Security

tests/market.test.ts

@@ -255,6 +255,37 @@ test('stale listings are removed and changed cards cannot be paid for', async t
   await f.orders(); assert.equal(f.market.browse().listings.length, 0);
 });
 
+test('direct canonical delivery outside the marketplace cannot also produce a refund', async t => {
+  const f = await fixture(t), l = await f.list(), o = await f.buy(l);
+  await f.run(bob, { type: 'mock-pay', orderId: o.id });
+  const tx = f.delivery(o);
+  f.confirm(tx); // No marketplace deliver command or saved transferId.
+  const settling = (await f.orders())[0];
+  assert.equal(settling.status, 'delivery-pending');
+  assert.equal(settling.transferId, transferId(tx));
+  await assert.rejects(f.run(bob, { type: 'refund', orderId: o.id }), /Refund requires/);
+  f.chain.state.blocks.push({ ...f.chain.state.blocks[0], height: 4, transactions: [] });
+  assert.equal((await f.orders())[0].status, 'complete');
+});
+
+test('direct pending delivery is not a conflict, while unpaid delivery never triggers payout', async t => {
+  const f = await fixture(t), l = await f.list(), o = await f.buy(l);
+  await f.run(bob, { type: 'mock-pay', orderId: o.id });
+  f.chain.state.pendingTransfers.push(f.delivery(o));
+  f.advance(48 * 3600_000);
+  assert.equal((await f.orders())[0].status, 'paid');
+  await assert.rejects(f.run(bob, { type: 'refund', orderId: o.id }), /Refund requires/);
+});
+
+test('canonical delivery without mock payment is held for review, not paid out', async t => {
+  const f = await fixture(t), l = await f.list(), o = await f.buy(l);
+  f.confirm(f.delivery(o));
+  f.chain.state.blocks.push({ ...f.chain.state.blocks[0], height: 4, transactions: [] });
+  assert.equal((await f.orders())[0].status, 'review');
+  assert.equal((await f.orders())[0].payout, 'review');
+  assert.equal((await f.orders())[0].additionalFee?.payout, 'review');
+});
+
 test('old open listings require fresh seller fee authorization and cannot be bought', async t => {
   const f = await fixture(t), l = await f.list();
   const db = new DatabaseSync(join(f.dir, 'testnet', 'market.sqlite'));