From 321f842a0eecf0280f110f266a8f55da8e01a77e Mon Sep 17 00:00:00 2001
From: vku2018 <299349635+vku2018@users.noreply.github.com>
Date: Fri, 3 Jul 2026 08:07:17 +0530
Subject: [PATCH] Normalize `authorized` boolean to 1/0 in orders.all()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`orders.all()` accepts `authorized` typed as `boolean | 1 | 0`, and the
Razorpay Orders API expects `1`/`0`. The method had a no-op self-assignment
`authorized = authorized` where the `normalizeBoolean` conversion was
clearly intended — as a result `normalizeBoolean` was exported but never
called anywhere in the library, and passing `authorized: true` sent the raw
boolean to the API instead of `1`.

The existing test only exercised `authorized: 1` (already binary), so its
own assertion message ("authorized to binary") passed by accident and the
bug went undetected.

Fix: use `authorized = normalizeBoolean(authorized)` (imported into
orders.js). `normalizeBoolean(undefined)` returns `undefined`, so callers
omitting the flag are unaffected; `1`/`0` pass through unchanged — backward
compatible.

Added tests exercising `authorized: true` -> 1 and `authorized: false` -> 0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 lib/resources/orders.js       |  4 ++--
 test/resources/orders.spec.js | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/lib/resources/orders.js b/lib/resources/orders.js
index 49114642..c8c949a9 100644
--- a/lib/resources/orders.js
+++ b/lib/resources/orders.js
@@ -1,6 +1,6 @@
 'use strict'
 
-const { normalizeDate } = require('../utils/razorpay-utils')
+const { normalizeDate, normalizeBoolean } = require('../utils/razorpay-utils')
 
 module.exports = function (api) {
   return {
@@ -22,7 +22,7 @@ module.exports = function (api) {
 
       count = Number(count) || 10
       skip = Number(skip) || 0
-      authorized = authorized
+      authorized = normalizeBoolean(authorized)
 
       return api.get({
         url: '/orders',
diff --git a/test/resources/orders.spec.js b/test/resources/orders.spec.js
index fb85fa12..f0b1ced8 100644
--- a/test/resources/orders.spec.js
+++ b/test/resources/orders.spec.js
@@ -67,6 +67,40 @@ describe('ORDERS', () => {
         done()
       })
     })
+
+    it('`authorized` boolean is normalized to 1/0', (done) => {
+      mocker.mock({
+        url: '/orders'
+      })
+
+      rzpInstance.orders.all({
+        authorized: true
+      }).then((response) => {
+        assert.strictEqual(
+          response.__JUST_FOR_TESTS__.requestQueryParams.authorized,
+          '1',
+          '`authorized: true` is sent to the API as 1'
+        )
+        done()
+      }).catch(done)
+    })
+
+    it('`authorized: false` is normalized to 0', (done) => {
+      mocker.mock({
+        url: '/orders'
+      })
+
+      rzpInstance.orders.all({
+        authorized: false
+      }).then((response) => {
+        assert.strictEqual(
+          response.__JUST_FOR_TESTS__.requestQueryParams.authorized,
+          '0',
+          '`authorized: false` is sent to the API as 0'
+        )
+        done()
+      }).catch(done)
+    })
   })
 
   describe('Order fetch', () => {