Reject duplicate refunds and cap refunds per order
Trail-Session: codex:588264da-bbc7-49f7-9130-d2cfe6125fcd
Trail-Link: http://localhost:8787/repos/payments-api/session/588264da-bbc7-49f7-9130-d2cfe6125fcd
Lleo committed 5 days ago · maincommit 064166f2079ace776882bd38fd212f4739ef9e6b
Agent sessions behind this commit1
Support agents keep double-clicking refund and we refund twice (see reports/refund-abuse.md). Limit refunds to 3 per order per hour and reje
Conversationcodex:588264da-bbc7-49f7-9130-d2cfe6125fcd · transcript lines 0–10
Artifacts1
Showing 1 changed file with 11 additions and 0 deletions.
app/refunds.py+11 −0
@@ -2,7 +2,18 @@ from app.db import db
from app.stripe import refund
+MAX_PER_HOUR = 3
+
+
+class RefundRejected(Exception):
+ pass
+
+
def create_refund(order_id, amount, agent):
+ if db.refunds.count(order_id=order_id, amount=amount, since_seconds=60):
+ raise RefundRejected("duplicate refund within a minute")
+ if db.refunds.count(order_id=order_id, since_seconds=3600) >= MAX_PER_HOUR:
+ raise RefundRejected("refund limit reached for this order")
order = db.orders.get(order_id)
refund(order.payment_intent, amount)
db.refunds.insert(order_id=order_id, amount=amount, agent=agent)