concurrency-guard 0.1.0__tar.gz

concurrency_guard-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Lint, Type Check, and Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install .[dev]
+
+      - name: Run Ruff Linter
+        run: |
+          ruff check .
+
+      - name: Run Mypy Type Checker
+        run: |
+          mypy src/
+
+      - name: Run Pytest Suite
+        run: |
+          pytest -v
+

concurrency_guard-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+*.egg-info/
+dist/
+build/
+

concurrency_guard-0.1.0/PKG-INFO

@@ -0,0 +1,191 @@
+Metadata-Version: 2.5
+Name: concurrency-guard
+Version: 0.1.0
+Summary: Deterministic AST + Runtime Concurrency & Idempotency Verifier for Python FastAPI/SQLAlchemy backends
+Requires-Python: >=3.10
+Requires-Dist: aiosqlite>=0.20.0
+Requires-Dist: fastapi>=0.111.0
+Requires-Dist: greenlet>=3.0.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: libcst>=1.4.0
+Requires-Dist: rich>=13.7.0
+Requires-Dist: sqlalchemy>=2.0.30
+Requires-Dist: typer>=0.12.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
+Requires-Dist: pytest>=8.2.0; extra == 'dev'
+Requires-Dist: ruff>=0.4.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ConcurrencyGuard (`cguard`)
+
+[![CI](https://github.com/AyushkhatiDev/concurrency-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/AyushkhatiDev/concurrency-guard/actions/workflows/ci.yml)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+**Deterministic AST + Runtime Concurrency & Idempotency Verifier for Python FastAPI, SQLAlchemy, and Celery Backends.**
+
+---
+
+## ⚡ Why ConcurrencyGuard?
+
+Modern async Python services frequently suffer from silent concurrency bugs, double-spend race conditions, lost updates, and duplicate background tasks. Traditional linters only check syntax and type hints, while external LLM tools hallucinate or miss non-local control flow races.
+
+**ConcurrencyGuard (`cguard`)** solves this with a **100% deterministic pipeline**:
+1. **Pure AST Static Scanning**: Catches race patterns, missing idempotency keys, N+1 queries, uniqueness races, and unsafe Celery retry tasks.
+2. **Runtime `asyncio.Barrier` Exploit Engine**: Proves race conditions empirically by synchronizing concurrent coroutines to hit endpoints at the exact same microsecond.
+3. **Deterministic `LibCST` Auto-Patcher**: Safely rewrites code to apply database row locks (`.with_for_update()`), inject FastAPI `Idempotency-Key` headers, and wrap transactions in `IntegrityError` guards.
+4. **Automated GitHub PR Reporter**: Emits rich Markdown comments with exploit proofs and diff previews for pull requests.
+
+---
+
+## 📋 Rule Catalog
+
+| Rule ID | Name | Target / Trigger Condition | Automated Fix |
+|:---|:---|:---|:---|
+| **`CG-001`** | **Unlocked Read-Modify-Write Race** | Async route reads database state with `select()`, mutates an attribute, and calls `commit()` without `.with_for_update()` locking. | Appends `.with_for_update()` row-level locks via LibCST. |
+| **`CG-002`** | **Missing Idempotency Guard** | Async `@app.post` or `@router.post` route mutates state without an `idempotency_key` parameter. | Injects `idempotency_key: str = Header(..., alias="Idempotency-Key")` into route parameters. |
+| **`CG-003`** | **Async Loop N+1 Query Explode** | `db.execute(...)` or `session.execute(...)` call located directly inside a `for` or `async for` loop body. | Flags query explosion; suggests batching or eager loading (`joinedload`/`selectinload`). |
+| **`CG-004`** | **Check-Then-Act Uniqueness Race** | Async route checks existence with `select()`, calls `add()`, and commits without catching `sqlalchemy.exc.IntegrityError`. | Wraps commit statements in `try...except IntegrityError` with session rollback. |
+| **`CG-005`** | **Non-Idempotent Celery Retry Task** | Celery task (`@app.task`, `@shared_task`) with `autoretry_for` or `max_retries` executes mutations (`.add()`, `.commit()`, `.post()`) without `acks_late=True` or an idempotency lock. | Recommends `acks_late=True` and distributed deduplication lock before side-effects. |
+
+---
+
+## 🚀 Installation
+
+```bash
+# Clone and install in virtual environment
+git clone https://github.com/AyushkhatiDev/concurrency-guard.git
+cd concurrency-guard
+python -m venv .venv
+source .venv/bin/activate
+pip install -e .
+```
+
+To install with development and testing dependencies:
+```bash
+pip install -e ".[dev]"
+```
+
+---
+
+## 🛠️ CLI Usage
+
+### 1. `cguard scan` — Static AST Analysis
+Scan files or entire directories for concurrency vulnerabilities:
+```bash
+# Scan a single file
+cguard scan examples/vulnerable_wallet.py
+
+# Scan an entire codebase
+cguard scan src/
+```
+
+### 2. `cguard verify` — Runtime `asyncio.Barrier` Verification
+Simulate high-concurrency traffic using synchronized barrier workers to prove whether an invariant holds or breaks under load:
+```bash
+cguard verify examples/vulnerable_wallet.py --workers 20
+```
+
+Sample exploit proof output:
+```
+❌ CONCURRENCY INVARIANT VIOLATED (RACE PROVEN)
+Target File: examples/vulnerable_wallet.py
+Target Endpoint: POST /wallet/withdraw
+Concurrent Barrier Workers: 20
+Initial Wallet Balance: $50
+Successful Withdrawals ($50 each): 20
+Final Resulting Balance: $-950
+
+INVARIANT VIOLATION PROVEN:
+Multiple concurrent withdrawals succeeded against a $50 balance due to an unlocked
+Read-Modify-Write race condition (CG-001).
+```
+
+### 3. `cguard fix` — Deterministic LibCST Auto-Patcher
+Inspect and apply deterministic code patches:
+```bash
+# Preview auto-fixes (dry-run)
+cguard fix examples/vulnerable_wallet.py
+
+# Apply specific rule fix
+cguard fix examples/vulnerable_wallet.py --rule CG-001 --write
+
+# Apply all available auto-fixes directly to disk
+cguard fix examples/vulnerable_wallet.py --write
+```
+
+### 4. `cguard report` — GitHub Pull Request Markdown Reporter
+Generate comprehensive Markdown summaries for CI/CD:
+```bash
+# Print report to stdout
+cguard report examples/vulnerable_wallet.py
+
+# Write report to markdown file for GitHub Actions PR comment
+cguard report examples/vulnerable_wallet.py --output pr_report.md
+```
+
+---
+
+## 🤖 GitHub Action Integration
+
+Add ConcurrencyGuard to your pull request workflows:
+
+```yaml
+name: Concurrency Guard CI
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  concurrency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run ConcurrencyGuard Action
+        uses: AyushkhatiDev/concurrency-guard@main
+        with:
+          path: "app"
+          report-file: "app/main.py"
+          output: "pr-report.md"
+
+      - name: Post PR Comment
+        if: failure() || success()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            if (fs.existsSync('pr-report.md')) {
+              const body = fs.readFileSync('pr-report.md', 'utf8');
+              github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: body
+              });
+            }
+```
+
+---
+
+## 🧪 Testing
+
+ConcurrencyGuard is thoroughly tested with unit tests and runtime stress verifications:
+
+```bash
+# Run test suite
+pytest -v
+
+# Run lint and type checking
+ruff check .
+mypy src/
+```
+
+---
+
+## 📄 License
+
+MIT License. See [LICENSE](LICENSE) for details.

concurrency_guard-0.1.0/README.md

@@ -0,0 +1,171 @@
+# ConcurrencyGuard (`cguard`)
+
+[![CI](https://github.com/AyushkhatiDev/concurrency-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/AyushkhatiDev/concurrency-guard/actions/workflows/ci.yml)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+**Deterministic AST + Runtime Concurrency & Idempotency Verifier for Python FastAPI, SQLAlchemy, and Celery Backends.**
+
+---
+
+## ⚡ Why ConcurrencyGuard?
+
+Modern async Python services frequently suffer from silent concurrency bugs, double-spend race conditions, lost updates, and duplicate background tasks. Traditional linters only check syntax and type hints, while external LLM tools hallucinate or miss non-local control flow races.
+
+**ConcurrencyGuard (`cguard`)** solves this with a **100% deterministic pipeline**:
+1. **Pure AST Static Scanning**: Catches race patterns, missing idempotency keys, N+1 queries, uniqueness races, and unsafe Celery retry tasks.
+2. **Runtime `asyncio.Barrier` Exploit Engine**: Proves race conditions empirically by synchronizing concurrent coroutines to hit endpoints at the exact same microsecond.
+3. **Deterministic `LibCST` Auto-Patcher**: Safely rewrites code to apply database row locks (`.with_for_update()`), inject FastAPI `Idempotency-Key` headers, and wrap transactions in `IntegrityError` guards.
+4. **Automated GitHub PR Reporter**: Emits rich Markdown comments with exploit proofs and diff previews for pull requests.
+
+---
+
+## 📋 Rule Catalog
+
+| Rule ID | Name | Target / Trigger Condition | Automated Fix |
+|:---|:---|:---|:---|
+| **`CG-001`** | **Unlocked Read-Modify-Write Race** | Async route reads database state with `select()`, mutates an attribute, and calls `commit()` without `.with_for_update()` locking. | Appends `.with_for_update()` row-level locks via LibCST. |
+| **`CG-002`** | **Missing Idempotency Guard** | Async `@app.post` or `@router.post` route mutates state without an `idempotency_key` parameter. | Injects `idempotency_key: str = Header(..., alias="Idempotency-Key")` into route parameters. |
+| **`CG-003`** | **Async Loop N+1 Query Explode** | `db.execute(...)` or `session.execute(...)` call located directly inside a `for` or `async for` loop body. | Flags query explosion; suggests batching or eager loading (`joinedload`/`selectinload`). |
+| **`CG-004`** | **Check-Then-Act Uniqueness Race** | Async route checks existence with `select()`, calls `add()`, and commits without catching `sqlalchemy.exc.IntegrityError`. | Wraps commit statements in `try...except IntegrityError` with session rollback. |
+| **`CG-005`** | **Non-Idempotent Celery Retry Task** | Celery task (`@app.task`, `@shared_task`) with `autoretry_for` or `max_retries` executes mutations (`.add()`, `.commit()`, `.post()`) without `acks_late=True` or an idempotency lock. | Recommends `acks_late=True` and distributed deduplication lock before side-effects. |
+
+---
+
+## 🚀 Installation
+
+```bash
+# Clone and install in virtual environment
+git clone https://github.com/AyushkhatiDev/concurrency-guard.git
+cd concurrency-guard
+python -m venv .venv
+source .venv/bin/activate
+pip install -e .
+```
+
+To install with development and testing dependencies:
+```bash
+pip install -e ".[dev]"
+```
+
+---
+
+## 🛠️ CLI Usage
+
+### 1. `cguard scan` — Static AST Analysis
+Scan files or entire directories for concurrency vulnerabilities:
+```bash
+# Scan a single file
+cguard scan examples/vulnerable_wallet.py
+
+# Scan an entire codebase
+cguard scan src/
+```
+
+### 2. `cguard verify` — Runtime `asyncio.Barrier` Verification
+Simulate high-concurrency traffic using synchronized barrier workers to prove whether an invariant holds or breaks under load:
+```bash
+cguard verify examples/vulnerable_wallet.py --workers 20
+```
+
+Sample exploit proof output:
+```
+❌ CONCURRENCY INVARIANT VIOLATED (RACE PROVEN)
+Target File: examples/vulnerable_wallet.py
+Target Endpoint: POST /wallet/withdraw
+Concurrent Barrier Workers: 20
+Initial Wallet Balance: $50
+Successful Withdrawals ($50 each): 20
+Final Resulting Balance: $-950
+
+INVARIANT VIOLATION PROVEN:
+Multiple concurrent withdrawals succeeded against a $50 balance due to an unlocked
+Read-Modify-Write race condition (CG-001).
+```
+
+### 3. `cguard fix` — Deterministic LibCST Auto-Patcher
+Inspect and apply deterministic code patches:
+```bash
+# Preview auto-fixes (dry-run)
+cguard fix examples/vulnerable_wallet.py
+
+# Apply specific rule fix
+cguard fix examples/vulnerable_wallet.py --rule CG-001 --write
+
+# Apply all available auto-fixes directly to disk
+cguard fix examples/vulnerable_wallet.py --write
+```
+
+### 4. `cguard report` — GitHub Pull Request Markdown Reporter
+Generate comprehensive Markdown summaries for CI/CD:
+```bash
+# Print report to stdout
+cguard report examples/vulnerable_wallet.py
+
+# Write report to markdown file for GitHub Actions PR comment
+cguard report examples/vulnerable_wallet.py --output pr_report.md
+```
+
+---
+
+## 🤖 GitHub Action Integration
+
+Add ConcurrencyGuard to your pull request workflows:
+
+```yaml
+name: Concurrency Guard CI
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  concurrency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run ConcurrencyGuard Action
+        uses: AyushkhatiDev/concurrency-guard@main
+        with:
+          path: "app"
+          report-file: "app/main.py"
+          output: "pr-report.md"
+
+      - name: Post PR Comment
+        if: failure() || success()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            if (fs.existsSync('pr-report.md')) {
+              const body = fs.readFileSync('pr-report.md', 'utf8');
+              github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: body
+              });
+            }
+```
+
+---
+
+## 🧪 Testing
+
+ConcurrencyGuard is thoroughly tested with unit tests and runtime stress verifications:
+
+```bash
+# Run test suite
+pytest -v
+
+# Run lint and type checking
+ruff check .
+mypy src/
+```
+
+---
+
+## 📄 License
+
+MIT License. See [LICENSE](LICENSE) for details.

concurrency_guard-0.1.0/action.yml

@@ -0,0 +1,45 @@
+name: "ConcurrencyGuard Action"
+description: "Deterministic AST scanner and runtime race condition verifier for Python FastAPI & SQLAlchemy"
+author: "AyushkhatiDev"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  path:
+    description: "Path to file or directory to scan"
+    required: false
+    default: "."
+  report-file:
+    description: "File to generate GitHub PR Markdown report for"
+    required: false
+    default: ""
+  output:
+    description: "Output path for the Markdown report"
+    required: false
+    default: "concurrency-guard-report.md"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
+
+    - name: Install ConcurrencyGuard
+      shell: bash
+      run: |
+        pip install .
+
+    - name: Run ConcurrencyGuard Scan
+      shell: bash
+      run: |
+        cguard scan ${{ inputs.path }}
+
+    - name: Run ConcurrencyGuard Report
+      if: ${{ inputs.report-file != '' }}
+      shell: bash
+      run: |
+        cguard report ${{ inputs.report-file }} --output ${{ inputs.output }} || true
+

concurrency_guard-0.1.0/examples/real_world_ecommerce/__init__.py

@@ -0,0 +1,2 @@
+"""Real-world multi-file FastAPI e-commerce benchmark application."""
+

concurrency_guard-0.1.0/examples/real_world_ecommerce/checkout_router.py

@@ -0,0 +1,100 @@
+"""FastAPI checkout and payment router demonstrating real-world concurrency issues."""
+
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+from typing import Any
+
+from fastapi import APIRouter, Depends, Header, HTTPException, status
+from pydantic import BaseModel
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+
+from examples.real_world_ecommerce.models import Coupon, Order, OrderItem, WebhookEvent
+
+DATABASE_URL = "sqlite+aiosqlite:///:memory:"
+engine = create_async_engine(DATABASE_URL, echo=False)
+async_session = async_sessionmaker(engine, expire_on_commit=False, class_=AsyncSession)
+
+
+async def get_db() -> AsyncGenerator[AsyncSession, None]:
+    async with async_session() as session:
+        yield session
+
+
+router = APIRouter()
+
+
+class RedeemCouponRequest(BaseModel):
+    code: str
+    user_id: int
+
+
+@router.post("/coupons/redeem")
+async def redeem_coupon(
+    request: RedeemCouponRequest,
+    db: AsyncSession = Depends(get_db),
+) -> dict[str, str | int]:
+    """Redeem coupon using SQLAlchemy 2.0 await db.scalar without row-locking or idempotency."""
+    stmt = select(Coupon).where(Coupon.code == request.code)
+    coupon = await db.scalar(stmt)
+
+    if coupon is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Coupon not found")
+
+    if coupon.remaining_uses > 0:
+        # Race condition: Unlocked Read-Modify-Write via db.scalar (CG-001)
+        # Missing Idempotency-Key guard (CG-002)
+        coupon.remaining_uses -= 1
+        await db.commit()
+        return {"status": "redeemed", "remaining": coupon.remaining_uses}
+
+    raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Coupon exhausted")
+
+
+@router.get("/orders/with-items")
+async def get_orders_with_items(
+    db: AsyncSession = Depends(get_db),
+) -> list[dict[str, Any]]:
+    """Fetch orders and query items in a loop: Async Loop N+1 Query Explode (CG-003)."""
+    result = await db.execute(select(Order))
+    orders = result.scalars().all()
+    orders_data: list[dict[str, Any]] = []
+
+    for order in orders:
+        stmt = select(OrderItem).where(OrderItem.order_id == order.id)
+        # N+1 query: executes inside loop
+        items_result = await db.scalars(stmt)
+        items = items_result.all()
+        orders_data.append({"order_id": order.id, "items": len(items)})
+
+    return orders_data
+
+
+class StripeWebhookPayload(BaseModel):
+    event_id: str
+    event_type: str
+
+
+@router.post("/webhooks/stripe")
+async def handle_stripe_webhook(
+    payload: StripeWebhookPayload,
+    idempotency_key: str = Header(..., alias="Idempotency-Key"),
+    db: AsyncSession = Depends(get_db),
+) -> dict[str, str]:
+    """Check-then-act uniqueness race on webhook event ingestion (CG-004)."""
+    stmt = select(WebhookEvent).where(WebhookEvent.event_id == payload.event_id)
+    existing = await db.scalar(stmt)
+    if existing is not None:
+        return {"status": "already_processed"}
+
+    event = WebhookEvent(
+        event_id=payload.event_id,
+        event_type=payload.event_type,
+        processed=True,
+    )
+    db.add(event)
+    # Unprotected commit: violates uniqueness under race conditions
+    await db.commit()
+    return {"status": "processed"}
+

concurrency_guard-0.1.0/examples/real_world_ecommerce/models.py

@@ -0,0 +1,55 @@
+"""SQLAlchemy 2.0 declarative models for e-commerce benchmark."""
+
+from __future__ import annotations
+
+from sqlalchemy import Float, Integer, String
+from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
+
+
+class Base(DeclarativeBase):
+    pass
+
+
+class Coupon(Base):
+    __tablename__ = "coupons"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    code: Mapped[str] = mapped_column(String(50), unique=True, index=True, nullable=False)
+    remaining_uses: Mapped[int] = mapped_column(Integer, default=1, nullable=False)
+    discount_percent: Mapped[float] = mapped_column(Float, default=10.0, nullable=False)
+
+
+class Order(Base):
+    __tablename__ = "orders"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    user_id: Mapped[int] = mapped_column(Integer, nullable=False)
+    total_amount: Mapped[float] = mapped_column(Float, default=0.0, nullable=False)
+    status: Mapped[str] = mapped_column(String(50), default="PENDING", nullable=False)
+
+
+class OrderItem(Base):
+    __tablename__ = "order_items"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    order_id: Mapped[int] = mapped_column(Integer, nullable=False)
+    product_name: Mapped[str] = mapped_column(String(100), nullable=False)
+    price: Mapped[float] = mapped_column(Float, nullable=False)
+
+
+class WebhookEvent(Base):
+    __tablename__ = "webhook_events"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    event_id: Mapped[str] = mapped_column(String(100), unique=True, nullable=False)
+    event_type: Mapped[str] = mapped_column(String(100), nullable=False)
+    processed: Mapped[bool] = mapped_column(default=False, nullable=False)
+
+
+class Product(Base):
+    __tablename__ = "products"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    name: Mapped[str] = mapped_column(String(100), nullable=False)
+    price: Mapped[float] = mapped_column(Float, nullable=False)
+

concurrency_guard-0.1.0/examples/real_world_ecommerce/tasks.py

@@ -0,0 +1,27 @@
+"""Celery background tasks demonstrating retry non-idempotency."""
+
+from __future__ import annotations
+
+from celery import shared_task
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session, sessionmaker
+
+from examples.real_world_ecommerce.models import Order
+
+sync_engine = create_engine("sqlite:///:memory:")
+SyncSessionLocal = sessionmaker(bind=sync_engine, class_=Session)
+
+
+@shared_task(autoretry_for=(Exception,), max_retries=5)
+def process_refund(order_id: int) -> dict[str, str]:
+    """Process order refund with retries but without idempotency protection (CG-005)."""
+    session = SyncSessionLocal()
+    try:
+        order = session.get(Order, order_id)
+        if order is not None:
+            order.status = "REFUNDED"
+            session.commit()
+    finally:
+        session.close()
+    return {"status": "refunded"}
+