revise ads and alerts

controllers/client/course_purchases.controller.js

@@ -104,6 +104,19 @@ exports.captureCourseOrder = async (req, res) => {
 
     const capture = captureData.purchase_units?.[0]?.payments?.captures?.[0];
 
+    // PayPal can return an HTTP 2xx from the capture endpoint even when the
+    // charge itself was declined or held for review (e.g. capture.status
+    // "DECLINED"/"PENDING") — axios only throws on non-2xx, so the actual
+    // status field must be checked explicitly before granting any access.
+    const captureStatus = capture?.status ?? captureData.status;
+    if (captureStatus !== 'COMPLETED') {
+      await purchase.update({
+        status:           'failed',
+        provider_payload: { ...purchase.provider_payload, capture: captureData, failed_reason: captureStatus ?? 'unknown' },
+      });
+      return R.error(res, `Payment was not completed by PayPal (status: ${captureStatus ?? 'unknown'}).`, 402);
+    }
+
     await purchase.update({
       status:           'completed',
       paid_at:          new Date(),