README

Magento 2 EU Return Compliance

KodeXpo_ReturnCompliance provides a secure return / withdrawal flow for Magento 2 stores with guest, customer, and admin review handling.

Built by KodeXpo.

Need custom Magento development, checkout and account flow work, or help debugging Adobe Commerce backend behavior? Contact: dev@kodexpo.com

Why This Module Exists

EU withdrawal / return flows need more than a simple contact form.

This module is built to handle:

• customer account requests
• guest requests that require ownership verification
• secure confirmation links with tokenized URLs
• configurable timing rules for the withdrawal window
• configurable resend throttling and confirmation attempt limits
• manual admin review before a request is approved or rejected
• email copy and sender identity that can be configured per store

It is intended for stores that want a clear, auditable withdrawal workflow without exposing order data or allowing uncontrolled guest abuse.

Features

• customer account withdrawal request flow
• guest withdrawal request flow with secure verification link
• configurable guest verification:
  • secure token URL
  • code TTL
  • resend delay
  • max attempts
  • optional reCAPTCHA integration
• admin review workflow:
  • pending requests grid
  • request detail view
  • approve / reject decision handling
  • review note support
  • order history comment on review
• configurable business rules:
  • withdrawal window
  • anchor order priority
  • anchor offsets for AWB, shipment, invoice, and order
• configurable email settings:
  • confirmation template
  • guest code template
  • from identity
• translated storefront and admin copy
• Magento 2.4.6 to 2.4.9 compatibility target

Request Flow

Customer Account Flow

1. Customer opens an order in My Account.
2. The module shows the withdrawal CTA when the order is still eligible.
3. The request is saved with an initial pending state.
4. The customer sees a confirmation page with the request status and order reference.
5. Admin reviews the request and approves or rejects it later.

Guest Flow

1. Guest enters order number and email address.
2. The module verifies order ownership before exposing any request state.
3. If allowed, the module sends a secure verification link.
4. The guest opens the tokenized confirmation page from the email.
5. The guest confirms the request and receives a submission response.
6. The request enters the same admin review queue as customer requests.

Admin Flow

1. Admin opens the return compliance request view.
2. The request detail page shows order, customer email, status, review metadata, and review note.
3. Admin chooses the decision in the dropdown and saves the record.
4. The module updates the request status, records the review data, and appends an order comment.

Security And Abuse Protection

The module is designed with abuse resistance in mind:

• guest links use opaque tokens instead of exposing email or verification code in the URL
• guest resend requests are throttled
• confirmation attempts are capped
• guest verification data is retained only for a configurable period
• forms are protected with Magento form keys where applicable
• optional guest reCAPTCHA support is available
• request state is handled in the module rather than exposing order data directly

Access Points

Frontend

Guest flow:

returncompliance/guest/index
returncompliance/guest/lookup
returncompliance/guest/code
returncompliance/guest/success

Customer flow:

returncompliance/customer/submit
returncompliance/customer/success

Admin

Request management:

kodexpo_returncompliance/request/index
kodexpo_returncompliance/request/view
kodexpo_returncompliance/request/save

Installation

Composer

If this module is published to your Composer repository, install it with your package name, then run:

bin/magento module:enable KodeXpo_ReturnCompliance
bin/magento setup:upgrade
bin/magento cache:clean

If needed:

bin/magento setup:di:compile
bin/magento setup:static-content:deploy en_US -f

Manual

Copy the module to:

app/code/KodeXpo/ReturnCompliance

Then run:

bin/magento module:enable KodeXpo_ReturnCompliance
bin/magento setup:upgrade
bin/magento cache:clean

Configuration

The module can be configured from:

Stores > Configuration > KodeXpo > EU Return Compliance

Typical settings include:

• module enablement
• withdrawal window and anchor offsets
• guest verification code TTL, resend delay, and max attempts
• guest verification retention cleanup
• email template selection and sender identity
• guest reCAPTCHA settings

The module also respects Magento's core reCAPTCHA settings when guest protection is enabled.

Compatibility

Designed for Magento Open Source / Adobe Commerce 2.4.6 through 2.4.9. The module package currently allows PHP 8.1 through 8.5.

Package requirements currently allow:

• PHP 8.1
• PHP 8.2
• PHP 8.3
• PHP 8.4
• PHP 8.5

Limitations

• The module does not auto-fix orders or shipments.
• Request eligibility still depends on order state and store configuration.
• Admin review remains manual by design.
• Index and cron health can affect eligibility timing and cleanup behavior.

Included Translations

• bg_BG
• cs_CZ
• da_DK
• de_DE
• el_GR
• en_US
• es_ES
• et_EE
• fi_FI
• fr_FR
• hr_HR
• hu_HU
• it_IT
• lt_LT
• lv_LV
• nb_NO
• nl_NL
• pl_PL
• pt_PT
• ro_RO
• sk_SK
• sl_SI
• sv_SE

License

Apache License 2.0. See LICENSE and LICENSE.txt.

Changelog

See CHANGELOG.md for release notes and notable changes.