feat: added refunds

Author: BolverBlitz

api/settings.js

@@ -41,6 +41,7 @@ const getSettingsToggleSchema = () => {
         'LOW_FUNDS_WARNING',
         'ERROR_REPORTS_ACTIVE',
         'LOW_STOCK_WARNING',
+        'AUTO_REFUNDS_ACTIVE',
     ];
     if (!isEBGOAuthEnabled()) settingKeys.unshift('REG_CODE_ACTIVE');
 
@@ -98,6 +99,10 @@ const settingsLowStockSchema = Joi.object({
     LOW_STOCK_PERCENT: Joi.number().min(0).max(100).required(),
 });
 
+const settingsRefundsSchema = Joi.object({
+    AUTO_REFUNDS_MINUTES: Joi.number().integer().min(1).max(10080).required(),
+});
+
 router.get('/logs', verifyRequest('app.admin.stats.read'), limiter(5), async (req, res) => {
     return res.json({ logs: getMemoryLogs() });
 });
@@ -173,6 +178,12 @@ router.put('/lowStock', verifyRequest('app.admin.settings.write'), limiter(10),
     res.status(200).json({ success: true });
 });
 
+router.put('/refunds', verifyRequest('app.admin.settings.write'), limiter(10), async (req, res) => {
+    const body = await settingsRefundsSchema.validateAsync(req.body);
+    await updateSetting('AUTO_REFUNDS_MINUTES', body.AUTO_REFUNDS_MINUTES.toString());
+    res.status(200).json({ success: true });
+});
+
 router.get('/backup', verifyRequest('app.admin.backup.read'), limiter(5), async (req, res) => {
     const backups = getBackups();
     return res.json(backups);

api/transactions.js

@@ -1,6 +1,6 @@
 const { verifyRequest } = require('@middleware/verifyRequest');
 const { limiter } = require('@middleware/limiter');
-const { getUserTransactionHistory, getAllTransactionHistory, getUserIdByUUID } = require('@lib/sqlite/users');
+const { getUserTransactionHistory, getAllTransactionHistory, getUserIdByUUID, refundTransaction } = require('@lib/sqlite/users');
 const Joi = require('@lib/sanitizer');
 const express = require('ultimate-express');
 const router = new express.Router();
@@ -20,6 +20,10 @@ const userUUIDSchema = Joi.object({
     uuid: Joi.string().uuid().required(),
 });
 
+const transactionIdSchema = Joi.object({
+    id: Joi.number().integer().min(1).required(),
+});
+
 router.get('/', verifyRequest('web.user.transactions.read'), limiter(4), async (req, res) => {
     const query = await paginationSchema.validateAsync(req.query);
     const transactions = await getUserTransactionHistory(req.user.user_data.id, query.limit, query.page, query.groupbyday);
@@ -45,6 +49,28 @@ router.get('/user/:uuid', verifyRequest('web.admin.transactions.read'), limiter(
     res.json({ transactions });
 });
 
+router.post('/:id/refund', verifyRequest('web.user.transactions.write'), limiter(2), async (req, res) => {
+    const params = await transactionIdSchema.validateAsync(req.params);
+    const result = refundTransaction(params.id, req.user.user_data.id);
+
+    if (!result.success) {
+        return res.status(result.status || 400).json({ error: result.error || 'Refund failed' });
+    }
+
+    return res.json({ success: true, refundedAmount: result.refundedAmount });
+});
+
+router.post('/admin/:id/refund', verifyRequest('web.admin.transactions.write'), limiter(2), async (req, res) => {
+    const params = await transactionIdSchema.validateAsync(req.params);
+    const result = refundTransaction(params.id, req.user.user_data.id, { force: true });
+
+    if (!result.success) {
+        return res.status(result.status || 400).json({ error: result.error || 'Refund failed' });
+    }
+
+    return res.json({ success: true, refundedAmount: result.refundedAmount });
+});
+
 module.exports = {
     router: router,
     PluginName: PluginName,

config/locales/de/AdminSettings.json

@@ -76,6 +76,13 @@
       "Percent": "Trigger in Prozent vom Zielbestand"
     }
   },
+  "Refunds": {
+    "Title": "Rückerstattungen",
+    "Description": "Erlaube Benutzern, eigene Transaktionen innerhalb eines Zeitfensters automatisch rückerstatten zu lassen.",
+    "ToggleLabel": "Automatische Rückerstattungen",
+    "Minutes": "Zeitfenster in Minuten",
+    "AUTO_REFUNDS_MINUTES": "Zeitfenster in Minuten"
+  },
   "Button": {
     "Save": "Speichern",
     "Saving": "Speichern...",

config/locales/de/Items.json

@@ -15,6 +15,12 @@
     "SystemPurchase": "Kauf von Artikel(n)",
     "AuthorizedBy": "Autorisiert von {{name}} um {{time}}",
     "GroupByDay": "Nach Tag gruppieren",
+    "Refund": "Rückerstatten",
+    "Refunded": "Rückerstattet",
+    "RefundModalTitle": "Rückerstattung bestätigen",
+    "RefundConfirm": "Möchtest du diese Transaktion wirklich rückerstatten?",
+    "RefundSuccess": "Rückerstattung erfolgreich.",
+    "RefundError": "Rückerstattung fehlgeschlagen.",
     "Sale": "Angebot",
     "Discounts": {
         "Manage": "Rabatte benachrichtigen",

lib/sqlite/users.js

@@ -261,11 +261,14 @@ const getUserTransactionHistory = async (user_id, limit = 10, page = 1, groupbyd
   if (groupbyday) {
     query = `
       SELECT
+        NULL AS id,
         t.user_id,
         t.item_id,
         SUM(t.quantity) AS quantity,
         SUM(t.price_at_transaction * t.quantity) / SUM(t.quantity) / 100.0 AS price_at_transaction,
         t.transaction_timestamp,
+        t.status,
+        0 AS can_refund,
         t.custom_item_text,
         i.uuid AS item_uuid,
         i.name AS item_name,
@@ -285,19 +288,29 @@ const getUserTransactionHistory = async (user_id, limit = 10, page = 1, groupbyd
       WHERE
         t.user_id = ?
       GROUP BY
-        DATE(t.transaction_timestamp), t.item_id, t.custom_item_text, t.user_id, i.uuid, i.name, u.uuid, u.name, u.username, initiator.name, initiator.username
+        DATE(t.transaction_timestamp), t.item_id, t.status, t.custom_item_text, t.user_id, i.uuid, i.name, u.uuid, u.name, u.username, initiator.name, initiator.username
       ORDER BY
         transaction_timestamp DESC
       LIMIT ? OFFSET ?
     `;
   } else {
     query = `
       SELECT
+        t.id,
         t.user_id,
         t.item_id,
         t.quantity,
         t.price_at_transaction / 100.0 AS price_at_transaction,
         t.transaction_timestamp,
+        t.status,
+        CASE
+          WHEN t.status = 0
+            AND NOT (i.uuid = '13620506-b9f8-44d7-a9ff-d1b58ddee93f' AND t.custom_item_text IS NULL)
+            AND (SELECT setting_value FROM app_settings WHERE setting_key = 'AUTO_REFUNDS_ACTIVE') = 'true'
+            AND datetime(t.transaction_timestamp, '+' || COALESCE((SELECT setting_value FROM app_settings WHERE setting_key = 'AUTO_REFUNDS_MINUTES'), '0') || ' minutes') >= datetime('now')
+          THEN 1
+          ELSE 0
+        END AS can_refund,
         t.custom_item_text,
         i.uuid AS item_uuid,
         i.name AS item_name,
@@ -338,11 +351,14 @@ const getAllTransactionHistory = async (limit = 10, page = 1, groupbyday = true)
   if (groupbyday) {
     query = `
       SELECT
+        NULL AS id,
         t.user_id,
         t.item_id,
         SUM(t.quantity) AS quantity,
         SUM(t.price_at_transaction * t.quantity) / SUM(t.quantity) / 100.0 AS price_at_transaction,
         t.transaction_timestamp,
+        t.status,
+        0 AS can_refund,
         t.custom_item_text,
         i.uuid AS item_uuid,
         i.name AS item_name,
@@ -360,7 +376,7 @@ const getAllTransactionHistory = async (limit = 10, page = 1, groupbyday = true)
       JOIN
         users initiator ON t.initiator_id = initiator.id
       GROUP BY
-        DATE(t.transaction_timestamp), t.item_id, t.custom_item_text, t.user_id, i.uuid, i.name, u.uuid, u.name, u.username, initiator.name, initiator.username
+        DATE(t.transaction_timestamp), t.item_id, t.status, t.custom_item_text, t.user_id, i.uuid, i.name, u.uuid, u.name, u.username, initiator.name, initiator.username
       ORDER BY
         transaction_timestamp DESC
       LIMIT ? OFFSET ?
@@ -369,11 +385,19 @@ const getAllTransactionHistory = async (limit = 10, page = 1, groupbyday = true)
   } else {
     query = `
       SELECT
+        t.id,
         t.user_id,
         t.item_id,
         t.quantity,
         t.price_at_transaction / 100.0 AS price_at_transaction,
         t.transaction_timestamp,
+        t.status,
+        CASE
+          WHEN t.status = 0
+            AND NOT (i.uuid = '13620506-b9f8-44d7-a9ff-d1b58ddee93f' AND t.custom_item_text IS NULL)
+          THEN 1
+          ELSE 0
+        END AS can_refund,
         t.custom_item_text,
         i.uuid AS item_uuid,
         i.name AS item_name,
@@ -400,6 +424,71 @@ const getAllTransactionHistory = async (limit = 10, page = 1, groupbyday = true)
   return db.prepare(query).all(...params);
 }
 
+const isAutoRefundAvailable = () => {
+  const active = db.prepare('SELECT setting_value FROM app_settings WHERE setting_key = ?').get('AUTO_REFUNDS_ACTIVE');
+  return active?.setting_value === 'true';
+};
+
+const getAutoRefundMinutes = () => {
+  const setting = db.prepare('SELECT setting_value FROM app_settings WHERE setting_key = ?').get('AUTO_REFUNDS_MINUTES');
+  const minutes = Number(setting?.setting_value ?? 0);
+  return Number.isFinite(minutes) && minutes > 0 ? minutes : 0;
+};
+
+const refundTransaction = (transactionId, requesterId, { force = false } = {}) => {
+  const runRefund = db.transaction((id, userId, forceRefund) => {
+    const transaction = db.prepare(`
+      SELECT
+        t.id,
+        t.user_id,
+        t.item_id,
+        t.quantity,
+        t.price_at_transaction,
+        t.transaction_timestamp,
+        t.status,
+        t.custom_item_text,
+        i.uuid AS item_uuid
+      FROM transactions t
+      JOIN items i ON i.id = t.item_id
+      WHERE t.id = ?
+    `).get(id);
+
+    if (!transaction) return { success: false, status: 404, error: 'Transaction not found' };
+    if (transaction.status === 1) return { success: false, status: 409, error: 'Transaction already refunded' };
+    if (transaction.item_uuid === '13620506-b9f8-44d7-a9ff-d1b58ddee93f' && !transaction.custom_item_text) {
+      return { success: false, status: 400, error: 'System transactions cannot be refunded' };
+    }
+
+    if (!forceRefund) {
+      if (transaction.user_id !== userId) return { success: false, status: 404, error: 'Transaction not found' };
+      if (!isAutoRefundAvailable()) return { success: false, status: 403, error: 'Auto refunds disabled' };
+
+      const minutes = getAutoRefundMinutes();
+      const timestamp = `${String(transaction.transaction_timestamp).replace(' ', 'T')}Z`;
+      const ageMs = Date.now() - new Date(timestamp).getTime();
+      if (!minutes || Number.isNaN(ageMs) || ageMs > minutes * 60 * 1000) {
+        return { success: false, status: 403, error: 'Refund window expired' };
+      }
+    }
+
+    const refundAmount = transaction.price_at_transaction * transaction.quantity;
+    const balanceDelta = transaction.item_uuid === '13620506-b9f8-44d7-a9ff-d1b58ddee93f' && !transaction.custom_item_text
+      ? refundAmount * -1
+      : refundAmount;
+    db.prepare('UPDATE users SET balance = balance + ? WHERE id = ?').run(balanceDelta, transaction.user_id);
+    db.prepare('UPDATE items SET stock = stock + ? WHERE id = ? AND is_active = 1').run(transaction.quantity, transaction.item_id);
+    db.prepare('UPDATE transactions SET status = 1 WHERE id = ?').run(transaction.id);
+    db.prepare(`
+      INSERT INTO refunds (user_id, transaction_id, authorizer_id, status, approved_timestamp)
+      VALUES (?, ?, ?, 1, datetime('now'))
+    `).run(transaction.user_id, transaction.id, userId);
+
+    return { success: true, refundedAmount: refundAmount };
+  });
+
+  return runRefund(transactionId, requesterId, force);
+};
+
 /**
  * Retrieves a user's favorite items.
  * @param {Number} user_id
@@ -578,6 +667,7 @@ module.exports = {
   purchaseItem,
   getUserTransactionHistory,
   getAllTransactionHistory,
+  refundTransaction,
   getUserFavorites,
   updateUserUserName,
   updateUserUserNameByUUID,

seeder.sql

@@ -14,7 +14,9 @@ INSERT OR IGNORE INTO app_settings (setting_key, setting_value) VALUES
 ('LOW_FUNDS_STRING', 'Bitte lade dein Konto auf!'),
 ('ERROR_REPORTS_ACTIVE', 'false'),
 ('LOW_STOCK_WARNING', 'false'),
-('LOW_STOCK_PERCENT', '20');
+('LOW_STOCK_PERCENT', '20'),
+('AUTO_REFUNDS_ACTIVE', 'false'),
+('AUTO_REFUNDS_MINUTES', '10');
 
 INSERT OR IGNORE INTO item_categories (uuid, name, is_active) VALUES
 ('13620506-b9f8-44d7-a9ff-d1b58ddee93f', 'System', 2); -- 2 To Hide it