[Bug]: Medusa v2.13.3 Admin Dashboard Activity "Cancel" for storefront return request calls /admin/returns/:id/cancel and fails with linked return fulfillments

Package.json file

{
  "name": "backend",
  "version": "0.0.1",
  "description": "A starter for Medusa B2B projects.",
  "author": "Medusa (https://medusajs.com)",
  "license": "MIT",
  "keywords": [
    "sqlite",
    "postgres",
    "typescript",
    "ecommerce",
    "headless",
    "medusa"
  ],
  "scripts": {
    "build": "medusa build",
    "seed": "medusa exec ./src/scripts/seed.ts",
    "start": "medusa start",
    "dev": "medusa develop",
    "test:integration:http": "TEST_TYPE=integration:http NODE_OPTIONS=--experimental-vm-modules jest --silent=false --runInBand --forceExit",
    "test:integration:http:handles": "TEST_TYPE=integration:http NODE_OPTIONS=--experimental-vm-modules jest --silent=false --runInBand --detectOpenHandles --openHandlesTimeout=5000",
    "test:integration:modules": "TEST_TYPE=integration:modules NODE_OPTIONS=--experimental-vm-modules jest --silent --runInBand --forceExit",
    "test:unit": "TEST_TYPE=unit NODE_OPTIONS=--experimental-vm-modules jest --silent --runInBand --forceExit"
  },
  "dependencies": {
    "@hookform/resolvers": "3.9.1",
    "@medusajs/admin-sdk": "2.13.3",
    "@medusajs/cli": "2.13.3",
    "@medusajs/core-flows": "^2.13.3",
    "@medusajs/framework": "2.13.3",
    "@medusajs/icons": "^2.13.3",
    "@medusajs/js-sdk": "2.13.3",
    "@medusajs/medusa": "2.13.3",
    "@medusajs/modules-sdk": "^2.13.3",
    "@medusajs/types": "^2.13.3",
    "@medusajs/ui": "4.1.3",
    "@medusajs/utils": "^2.13.3",
    "@medusajs/workflows-sdk": "^2.13.3",
    "@radix-ui/react-label": "^2.1.8",
    "@radix-ui/react-popover": "^1.1.15",
    "@radix-ui/react-radio-group": "^1.3.8",
    "@radix-ui/react-slot": "^1.2.4",
    "@tanstack/react-query": "5.64.2",
    "@tanstack/react-table": "8.20.5",
    "@uiw/react-json-view": "^2.0.0-alpha.17",
    "cmdk": "^0.2.0",
    "date-fns": "^3.6.0",
    "i18next": "23.7.11",
    "ioredis": "^5.9.2",
    "jsonwebtoken": "^9.0.3",
    "lodash": "^4.17.23",
    "pg": "^8.13.0",
    "react-hook-form": "7.53.0",
    "react-i18next": "13.5.0",
    "react-router-dom": "6.30.3",
    "scrypt-kdf": "^4.0.0",
    "zod": "3.25.76"
  },
  "resolutions": {
    "zod": "3.25.76"
  },
  "devDependencies": {
    "@medusajs/test-utils": "2.13.3",
    "@medusajs/ui-preset": "2.13.3",
    "@swc/core": "^1.5.7",
    "@swc/jest": "^0.2.36",
    "@types/jest": "^29.5.14",
    "@types/jsonwebtoken": "^9",
    "@types/lodash": "^4",
    "@types/node": "^20.0.0",
    "@types/react": "^18.3.2",
    "@types/react-dom": "^18.2.25",
    "jest": "^29.7.0",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.5.3",
    "vite": "^5.2.11"
  },
  "engines": {
    "node": ">=20"
  },
  "packageManager": "pnpm@10.28.1",
  "pnpm": {
    "overrides": {
      "@isaacs/brace-expansion": "5.0.1",
      "axios": "1.13.5",
      "esbuild": "0.25.11",
      "fast-xml-parser": "5.3.4",
      "qs": "6.14.2"
    },
    "onlyBuiltDependencies": [
      "@medusajs/telemetry",
      "@swc/core",
      "esbuild",
      "msgpackr-extract",
      "protobufjs"
    ]
  }
}

Node.js version

v20.20.0

Database and its version

PostgreSQL 17.9

Operating system name and version

Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-171-generic x86_64)

Browser name

Chrome

What happended?

When a customer creates a return from the storefront using the official store return flow, the Medusa Admin order page shows the return request in the Activity section. However, clicking Cancel in the Activity section sends POST /admin/returns/:id/cancel instead of canceling the return request.

If the storefront-created return has linked return fulfillments, this fails with: All fulfillments must be canceled before canceling a return This makes it impossible to cancel a customer return request from the default Admin Activity UI.

I traced this to an inconsistency in the dashboard package:

• The active return panel uses the request-cancel path.
• The order activity timeline uses the return-cancel path. From local package source in v2.13.3, the behavior appears to come from the dashboard implementation equivalent to:

packages/admin/dashboard/src/routes/orders/order-detail/components/active-order-return-section/active-order-return-section.tsx uses useCancelReturnRequest(...)

packages/admin/dashboard/src/routes/orders/order-detail/components/order-activity-section/order-timeline.tsx uses useCancelReturn(...)

So the same requested return is handled through two different cancel APIs depending on which UI entry the user clicks.

Expected behavior

Canceling a customer-created return request from the Admin Activity section should behave like canceling a requested return request, not like canceling a fully progressed return.

Expected outcomes:

• The Activity section Cancel action should call DELETE /admin/returns/:id/request, or
• The cancel flow should otherwise handle linked return fulfillments automatically before canceling the return.

In either case, a merchant should be able to cancel a storefront-created return request from the default Admin UI without manually canceling hidden linked return fulfillments first.

Actual behavior

The Admin Activity section Cancel action sends:

POST /admin/returns/:id/cancel

And the response is:

400 Bad Request All fulfillments must be canceled before canceling a return

I also verified that storefront-created returns are created through the official store return flow, and linked return fulfillments exist for those returns. So the Activity cancel action cannot complete successfully for this scenario.

Link to reproduction repo

https://github.com/medusajs/medusa