Match dev mock to production: reject raw PAN card creation (PCI-DSS parity)
Previously the dev MockClient was more permissive than production: - MockClient.CreateCardOnFileRaw processed raw PANs and stored mock cards, while ProdClient and devProdClient both block raw PANs. A dev testing the raw-card flow saw it succeed, masking a production failure. - MockClient.CreateCardOnFile accepted raw PANs as source_id via an isAllDigits branch. Real Square only accepts cnon:xxx/ccof:xxx tokens. Now the mock behaves identically to production: - CreateCardOnFileRaw returns the same PCI error as ProdClient - CreateCardOnFile validates source_id is token-like (cnon:/ccof:) and rejects raw PANs - Removed dead isAllDigits helper Tests updated to assert the parity behavior: - TestDevClient_CreateCardOnFileRaw_Rejected_ProdParity (table-driven, replaces 5 brand-specific raw-PAN tests) - TestDevClient_CreateCardOnFile_RejectsRawPAN (replaces RawNumber) - TestCreatePaymentMethod_HappyPath / SecondCardNotDefault now expect 500 instead of 200, documenting the prod block
This commit is contained in:
@@ -237,79 +237,32 @@ func TestDevClient_GetCheckout_NotFound(t *testing.T) {
|
||||
require.Error(t, err)
|
||||
}
|
||||
|
||||
func TestDevClient_CreateCardOnFileRaw_Visa(t *testing.T) {
|
||||
client := NewDevClient().(*MockClient)
|
||||
card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-1", "4111111111111111", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "VISA", card.Brand)
|
||||
assert.Equal(t, "1111", card.Last4)
|
||||
assert.True(t, card.IsDefault)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.Equal(t, 12, card.ExpMonth)
|
||||
assert.Equal(t, 2030, card.ExpYear)
|
||||
assert.NotEmpty(t, card.CreatedAt)
|
||||
assert.Greater(t, card.Version, int64(0))
|
||||
}
|
||||
|
||||
func TestDevClient_CreateCardOnFileRaw_Mastercard(t *testing.T) {
|
||||
func TestDevClient_CreateCardOnFileRaw_Rejected_ProdParity(t *testing.T) {
|
||||
// PCI-DSS parity: the mock must reject raw PANs exactly like the
|
||||
// ProdClient, so dev testing cannot mask a production failure.
|
||||
client := NewDevClient().(*MockClient)
|
||||
ctx := context.Background()
|
||||
// First card to set up non-default check
|
||||
_, err := client.CreateCardOnFileRaw(ctx, "user-raw-2", "4111111111111111", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
// Mastercard is second → not default
|
||||
card, err := client.CreateCardOnFileRaw(ctx, "user-raw-2", "5555555555554444", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "MASTERCARD", card.Brand)
|
||||
assert.Equal(t, "4444", card.Last4)
|
||||
assert.False(t, card.IsDefault)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.Equal(t, 12, card.ExpMonth)
|
||||
assert.Equal(t, 2030, card.ExpYear)
|
||||
assert.NotEmpty(t, card.CreatedAt)
|
||||
assert.Greater(t, card.Version, int64(0))
|
||||
}
|
||||
|
||||
func TestDevClient_CreateCardOnFileRaw_Amex(t *testing.T) {
|
||||
client := NewDevClient().(*MockClient)
|
||||
card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-3", "378282246310005", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "AMERICAN_EXPRESS", card.Brand)
|
||||
assert.Equal(t, "0005", card.Last4)
|
||||
assert.True(t, card.IsDefault)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.Equal(t, 12, card.ExpMonth)
|
||||
assert.Equal(t, 2030, card.ExpYear)
|
||||
assert.NotEmpty(t, card.CreatedAt)
|
||||
assert.Greater(t, card.Version, int64(0))
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
cardNumber string
|
||||
}{
|
||||
{"visa", "4111111111111111"},
|
||||
{"mastercard", "5555555555554444"},
|
||||
{"amex", "378282246310005"},
|
||||
{"discover", "6011111111111117"},
|
||||
{"unknown brand", "9999999999999999"},
|
||||
{"too short", "123"},
|
||||
}
|
||||
|
||||
func TestDevClient_CreateCardOnFileRaw_Discover(t *testing.T) {
|
||||
client := NewDevClient().(*MockClient)
|
||||
card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-4", "6011111111111117", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "DISCOVER", card.Brand)
|
||||
assert.Equal(t, "1117", card.Last4)
|
||||
assert.True(t, card.IsDefault)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.Equal(t, 12, card.ExpMonth)
|
||||
assert.Equal(t, 2030, card.ExpYear)
|
||||
assert.NotEmpty(t, card.CreatedAt)
|
||||
assert.Greater(t, card.Version, int64(0))
|
||||
}
|
||||
|
||||
func TestDevClient_CreateCardOnFileRaw_UnknownBrand(t *testing.T) {
|
||||
client := NewDevClient().(*MockClient)
|
||||
card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-5", "9999999999999999", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "UNKNOWN", card.Brand)
|
||||
assert.Equal(t, "9999", card.Last4)
|
||||
assert.True(t, card.IsDefault)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.Equal(t, 12, card.ExpMonth)
|
||||
assert.Equal(t, 2030, card.ExpYear)
|
||||
assert.NotEmpty(t, card.CreatedAt)
|
||||
assert.Greater(t, card.Version, int64(0))
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
card, err := client.CreateCardOnFileRaw(ctx, "user-raw-"+tt.name, tt.cardNumber, 12, 2030, "123")
|
||||
require.Error(t, err, "raw PAN must be rejected for production parity")
|
||||
assert.Nil(t, card)
|
||||
assert.Contains(t, err.Error(), "raw card number input is not supported")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreatePayment_ShouldFail(t *testing.T) {
|
||||
@@ -479,40 +432,31 @@ func TestDevClient_CreateCardOnFileRaw_WithBrandDetection(t *testing.T) {
|
||||
userID := "user-raw-brand-detect"
|
||||
|
||||
card, err := client.CreateCardOnFileRaw(ctx, userID, "4111111111111111", 12, 2030, "123")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "VISA", card.Brand)
|
||||
assert.Equal(t, "1111", card.Last4)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.Equal(t, 12, card.ExpMonth)
|
||||
assert.Equal(t, 2030, card.ExpYear)
|
||||
require.Error(t, err, "raw PAN must be rejected for production parity")
|
||||
assert.Nil(t, card)
|
||||
}
|
||||
|
||||
func TestDevClient_CreateCardOnFile_RawNumber(t *testing.T) {
|
||||
func TestDevClient_CreateCardOnFile_RejectsRawPAN(t *testing.T) {
|
||||
client := NewDevClient().(*MockClient)
|
||||
ctx := context.Background()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
cardNum string
|
||||
wantBrand string
|
||||
wantLast4 string
|
||||
name string
|
||||
cardNum string
|
||||
}{
|
||||
{"visa formatted", "4111 1111 1111 1111", "VISA", "1111"},
|
||||
{"visa raw", "4111111111111111", "VISA", "1111"},
|
||||
{"mastercard", "5500 0000 0000 0004", "MASTERCARD", "0004"},
|
||||
{"amex", "3400 0000 0000 009", "AMERICAN_EXPRESS", "0009"},
|
||||
{"discover", "6011 0000 0000 0004", "DISCOVER", "0004"},
|
||||
{"visa formatted", "4111 1111 1111 1111"},
|
||||
{"visa raw", "4111111111111111"},
|
||||
{"mastercard", "5500 0000 0000 0004"},
|
||||
{"amex", "3400 0000 0000 009"},
|
||||
{"discover", "6011 0000 0000 0004"},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
userID := fmt.Sprintf("user-raw-card-%s", tt.name)
|
||||
card, err := client.CreateCardOnFile(ctx, userID, tt.cardNum)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.wantBrand, card.Brand)
|
||||
assert.Equal(t, tt.wantLast4, card.Last4)
|
||||
assert.True(t, card.Enabled)
|
||||
assert.NotEmpty(t, card.CardholderName)
|
||||
require.Error(t, err, "raw PAN must be rejected for production parity")
|
||||
assert.Nil(t, card)
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -540,7 +484,7 @@ func TestDevClient_CreateCardOnFileRaw_TooShort(t *testing.T) {
|
||||
|
||||
_, err := client.CreateCardOnFileRaw(ctx, "user-too-short", "123", 12, 2030, "999")
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "too short")
|
||||
assert.Contains(t, err.Error(), "raw card number input is not supported")
|
||||
}
|
||||
|
||||
func TestDevClient_GetCardsOnFile_Empty(t *testing.T) {
|
||||
|
||||
Reference in New Issue
Block a user