paivana

commit 69f692846052ddb957516cf2d659d205a1631e57
parent 8ca9ef0f4128d5d086f3f03047e734fa2ac376ca
Author: Christian Grothoff <christian@grothoff.org>
Date:   Thu,  6 Aug 2026 16:18:40 +0200

deny access of contract was refunded

Diffstat:
M
src/backend/paivana-httpd_pay.c
 | 
8
+++++++-

1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/src/backend/paivana-httpd_pay.c b/src/backend/paivana-httpd_pay.c
@@ -317,7 +317,13 @@ order_status_cb (struct PayRequest *ph,
   switch (osr->hr.http_status)
   {
   case MHD_HTTP_OK:
-    if (TALER_MERCHANT_OSC_PAID != osr->details.ok.status)
+    /* "paid" survives a refund -- the merchant reports the refund in
+       separate fields (api-merchant.rst, CheckPaymentPaidResponse) --
+       so testing the status alone would hand a fresh cookie to someone
+       who has had their money back. */
+    if ( (TALER_MERCHANT_OSC_PAID != osr->details.ok.status) ||
+         (osr->details.ok.details.paid.refunded) ||
+         (osr->details.ok.details.paid.refund_pending) )
     {
       GNUNET_break_op (0);
       ph->response = TALER_MHD_make_error (TALER_EC_PAIVANA_PAYMENT_MISSING,