Middleware Backend — Refunds

Folder: src/routes/refunds/
Mount: api/v1/bookdirect/refunds
Status: to implement.

Middleware Backend · winner

POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/refunds

GET https://middleware-dev.bookdirect.live/api/v1/bookdirect/refunds/{refund_uuid}

Frontend: Manage booking.

Request

{
  "booking_uuid": "{booking_uuid}",
  "reason": "guest_cancelled",
  "amount_kobo": null
}

amount_kobo null = full refund of the paid payment entity.

Middleware Backend must

1. JWT user is the booking owned_by or owns the parent property (or has a Core Backend role on it).
2. Load paid payment from Core Backend (parent_entity_type=booking).
3. Call PSP refund (Paystack refund, etc.).
4. Update Core Backend payment status to refunded / partially_refunded.
5. PUT booking status: cancelled when the policy says the stay is void.
6. Optional: POST emails booking_cancelled_guest / booking_cancelled_owner.

IDOR

A guest must not refund someone else’s booking by guessing booking_uuid. An owner must not refund a booking on a property they do not own. Enforce on Middleware Backend and assume Core Backend GET-by-uuid may be under-scoped — check ownership yourself.