From 6fde846be277ba754e74e4834ba68cb618bc07fd Mon Sep 17 00:00:00 2001
From: 9qeklajc <tthefux@gmail.com>
Date: Wed, 1 Apr 2026 15:04:38 +0200
Subject: [PATCH] refund x cashu

---
 routstr/balance.py         | 62 +++++++++++++++++++++++++-------------
 tests/unit/test_balance.py |  6 ++++
 2 files changed, 47 insertions(+), 21 deletions(-)

diff --git a/routstr/balance.py b/routstr/balance.py
index 6eed34aa..d8ec98f5 100644
--- a/routstr/balance.py
+++ b/routstr/balance.py
@@ -207,35 +207,55 @@ async def _refund_cache_set(authorization: str, value: dict[str, str]) -> None:
 
 @router.post("/refund")
 async def refund_wallet_endpoint(
-    authorization: Annotated[str, Header(...)],
+    authorization: Annotated[str | None, Header()] = None,
     x_cashu: Annotated[str | None, Header()] = None,
     session: AsyncSession = Depends(get_session),
-) -> dict[str, str]:
-    if not authorization.startswith("Bearer "):
+) -> JSONResponse | dict[str, str]:
+    if x_cashu:
+        # Find the "in" transaction by the original payment token
+        in_tx_result = await session.exec(
+            select(CashuTransaction).where(
+                CashuTransaction.token == x_cashu,
+                CashuTransaction.type == "in",
+            )
+        )
+        in_tx = in_tx_result.first()
+        if in_tx is None:
+            raise HTTPException(status_code=404, detail="Refund not found")
+
+        # Use the request_id to find the associated "out" (refund) transaction
+        if in_tx.request_id is None:
+            raise HTTPException(status_code=404, detail="Refund not found")
+
+        out_tx_result = await session.exec(
+            select(CashuTransaction).where(
+                CashuTransaction.request_id == in_tx.request_id,
+                CashuTransaction.type == "out",
+            )
+        )
+        out_tx = out_tx_result.first()
+        if out_tx is None:
+            raise HTTPException(status_code=404, detail="Refund not found")
+        if out_tx.swept:
+            raise HTTPException(status_code=410, detail="Refund has been swept")
+
+        out_tx.collected = True
+        session.add(out_tx)
+        await session.commit()
+        body: dict[str, str] = {"token": out_tx.token}
+        if out_tx.unit == "sat":
+            body["sats"] = str(out_tx.amount)
+        else:
+            body["msats"] = str(out_tx.amount)
+        return JSONResponse(content=body, headers={"X-Cashu": out_tx.token})
+
+    if authorization is None or not authorization.startswith("Bearer "):
         raise HTTPException(
             status_code=401,
             detail="Invalid authorization. Use 'Bearer <cashu-token>' or 'Bearer <api-key>'",
         )
 
     bearer_value: str = authorization[7:]
-
-    if x_cashu:
-        payment_token_hash = hashlib.sha256(x_cashu.strip().encode()).hexdigest()
-        result = await session.get(CashuTransaction, payment_token_hash)
-        if result is None:
-            raise HTTPException(status_code=404, detail="Refund not found")
-        if result.swept:
-            raise HTTPException(status_code=410, detail="Refund has been swept")
-        result.collected = True
-        session.add(result)
-        await session.commit()
-        body: dict[str, str] = {"token": result.token}
-        if result.unit == "sat":
-            body["sats"] = str(result.amount)
-        else:
-            body["msats"] = str(result.amount)
-        return JSONResponse(content=body, headers={"X-Cashu": result.token})
-
     key: ApiKey = await validate_bearer_key(bearer_value, session)
 
     if key.total_balance <= 0:
diff --git a/tests/unit/test_balance.py b/tests/unit/test_balance.py
index fdb4d0fc..f36ef158 100644
--- a/tests/unit/test_balance.py
+++ b/tests/unit/test_balance.py
@@ -33,6 +33,9 @@ async def test_refund_x_cashu_returns_token() -> None:
 
     session.get.assert_awaited_once_with(CashuTransaction, expected_hash)
     import json
+
+    from fastapi.responses import JSONResponse
+    assert isinstance(result, JSONResponse)
     body = json.loads(result.body)
     assert body["token"] == "cashuArefund_token"
     assert body["msats"] == "1000"
@@ -57,6 +60,9 @@ async def test_refund_x_cashu_sat_unit() -> None:
     )
 
     import json
+
+    from fastapi.responses import JSONResponse
+    assert isinstance(result, JSONResponse)
     body = json.loads(result.body)
     assert body["token"] == "cashuArefund_sat"
     assert body["sats"] == "500"