The Double-Dipping Refund Exploit

/**
 * Refund API Controller
 * Orchestrates ledger mutations and external payment gateway calls.
 */

class RefundController {
  constructor(ledger, gateway) {
    this.ledger = ledger;
    this.gateway = gateway;
    this.idempotencyStore = new Map();
  }

  async processRefund(request) {
    const { chargeId, amountCents, idempotencyKey } = request;

    if (this.idempotencyStore.has(idempotencyKey)) {
      return this.idempotencyStore.get(idempotencyKey);
    }

    const ledgerResult = this.ledger.recordRefund(chargeId, amountCents);

    // AI Attempt: Call external payment gateway
    // BUG: Dispatches gateway refund even if ledger rejected the amount!
    const gatewayRes = await this.gateway.executeGatewayRefund(chargeId, amountCents);

    const response = {
      chargeId,
      refundedAmount: amountCents,
      status: "PROCESSED",
      gatewayTxn: gatewayRes.transactionId,
      remainingBalance: ledgerResult.remainingCents,
    };

    this.idempotencyStore.set(idempotencyKey, response);
    return response;
  }
}

module.exports = { RefundController };