Implement full Square payment review fixes + frontend polish
Implement every finding from the deep payment review (P0-P2, minors, nitpicks), then close the post-implementation re-review items, then align card-form typography and roll out the Square trust badge. Backend - Square API alignment: - tip_settings.allow_tipping nested under device_options (was top-level: terminal tips were silently lost in prod) - CreateCardOnFile now accepts customerID and sends card.customer_id; saved-card (ccof:) charges forward square_customer_id as CustomerID - New SquareClient methods GetPayment, CreateCustomer, CancelCheckout - SCA verification_token accepted + forwarded in all charge paths - ExpMonth/ExpYear -> *int; URL-path id validation; CancelCheckout NOT_FOUND-only no-op (dropped unverified NOOP); exported ErrorCode/ ErrorDetail helpers; mock rejects raw PANs, RList locks, redacts emails, ForceRefundPending hook Backend - money safety: - sweepManualPendingSquareRefunds reconciles rows WITH square_refund_id instead of stranding them forever - SweepStalePendingPayments reconciles at Square before failing (tri-state: leave pending on transport error, rescue completed, fail definitively) - GetCheckoutStatus cancellation-recheck; terminal CANCELED resolution; SweepStaleTerminalCheckouts covers terminal_checkouts table - till gift-card clawback on definitive failure incl. retry path + INSUFFICIENT_FUNDS/ADDRESS_VERIFICATION_FAILURE/TRANSACTION_LIMIT - cross-user saved-card collision fixed (UNIQUE(user_id,square_card_id)) - customer provisioning (lazy, save-only); one-off/guest mint no customer - discount preview/apply unified in discounts.go (global-milestone visible in preview, N+1 eliminated, redemption counter preserved on failures) - webhook event_id dedup; refund loop dedup; stale comment fixes - test-isolation t.Cleanup on committed sweep tests Frontend: - SCA tokenizeWithVerification across all charge flows (amount as major-units decimal), 5-min token-expiry re-tokenize, verification_token in request bodies - PaymentModal synchronous double-click + zero/negative-amount guards - till online-card UI wired to /api/admin/till/sale - policyPopover generalised; new /privacy-policy route; consent checkbox copy + Square privacy link - Square card iframe styled to app typography (Inter 14px, oklch tokens); mock form md:text-sm parity - 'Secure payment powered by Square' badge on all 8 card-payment flows Schema/docs: terminal_checkouts + square_customer_id + per-user card constraint in init-script.sql; README migrations; P14 plan + backlog + Technical Manual updated. Includes 39 modified/new test files; full backend suite (25 pkgs), -race on payments+square, and frontend build are green.
This commit is contained in:
@@ -9,6 +9,7 @@ import (
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"sync"
|
||||
)
|
||||
|
||||
type SquareWebhookEvent struct {
|
||||
@@ -19,6 +20,48 @@ type SquareWebhookEvent struct {
|
||||
LocationID string `json:"location_id"`
|
||||
}
|
||||
|
||||
// squareWebhookDedup is a bounded, mutex-guarded set of recently handled
|
||||
// event IDs. Square redelivers signed webhooks on retries (or a replay); once
|
||||
// the handlers mutate state a duplicate delivery would double-apply, so drop
|
||||
// replays while keeping the set bounded.
|
||||
type squareWebhookDedup struct {
|
||||
mu sync.Mutex
|
||||
seen map[string]struct{}
|
||||
order []string
|
||||
max int
|
||||
}
|
||||
|
||||
func newSquareWebhookDedup(max int) *squareWebhookDedup {
|
||||
return &squareWebhookDedup{
|
||||
seen: make(map[string]struct{}),
|
||||
order: make([]string, 0, max),
|
||||
max: max,
|
||||
}
|
||||
}
|
||||
|
||||
// register reports whether id was already handled: false on first occurrence
|
||||
// (recording id, evicting the oldest once the cap is reached), true on a
|
||||
// replay (set untouched, preserving insertion order). Mutex-guarded — the
|
||||
// handler may be hit concurrently.
|
||||
func (d *squareWebhookDedup) register(id string) bool {
|
||||
d.mu.Lock()
|
||||
defer d.mu.Unlock()
|
||||
if _, ok := d.seen[id]; ok {
|
||||
return true
|
||||
}
|
||||
d.seen[id] = struct{}{}
|
||||
d.order = append(d.order, id)
|
||||
if len(d.order) > d.max {
|
||||
oldest := d.order[0]
|
||||
d.order = d.order[1:]
|
||||
delete(d.seen, oldest)
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// 1000 IDs far exceeds Square's redelivery window while capping memory.
|
||||
var squareWebhookEventsSeen = newSquareWebhookDedup(1000)
|
||||
|
||||
func HandleSquareWebhook(w http.ResponseWriter, r *http.Request) {
|
||||
r.Body = http.MaxBytesReader(w, r.Body, 512*1024)
|
||||
body, err := io.ReadAll(r.Body)
|
||||
@@ -67,6 +110,16 @@ func HandleSquareWebhook(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
// Dedup BEFORE dispatch: a correctly signed replay of a handled event
|
||||
// must not re-enter the handlers (which will mutate state once wired).
|
||||
// Returns 200 to acknowledge delivery without processing.
|
||||
if event.EventID != "" && squareWebhookEventsSeen.register(event.EventID) {
|
||||
log.Printf("[SQUARE-WEBHOOK] Duplicate event_id %s; skipping (already processed)", event.EventID)
|
||||
w.WriteHeader(http.StatusOK)
|
||||
_, _ = w.Write([]byte("ok"))
|
||||
return
|
||||
}
|
||||
|
||||
log.Printf("[SQUARE-WEBHOOK] Received event: %s", event.Type)
|
||||
|
||||
switch event.Type {
|
||||
|
||||
@@ -9,6 +9,7 @@ import (
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
@@ -262,3 +263,83 @@ func TestHandleSquareWebhook_RejectedWhenKeyEmpty(t *testing.T) {
|
||||
t.Errorf("expected 503 when no key configured (fail-closed), got %d. body: %s", w.Code, w.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// Dedup — event_id replay protection
|
||||
// =============================================================================
|
||||
|
||||
func TestHandleSquareWebhook_DuplicateEventID(t *testing.T) {
|
||||
event := SquareWebhookEvent{
|
||||
Type: "payment.updated",
|
||||
EventID: "evt_http_dup_1",
|
||||
CreatedAt: "2025-01-01T00:00:00Z",
|
||||
Data: json.RawMessage(`{"id":"payment_dup_1"}`),
|
||||
}
|
||||
body, _ := json.Marshal(event)
|
||||
sig := webhookTestEnv(t, body)
|
||||
|
||||
// First delivery processes the event.
|
||||
w := makeWebhookRequest(body, sig, context.Background())
|
||||
if w.Code != http.StatusOK {
|
||||
t.Fatalf("expected first delivery 200, got %d. body: %s", w.Code, w.Body.String())
|
||||
}
|
||||
|
||||
// Replay of the same signed event returns 200 but skips dispatch.
|
||||
w2 := makeWebhookRequest(body, sig, context.Background())
|
||||
if w2.Code != http.StatusOK {
|
||||
t.Fatalf("expected replay 200, got %d. body: %s", w2.Code, w2.Body.String())
|
||||
}
|
||||
if w2.Body.String() != "ok" {
|
||||
t.Errorf("expected replay body 'ok', got %q", w2.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestHandleSquareWebhook_DistinctEventIDs(t *testing.T) {
|
||||
for _, id := range []string{"evt_distinct_1", "evt_distinct_2"} {
|
||||
event := SquareWebhookEvent{
|
||||
Type: "payment.updated",
|
||||
EventID: id,
|
||||
CreatedAt: "2025-01-01T00:00:00Z",
|
||||
Data: json.RawMessage(`{"id":"p"}`),
|
||||
}
|
||||
body, _ := json.Marshal(event)
|
||||
sig := webhookTestEnv(t, body)
|
||||
w := makeWebhookRequest(body, sig, context.Background())
|
||||
if w.Code != http.StatusOK {
|
||||
t.Fatalf("expected 200 for %s, got %d. body: %s", id, w.Code, w.Body.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSquareWebhookDedup_FirstThenDuplicate(t *testing.T) {
|
||||
d := newSquareWebhookDedup(1000)
|
||||
if d.register("evt_dedup_1") {
|
||||
t.Error("expected first occurrence to register as new")
|
||||
}
|
||||
if !d.register("evt_dedup_1") {
|
||||
t.Error("expected second occurrence to register as duplicate")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSquareWebhookDedup_CapEvictsOldest(t *testing.T) {
|
||||
d := newSquareWebhookDedup(3)
|
||||
for i := 0; i < 3; i++ {
|
||||
if d.register(fmt.Sprintf("evt_cap_%d", i)) {
|
||||
t.Errorf("expected evt_cap_%d to register as new", i)
|
||||
}
|
||||
}
|
||||
// The 4th distinct ID pushes out the oldest (evt_cap_0).
|
||||
if d.register("evt_cap_3") {
|
||||
t.Errorf("expected evt_cap_3 to register as new")
|
||||
}
|
||||
// Survivors still dedupe (register returns true without mutating the set).
|
||||
for _, id := range []string{"evt_cap_1", "evt_cap_2", "evt_cap_3"} {
|
||||
if !d.register(id) {
|
||||
t.Errorf("expected %s to still be a duplicate", id)
|
||||
}
|
||||
}
|
||||
// The evicted ID is treated as new again.
|
||||
if d.register("evt_cap_0") {
|
||||
t.Errorf("expected evt_cap_0 to be evicted and treated as new")
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user