod` — used for guest orders that have no saved `payment_detail`), `refund_mapping` (id, payment_id, is_refunded, refund_mode, images, details), `payment_detail` (id, type, detail_json, is_default) resolved from the customer's specified or default payment detail, and `refund` (product_amount, return_charge, expected_net_amount, final_refund_amount, currency_code, is_processed, breakdown_matches, destination_label). `final_refund_amount` is the processed payment refund (or COD/offline `return.refund_amount` after mark-refunded), not `product_amount - return_charge`. Returns null blocks when no return or mapping exists. An admin widget at `order.details.after` shows **Order payment method** (the provider used at checkout, including guest orders), **Refund calculation**, refund payment method, **Refund mode** (Offline/Online), **Details**, **Images** (with upload via Medusa `POST /admin/uploads`), and **Mark refunded** only when `can_process_refund` is true. While the return is unreceived the widget tells admins to receive items first and not refund from Payments. Only admin can change refund_mode, images, and details.
+- **Order detail integration**: `GET /admin/orders/:order_id/refund-context` — aggregated read returning `return_id`, `return_status`, `can_process_refund` (`true` only when status is `received` and the mapping exists and is not already refunded), `order_payment` (checkout `provider_id`, human-readable `label`, `is_cod` — used for guest orders that have no saved `payment_detail`), `refund_mapping` (id, payment_id, is_refunded, refund_mode, images, details), `payment_detail` (id, type, detail_json, is_default) resolved from the customer's specified or default payment detail, and `refund` (product_amount, return_charge, expected_net_amount, final_refund_amount, currency_code, is_processed, breakdown_matches, destination_label). `final_refund_amount` is the processed payment refund (or COD/offline `return.refund_amount` after mark-refunded), not `product_amount - return_charge`. Returns null blocks when no return or mapping exists. Used by admin refund/return detail pages; refund_mode, images, and details are admin-only via the mapping APIs above.
 - **Store return payload**: `GET /store/returns` and `GET /store/returns/:id` attach the same `refund` object so the storefront can render the breakdown. `GET /store/orders/:order_id/refund-payment-mappings` includes `refund` per mapping.
 - **Registration**: Add the module in `medusa-config.js` (e.g. `orderManagement.modules["refund-payment-mapping"]`) and run migrations.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "order-management",
-  "version": "0.0.95",
+  "version": "0.0.96",
   "description": "A starter for Medusa plugins.",
   "author": "Medusa (https://medusajs.com)",
   "license": "MIT",