Files
commerce/api/order/handlers.go
zooqueenandHanzo Dev a265087b13 No route makes or records a refund; a refund or dispute is recorded only from the processor's signed webhook, once, and an inquiry that closes without a chargeback restores its period
Commerce never initiates a refund. POST /v1/billing/refunds, POST /v1/billing/refund,
POST /v1/order/:orderid/refund and POST /v1/payment/:paymentid/refund are gone with
their handlers (engine.CreateRefund, checkout Refund, square.Refund) and the helpers
only they used; GET /v1/billing/refunds stays read-only. A claim is settled by a
replacement order, never a refund.

A refund or dispute of a plan's payment reaches its invoice only from the
processor's webhook, under the processor's own refund id, through one locked
writer that reads the invoice afresh (engine.RecordRefund, engine.RecordDispute).
Every state a dispute reports reaches the invoice; INQUIRY_CLOSED holds the
payment no longer, WON stays final and LOST stays disputed.

No backfill of the payment-to-invoice index is run: the only plan payments made
before v1.50.139 are the team's own card purchases (z24, zk) and one Square
record.

Co-authored-by: Hanzo Dev <[email protected]>
2026-10-01 17:04:54 -07:00

37 lines
1.4 KiB
Go

package order
import (
"github.com/zap-proto/zip"
checkoutApi "github.com/hanzoai/commerce/api/checkout"
"github.com/hanzoai/commerce/middleware"
"github.com/hanzoai/commerce/models/order"
"github.com/hanzoai/commerce/util/permission"
"github.com/hanzoai/commerce/util/rest"
)
func Route(router *zip.Group, args ...zip.Handler) {
adminRequired := middleware.TokenRequired(permission.Admin)
publishedRequired := middleware.TokenRequired(permission.Admin, permission.Published)
namespaced := middleware.Namespace()
api := rest.New(order.Order{})
api.POST("/:orderid/authorize", publishedRequired, namespaced, checkoutApi.Authorize)
api.POST("/:orderid/capture", publishedRequired, namespaced, checkoutApi.Capture)
api.POST("/:orderid/charge", publishedRequired, namespaced, checkoutApi.Charge)
api.GET("/:orderid/payments", adminRequired, namespaced, Payments)
api.GET("/:orderid/returns", adminRequired, namespaced, Returns)
api.GET("/:orderid/status", publishedRequired, namespaced, Status)
api.GET("/:orderid/sendorderconfirmation", adminRequired, namespaced, SendOrderConfirmation)
api.GET("/:orderid/sendrefundconfirmation", adminRequired, namespaced, SendRefundConfirmation)
api.GET("/:orderid/sendfulfillmentconfirmation", adminRequired, namespaced, SendFulfillmentConfirmation)
api.Create = Create
api.Update = Update
api.Patch = Patch
api.Route(router, args...)
}