From 5d4748043fc42aa010d462269c2767b25e5226b2 Mon Sep 17 00:00:00 2001
From: androidlover5842 <androidlover5842@gmail.com>
Date: Sun, 1 Feb 2026 16:56:07 +0530
Subject: [PATCH] Validate Razorpay refund amount against payment

---
 .../trisolarisserver/controller/RazorpayRefundsController.kt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/main/kotlin/com/android/trisolarisserver/controller/RazorpayRefundsController.kt b/src/main/kotlin/com/android/trisolarisserver/controller/RazorpayRefundsController.kt
index e84eb2f..5d55acf 100644
--- a/src/main/kotlin/com/android/trisolarisserver/controller/RazorpayRefundsController.kt
+++ b/src/main/kotlin/com/android/trisolarisserver/controller/RazorpayRefundsController.kt
@@ -67,6 +67,11 @@ class RazorpayRefundsController(
             if (payment.booking.id != bookingId || payment.property.id != propertyId) {
                 throw ResponseStatusException(HttpStatus.NOT_FOUND, "Payment not found for booking")
             }
+            request.amount?.let {
+                if (it > payment.amount) {
+                    throw ResponseStatusException(HttpStatus.BAD_REQUEST, "amount must be <= payment amount")
+                }
+            }
             payment.gatewayPaymentId
                 ?: throw ResponseStatusException(HttpStatus.BAD_REQUEST, "Payment is missing gateway id")
         }