meshkee-app/backend
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Lock payment process steps to gateway-only updates.

Browse Source 
Reject admin PATCH of awaiting-payment / payment-successful so order payment status cannot be set manually.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Alireza Hassani
2026-10-02 22:07:32 +03:30
co-authored by Cursor
parent 88ef4e82a1
commit 0a330b8749
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/business-settings/business-settings.util.ts
+11 -1
View File
@@ -370,7 +370,17 @@ export function listPublicPaymentGateways(settings: EPaymentSettings) {
};
}
const PAYMENT_PROCESS_STEP_IDS = ['awaiting-payment', 'payment-successful'] as const;
/** System-managed payment steps — set by gateway callbacks, not admin UI. */
export const PAYMENT_PROCESS_STEP_IDS = [
'awaiting-payment',
'payment-successful',
] as const;
export type PaymentProcessStepId = (typeof PAYMENT_PROCESS_STEP_IDS)[number];
export function isSystemPaymentProcessStep(stepId: string): boolean {
return (PAYMENT_PROCESS_STEP_IDS as readonly string[]).includes(stepId);
}
/** Prepend default payment steps when an older store settings JSON omits them. */
function ensurePaymentProcessSteps(steps: OrderProcessStep[]): OrderProcessStep[] {