Refund initiated within configured timeframe of cancellation

Without a defined refund window, refunds can theoretically be issued for orders cancelled two years ago — a refund policy violation that a simple date comparison prevents. Beyond fraud prevention, the absence of a configured timeframe means your refund policy (stated in terms and conditions) and your code are inconsistent: the policy says '30 days', the system enforces no limit. CWE-285 applies when a time-based access control exists in policy but not in code. The fix is a single numeric constant — REFUND_WINDOW_DAYS in lib/orders/config.ts — that makes the policy machine-enforceable and auditable.

Define the refund window as a named constant in lib/orders/config.ts and enforce it with a date comparison at the start of the refund handler at app/api/orders/[id]/refund/route.ts.

// lib/orders/config.ts
export const REFUND_WINDOW_DAYS = 30

// app/api/orders/[id]/refund/route.ts
import { REFUND_WINDOW_DAYS } from '@/lib/orders/config'

const daysSinceCancellation = Math.floor(
  (Date.now() - order.cancelledAt!.getTime()) / (1000 * 60 * 60 * 24)
)
if (daysSinceCancellation > REFUND_WINDOW_DAYS) {
  return Response.json(
    { error: `Refund window of ${REFUND_WINDOW_DAYS} days has passed.` },
    { status: 409 }
  )
}