[eicyer]

Fixes Venmo payment confirmation so it stops skipping safety checks, and stops silently dropping mismatched payments.

Description

• updateOrderPaymentStatus was writing the order's payment status directly instead of going through the normal confirm-payment path — so it skipped the inventory check (risk of overselling limited items) and never refreshed the fundraiser's stats cache. It now calls the same confirmOrderPayment function admins use.
• On a payment amount mismatch, the old code just threw an error that got logged and swallowed — the buyer's order stayed PENDING, so they kept getting "please pay" reminders for money they'd already sent, and nobody on the seller side was told. It now records the mismatch on the order (new paidAmount / paymentMismatchAt columns), stops the reminder job from nagging that order, and immediately emails the buyer with what we received vs. what's owed.

testing

• Automated: added 10 new tests covering both fixes — backend/src/api/order/__tests__/order.services.test.ts (confirm routes through the real inventory check + cache refresh, with/without a payment method, mismatch recording) and backend/src/api/email/__tests__/email.services.test.ts (confirms on exact match and within the 1¢ tolerance, records + emails on mismatch, wraps confirm errors).

• Manual path for a reviewer: create a VENMO order, send updateOrderPaymentStatus(orderId, wrongAmount) — order should get paidAmount/paymentMismatchAt set and the buyer should get a mismatch email instead of the order silently staying pending.

Dependencies

Builds on #164 (rebased Jest test infrastructure) as it has a test suite.

Appendix / notes

• Needs a Prisma migration run against the dev/prod DB (paid_amount, payment_mismatch_at columns on orders) — not yet applied, see backend/prisma/migrations/20261004174637_add_order_payment_mismatch_fields/.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
curaise	Ready	Preview	Oct 29, 2026 4:56am UTC

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 2 committers have signed the CLA.

❌ Emir icyer
❌ Arsh-S

---

Emir icyer seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[jiminkim214]

Hey Emir, awesome job on this. It looks like a solid fix. One small thing to consider: toNumber() is fine for normal order totals, and toFixed(2) is there if you would rather store the amount as a two-decimal string, like "15.50", instead of a JavaScript number.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: 000fb834-657f-477d-909f-dd66caad822d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Arsh-S]

Good catch! Two things: skip the confirm if the order is already CONFIRMED, otherwise the stats cache double counts. And sellers can't see the mismatch anywhere yet, add paidAmount / paymentMismatchAt to BasicOrderSchema and show it on the seller order page. @eicyer