myron/tomtomgames
1
0
Fork 0
mirror of https://github.com/myronblair/tomtomgames synced 2026-07-27 17:02:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add in-admin refund processing for Square token purchases; commit earlier pending security fixes

Browse Source 
Refund feature: token_purchases had no way to refund a completed Square
payment - the existing resolve_purchase action only approves/rejects
manual (Zelle etc) payments still in pending status. Adds a real
refund_purchase action (api/admin.php) that calls Squares actual Refunds
API via a new SquarePayment::refund() method, updates status to the new
refunded enum value, logs the refund ID, and claws back the tokens
credited on purchase (clamped at 0 if the customer already spent some,
reported back as a shortfall so staff know). UI: admin/index.php shows a
Refund button on completed card purchases with a square_payment_id.

Tested in sandbox: full refund with full token clawback, and a shortfall
scenario (user already spent below the credited amount) to confirm
clamping works correctly rather than going negative.

Also committing two earlier pending fixes from this session that were
never committed: .htaccess .py/!install!! blocking hardening and moving
bump_version.PHPs BUMP_KEY out of the web-reachable file into
includes/config.php.
This commit is contained in:
Myron Blair
2026-07-05 15:45:50 +00:00
parent 43ef4c9699
commit 674ec71682
4 changed files with 92 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/admin.php
+63
View File
@@ -1,5 +1,6 @@
<?php
require_once __DIR__ . '/../../includes/auth.php';
require_once __DIR__ . '/../../includes/square.php';
header('Content-Type: application/json');
requireAdmin();
@@ -149,6 +150,68 @@ switch ($action) {
echo json_encode(['success'=>true]);
break;
// ─── REFUND PURCHASE (real Square refund) ────────────────
case 'refund_purchase':
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { echo json_encode(['success'=>false]); exit; }
$data = json_decode(file_get_contents('php://input'), true);
$id = (int)($data['id'] ?? 0);
$reason = trim($data['reason'] ?? '');
$row = db()->prepare("SELECT * FROM token_purchases WHERE id=? AND status='completed'");
$row->execute([$id]);
$purchase = $row->fetch();
if (!$purchase) {
echo json_encode(['success'=>false,'error'=>'Purchase not found or not in a refundable state']); exit;
}
if ($purchase['payment_method'] !== 'card' || empty($purchase['square_payment_id'])) {
echo json_encode(['success'=>false,'error'=>'This purchase has no Square payment to refund']); exit;
}
$amountCents = isset($data['amount']) ? (int) round((float)$data['amount'] * 100) : (int) $purchase['amount_cents'];
if ($amountCents <= 0 || $amountCents > (int) $purchase['amount_cents']) {
echo json_encode(['success'=>false,'error'=>'Invalid refund amount']); exit;
}
$square = new SquarePayment();
$result = $square->refund($purchase['square_payment_id'], $amountCents, $reason ?: ('Purchase #' . $id));
if (!$result['success']) {
echo json_encode(['success'=>false,'error'=>$result['error']]); exit;
}
$note = 'Refunded $' . number_format($amountCents / 100, 2) . ' via Square (refund ID: ' . $result['refund_id'] . ')' . ($reason ? ' - ' . $reason : '');
$existingNote = $purchase['admin_note'] ? $purchase['admin_note'] . " | " . $note : $note;
db()->beginTransaction();
try {
db()->prepare("UPDATE token_purchases SET status='refunded', admin_note=?, refund_id=? WHERE id=?")
->execute([$existingNote, $result['refund_id'], $id]);
// Claw back the tokens credited on purchase, clamped at 0
$userRow = db()->prepare("SELECT tokens FROM users WHERE id=?");
$userRow->execute([$purchase['user_id']]);
$currentTokens = (float) ($userRow->fetchColumn() ?: 0);
$newTokens = max(0, $currentTokens - (float) $purchase['tokens']);
db()->prepare("UPDATE users SET tokens=? WHERE id=?")->execute([$newTokens, $purchase['user_id']]);
db()->commit();
} catch (Exception $e) {
db()->rollBack();
echo json_encode(['success'=>false,'error'=>'Refund processed on Square but failed to update local records: ' . $e->getMessage()]); exit;
}
$tokensClawedBack = min((float) $purchase['tokens'], $currentTokens);
$shortfall = (float) $purchase['tokens'] - $tokensClawedBack;
echo json_encode([
'success' => true,
'refund_id' => $result['refund_id'],
'tokens_clawed_back' => $tokensClawedBack,
'token_shortfall' => $shortfall,
]);
break;
// ─── CASHOUTS ─────────────────────────────────────────────
case 'cashouts':
$status = $_GET['status'] ?? 'pending';