Myron Blair 674ec71682 Add in-admin refund processing for Square token purchases; commit earlier pending security fixes ...

Refund feature: token_purchases had no way to refund a completed Square
payment - the existing resolve_purchase action only approves/rejects
manual (Zelle etc) payments still in pending status. Adds a real
refund_purchase action (api/admin.php) that calls Squares actual Refunds
API via a new SquarePayment::refund() method, updates status to the new
refunded enum value, logs the refund ID, and claws back the tokens
credited on purchase (clamped at 0 if the customer already spent some,
reported back as a shortfall so staff know). UI: admin/index.php shows a
Refund button on completed card purchases with a square_payment_id.

Tested in sandbox: full refund with full token clawback, and a shortfall
scenario (user already spent below the credited amount) to confirm
clamping works correctly rather than going negative.

Also committing two earlier pending fixes from this session that were
never committed: .htaccess .py/!install!! blocking hardening and moving
bump_version.PHPs BUMP_KEY out of the web-reachable file into
includes/config.php.

2026-07-05 15:45:50 +00:00

..

index.php

Add in-admin refund processing for Square token purchases; commit earlier pending security fixes

2026-07-05 15:45:50 +00:00

login.php

Initial commit

2026-05-22 12:52:50 +00:00