- README: payments/2FA sections rewritten for the SCA-only posture (no
TWO_FACTOR_FALLBACK, tokenize-result wire contract, 402 refusal), deposit
carve-out clarified, gift-card 12-hex codes + 14-day cancellation, flood-cap
insert sites enumerated, escalating lockout tiers documented, ICO
registration note, updated test counts (2,555 backend + 129 frontend).
- local-dev-2.sh: fail-closed dev secret bootstrap (auto-generates
JWT_SECRET_KEY / TWO_FACTOR_PEPPER into the gitignored .env), kills stale
backends holding :8080 before the tmux reset, passes
RUSTFS_ENDPOINT/GO_TESTING=1 to the dev backend, and backdates seeded patch
tests 60 days so past gel bookings pass the 24h notice gate.
- Obsidian manuals (Technical/Admin/User/Feature Catalog/Overview/Gift Card
T&C/Privacy/T&C/Testing Architecture/payments and money processes + p14 plan
+ workspace state) updated to the post-round-2 state.
The round-7 port pre-flight ran BEFORE , so a
healthy postgres container from a previous run (which owns host port 5432) was
mistaken for a squatter and the script exited. Down the container first, then
check for any remaining non-Docker process on 5432 and fail loudly with the
offending pid.
Fresh-eyes review round with 6 independent agents (money-safety, concurrency,
Square wire parity, security, frontend flow, testing-gaps). Every finding was
independently verified against the code before fixing. All backend changes
now carry full test suites (10+ new tests, each verified to FAIL without its
guard). All 20 packages green, race detector clean.
Money-safety:
- Gift-card purchase refunds no longer create money: manual refunds of a
no-booking (gift-card purchase) payment are rejected with a clear message
in the direct handler AND never re-issued by the sweep-resume path
(processManualPaymentGroup skips them; reconcile-then-fail, no re-issue).
- BuyGiftCard no-client-key fallback: derived deterministically under the
advisory lock (pending-row reuse fixes lost-response double-charge;
completed-row sequence advance preserves distinct-purchase collapse fix).
- Terminal completion is never unrecorded: activeTerminalCheckoutID now calls
recordUntrackedTerminalPayment when a provisional (tmp-) checkout is found
COMPLETED at Square (previously only marked the row COMPLETED — a lost poll
left the payment invisible and unrefundable).
- Sweep: provisional tmp- checkout rows are resolved against Square first
(COMPLETED → record; live → keep guard; NOT_FOUND/CANCELED → fail;
ambiguous → leave pending) instead of blind-failing a possibly-live
checkout. recordUntrackedTerminalPayment re-checks the booking status
(FOR UPDATE) and refuses to record on a cancelled booking, inserting a
critical_payment_log admin notification instead. Till-sale post-charge
UPDATE now requires status='pending' (no resurrection of a clawed-back sale).
Frontend (Svelte 5):
- UserPaymentModal keeps CardSelection mounted through processing (bind:this
ref + Square iframe survive the loyalty/tokenize awaits) — new-card
payments work again.
- BookingFlow clears the cached nonce/verification pair on any failure (retry
re-tokenizes fresh; idempotency key retained for dedup); 409 'already paid'
refetches the booking and reconciles depositPaid so the confirmation gate
opens; Back button disabled during processing.
- Synchronous double-submit guards on buyGiftCard/redeemGiftCard/submitTip.
Square wire parity (mock vs real):
- processing_fee sign unified (negated at paymentFromSquare; mock agrees).
- SimulateSourceUsed (SOURCE_USED, 400) matches real CreateCard.
- GetCardsOnFile excludes disabled cards (matches ListCards).
- ForcePaymentStatus toggle + tests prove the charge path can't be status-blind.
- CreateCheckout rejects empty device_id (env fallback SQUARE_TERMINAL_DEVICE_ID);
completed terminal checkout's payment resolvable by id.
Security:
- 2FA attempt-map data race fixed: lastAt is atomic.Int64 (nanos) — eviction
scan reads race-free; concurrent verify+evict tests under -race.
- Backend refuses to start on weak/placeholder JWT_SECRET_KEY (<32 chars or
known public placeholders) with openssl rand -hex 32 guidance.
- Dockerfile no longer COPYs .env (secrets injected via compose env_file).
- SabreDAV requires DAV_ADMIN_PASSWORD (no admin/admin default); compose
fails at config time when missing.
Testing gaps closed (each verified to FAIL without its guard):
- refunded-dedup 409 (CreateBookingPayment), keyed sweep past-retention
blind-fail, reconcile status-switch (CANCELED/FAILED/APPROVED/PENDING/unknown
in both by-key and by-id paths), resolveChargeSource Square-failure branches,
structured 500 / CARD_DECLINED / cancelled-context E2E (row stays pending),
deriveBookingPaymentIdempotencyKey >45-char truncation, webhook
findPaymentByDisputeID fallback, clawbackOneTillSale non-gift-card branch,
dispute.evidence / terminal.checkout dispatch.
Infra:
- local-dev-2.sh fails loudly on port-5432 squatters / docker compose failures
(previously died silently under ERR_EXIT with hidden output).
- Test harness defaults SQUARE_TERMINAL_DEVICE_ID; money_safety_fixes_test.go
gained the missing build tag.
Verification: go test -tags test,dev -count=1 -parallel 8 ./... (20/20 ok),
-race clean on 2FA + payments money paths, go build ./... + -tags dev, go vet
clean, svelte-check 0 errors, env-docs gate OK (36 vars), docker compose
config valid.
Sixth fresh-eyes review pass (5 agents: goal, QA, code-quality, security,
context-mining). QA FAILED the deposit-required new-card flow; the P0 root
cause was backend + frontend, now fixed. All 20 packages green.
P0 money-safety:
- Deposit-required bookings now actually charge the deposit on new-card
payment. Two-part fix: (1) CreateBookingHandler re-reads the
trigger-maintained total_amount/total_duration_minutes from the DB after the
booking_services insert (the INSERT..RETURNING row predates the recalc
trigger, so TotalAmount serialized as 0 and DepositPaid computed TRUE on an
unpaid booking — the frontend gate trusted deposit_paid:true, never charged,
and confirmed the booking with zero payment rows); (2) BookingFlow.svelte
gates the confirmation view on depositPaid and guards against re-creating a
booking on retry. Regression test
TestBookings_Create_DepositPaidFalseOnUnpaidBooking.
Payments (idempotency + money):
- deriveBookingPaymentIdempotencyKey: no-client-key fallback now advances a
sequence for repeatable types (partial) and rotates past refunded completed
rows, so refund-then-repay and equal-amount partials diverge onto distinct
keys; an un-refunded completed row keeps its key (double-charge protection
holds). Dedup hits on refunded rows now 409, never stale success.
- chargeFailureStatus default is 503 (ambiguous), never 402; table test.
- Flaky TestBookingPayment_FullPayment_SplitsIntoDepositAndBalance fixed
(ORDER BY payment_type).
- resolveChargeSource: orphaned card-on-file disabled via DeleteCardOnFile
when SaveCardForUser fails (best-effort, redacted log); retry path preserved.
Square client:
- Dev builds HARD-FAIL (panic) on SQUARE_ENVIRONMENT=production without
SQUARE_ALLOW_REAL_API=1; sandbox routes with a loud banner.
- Mock fault-injection FailAfterCommit (commit-then-5xx) exercises the exact
lost-response same-key retry; SimulateCardTokenUsed; 45-char idempotency-key
cap parity; SquareEnvironment/SquareLocationID shared env helpers used by
the sweep (env contract no longer comment-only).
- listRefunds truncation now errors (money-sensitive reconcile retries
instead of over-refunding); getCardsOnFile truncation loudly logged.
Webhooks + 2FA:
- square-environment header checked fail-closed (403) when configured env is
production/sandbox; dispatch DB work bounded by 30s timeout contexts.
- 2FA codes HMAC-SHA256 pepper'd (TWO_FACTOR_PEPPER) with legacy-hash
migration + upgrade-on-verify; disable-flow mint cooldown (1/min, 429) caps
the brute-force loop; in-lockout records never LRU-evicted.
Repo hygiene:
- env-docs CI gate green again (FRONTEND_ORIGIN + SQUARE_ALLOW_REAL_API +
TWO_FACTOR_PEPPER documented; Vite DEV built-in allowlisted).
- Dead square_deposits schema dropped; obsidian/README/legal-page drift fixed
(consumeradvice.scot signposting, CORS allowlist, p11 R3/P13, T1).
- 2FA disable residual documented; P6 email/SMS delivery and P12 sandbox
smoke test remain the pre-go-live gates.
Verification: go test -tags test,dev -count=1 -parallel 8 ./... (20/20 ok),
go build ./... + -tags dev, go vet clean, svelte-check 0 errors, env-docs
gate OK, live deposit-required flow re-verified end-to-end (deposit £11
charged, square_payment_id recorded).
The test command (line 1478) inherits the tmux environment, which
includes POSTGRES_HOST=postgres from line 112 (sourced from .env).
Since db_dev.go now reads POSTGRES_HOST from env, the test runner
tried connecting to 'postgres:5432' which doesn't resolve from the
host — causing all TestMain functions to fail.
Fix: export explicit values (myuser/mypassword/localhost/crussell_test)
instead of re-exporting whatever the tmux session inherited.
CI test command: switch from explicit package list to ./... so new
packages are automatically included.
local-dev-2.sh: override POSTGRES_HOST=localhost for the host-side
go run -tags dev ./main.go. The dev-tagged Connect() now reads
POSTGRES_HOST from env (needed for CI where service containers use
Docker DNS). Locally, .env sets POSTGRES_HOST=postgres, but that
name only resolves inside Docker — not from the host where the dev
server runs. Override to localhost so it connects via Docker's port
forwarding.
Update project documentation and development scripts.
- Update README test counts (953/957 passing, 8 skipped)
- Simplify dev script: remove test DB seeding, add name history creation,
clean up stale test databases on startup, remove -p 1 test flag
- Update obsidian documentation for new features:
- Name history system docs
- Referral discount system docs
- Database migration docs (CHAR(12) short IDs)
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Backend:
- Add enriched response types (EditSnapshot, EnrichedEditRequest) with original vs proposed snapshots
- Add 4 new GET endpoints for viewing edit requests (user and admin scoped)
- Remove github.com/lib/pq dependency — use native PostgreSQL array scanning
- Clean up edit requests, time blockers, and notifications on booking cancellation
- Validate exceptional closed hours on admin approve (409 Conflict)
- Notification upsert on edit request replace (no duplicate admin notifications)
Frontend:
- New user EditRequestModal with time/services/both modes and lunch protection
- New admin EditRequestModal with side-by-side diff (date/time, services, notes)
- Integrate edit requests into PendingApprovals card and notifications page
- Preload 3 months of availability to prevent calendar snap-back
- Apply lunch protection to isDateUnavailable in BookingFlow and BookingCreateModal
- Fix accessibility: card list items use <button> instead of <div>
Dev & Docs:
- Seed edit requests in local-dev-2.sh
- Update all Obsidian manuals with enriched edit request documentation
- 42 new tests (438/441 passing)
- backend/main.go: Flatten /bookings/* sub-Route to explicit paths to prevent
RequireAuth middleware from bleeding into OptionalAuth POST /bookings
- backend/handlers/scheduling/time-blockers.go: Exclude RESERVATION:* entries
from GetTimeBlockersInRange so overlap checks dont reject the users own
reservation before CreateBookingHandler can delete it
- local-dev-2.sh: Fix open_day to skip Saturday (6) not Monday (1), matching
working_hours schema; move guest booking dates to +16/+20/+22 days beyond
the upcoming loop range; add reserve-then-book step mirroring frontend flow
All slots on tomorrow were occupied by existing bookings.
Shifted guest bookings to day 3 and day 5 where specific
slots (B, C, D) are guaranteed free by the upcoming pattern.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Guest bookings: create 4 guest accounts (3 unique + 1 shared-email),
3 guest bookings across different days, and verify registered-email
collision is properly blocked.
Time blockers: staff meeting, holiday morning block, and late start
block to demonstrate unavailable-time behaviour.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Hide My Schedule link from admin users (they have dashboard instead).
Add 60+ randomized greeting strings split between returning and new users.
Update dev script admin seed name.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Use fixed date (Thursday Feb 26, 2026) instead of dynamic tomorrow
to avoid timezone-related test flakiness
- Remove orphaned SQL fragment from init-script.sql
- Clean up duplicate color code definitions in local-dev-2.sh
- Add Rustfs data wipe and SabreDAV startup to dev script
- Add composer.lock to .gitignore
- Remove patch_test_duration_hours from services table
- Add new patch_tests table with service_ids array, notice_duration_hours, expiry_months
- Add new user_patch_tests table linking users to patch_tests with tested_at
- Update services handler to check patch_tests.service_ids for eligibility
- Update booking creation to validate patch test requirements (24h notice, 6mo expiry)
- Update booking completion to extend patch test validity (reset tested_at)
- Update admin handlers for new patch test CRUD operations
- Update test fixtures and test cases for new schema
- Update seeding script to create patch_tests and link to gel services
- Add TestMain to set test env vars and testdb.TruncateTables for test
isolation
- Add chi routing context to test helpers for path parameter extraction
- Fix SQL error handling to use errors.Is() instead of ==
- Add validators package with ID validation
- Fix admin test middleware chain (RequireAdmin wrapper)
- Update test user inserts to include phone and date_of_birth fields
- Update service delete test to check soft-delete (is_active=false)
- Update holiday hours test to use new schema (weekday, is_open)
- Add phone number validation tests for UK mobile numbers
- PostgreSQL reports ready (SELECT 1 succeeds) but internal initialization still in progress
- Add explicit 5-second sleep after 'PostgreSQL is ready' message
- Ensures database system fully initialized before creating/seeding test database
- Prevents 'database system is starting up' errors
- Also increase sleep after database creation from 1s to 2s for stability
- PostgreSQL container takes time to fully initialize after docker compose up
- Previous fix didn't account for container startup time
- Add explicit wait loop (30 second timeout) for PostgreSQL service to be ready
- Only create test database AFTER PostgreSQL itself responds to connections
- Prevents 'database system is starting up' errors
- More robust and handles slower container startup scenarios
- Add explicit verification loop in local-dev-2.sh to wait for crussell_test database to be ready before running tests (prevents race condition)
- Remove unused 'handler' variable declaration in scheduling_test.go that was breaking the build
- Tests now properly execute without immediate 'database does not exist' errors
- Real test failures are now visible instead of being masked by setup issues
- Create crussell_test database after PostgreSQL reset
- Seed test DB schema from init-script.sql so tests can run
- This fixes the TLS connection errors in test runs
Also:
- Fixed color variables in script (C_RESET, C_GREEN, etc.)
- Add eligibility filtering to /api/services: exclude services below
user's
age, gray out services requiring patch tests that are missing/expired
- Add new endpoint /api/services/eligible-for/{user_id} for admin
booking
flows to check eligibility for a specific user
- Add image metadata stripping: uploads now strip all EXIF/GPS data
via imaging library (security improvement)
- Update ServiceCard frontend: show grayed-out state for ineligible
services with "contact us" link (public) or just warning (admin)
- Add 2 patch test services to seed data: Gel Polish Full Set,
Luxury Gel Manicure (48h each)
- Remove deprecated local-dev.sh script
- Add backend/internal/s3/ with build-tag pattern (dev vs prod)
- Dev: Uses local Rustfs container (S3-compatible)
- Prod: Stub for R2 Cloudflare (add AWS SDK to implement)
- Add S3 env vars to .env.example and .env
- Add Rustfs service to compose.yml
- Add Rustfs reset to local-dev-2.sh (wipes data on each run)
Backend:
- Enriched GetAllUserBookings response with calculated total_amount,
amount_paid, and duration_minutes.
- Refactored GetBookingHandler to return a flat booking object matching
frontend expectations.
- Added account_role to admin user list response and sorted users by
booking activity.
- Corrected function name oo to AdminCreateBookingForUserHandler.
Frontend:
- Rebuilt BookingCreateModal into a 4-step wizard supporting guest
bookings, service overrides, and real-time availability checks.
- Fixed account dashboard logic to correctly identify upcoming vs past
bookings and sort unpaid items to the top.
- Extracted booking flow into a shared BookingFlow component.
- Redirected admin users from home page to /today.
popertotsandSisyphus