popertots
7439fa86c1
R1/R4: saved_card branch in CreateTerminalPayment now mirrors CreateTipPayment - advisory lock (crussell:payment:<bookingID>) serializes concurrent double-clicks - deterministic key bookingID-sc-type-amount-cardID (<=45 chars) so a lost-response retry derives the same key and dedups instead of double-charging - idempotency switch inside the lock: completed -> dedup, pending -> reuse with pence amount-guard, failed -> clean 409 - success response includes card_brand/card_last4 (frontend already reads them) R2: add 'failed' case to all four retry switches (tip, booking, gift card, till) - a swept/definitively-rejected record returns 409 instead of 500-ing on the idempotency_key UNIQUE constraint R3: extend SweepStalePendingPayments to till_sales card rows - sweeps pending till_sales (online_square/in_person_card) past Square's ~24h key retention, closing the double-charge window for till sales - swept rows logged with the same CRITICAL manual-reconciliation marker as the refund sweep Webhook fail-closed: reject 503 when SQUARE_WEBHOOK_SIGNATURE_KEY unset, 403 on bad signature (was: skip verification in dev) Refund status resolution: refunds now resolve by Square status (COMPLETED/PENDING/FAILED/REJECTED) instead of assuming completed; real error codes (REFUND_AMOUNT_INVALID, PAYMENT_NOT_REFUNDABLE, REFUND_ALREADY_PENDING) added to the definitive/processed classification HTTP client: CreateCard key truncated to <=45 chars, device_options always sent (env SQUARE_TERMINAL_DEVICE_ID fallback), processing_fee reads amount_money, ListCards cursor loop, refund keys hashed to <=45 chars Other fixes: payment/till/gift-card advisory-lock + FOR UPDATE asymmetries, GetPaymentByID NULL scans, loyalty redemption lock, card upsert on conflict, mock ccof: prefix parity, IsValidSquareCheckoutID for real Square IDs, isAdminRequest defense-in-depth on all 6 admin payment handlers, webhook signature docs, M8/L5 debug markers removed Docs: README/FC/TM/Overview updated (22 jobs, 20 CRITICAL sites, 23-section GDPR export, sweep jobs, webhook fail-closed); P11 plan marks remaining items (sandbox smoke test, M-8 customer_id, saved-card key dedup trade-off) as deferred with rationale; gap backlog pruned of completed items
79 lines
2.2 KiB
Go
79 lines
2.2 KiB
Go
package validators
|
|
|
|
import (
|
|
"fmt"
|
|
"github.com/go-playground/validator/v10"
|
|
"reflect"
|
|
"regexp"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
var Validate *validator.Validate
|
|
|
|
func init() {
|
|
Validate = validator.New()
|
|
Validate.RegisterTagNameFunc(func(fld reflect.StructField) string {
|
|
name := strings.SplitN(fld.Tag.Get("json"), ",", 2)[0]
|
|
if name == "-" {
|
|
return ""
|
|
}
|
|
return name
|
|
})
|
|
}
|
|
|
|
// ID format: 12-character hexadecimal string (from gen_random_bytes(6) encoded as hex)
|
|
var validIDRegex = regexp.MustCompile(`^[0-9a-fA-F]{12}$`)
|
|
|
|
// IsValidID checks if an ID is valid based on the database constraint (CHAR(12) hex string)
|
|
// Valid IDs are exactly 12 hexadecimal characters (0-9, a-f, A-F)
|
|
func IsValidID(id string) bool {
|
|
if id == "" {
|
|
return false
|
|
}
|
|
return validIDRegex.MatchString(id)
|
|
}
|
|
|
|
// Square checkout IDs are opaque strings (e.g. "08YceKh7B3ZqO") — NOT local
|
|
// 12-hex DB IDs, so IsValidID must not gate them (it would 404 every real
|
|
// checkout). Accept any non-empty ID matching Square's character set with a
|
|
// sane length bound, and reject anything that could inject into the URL path.
|
|
var squareCheckoutIDRegex = regexp.MustCompile(`^[A-Za-z0-9_\-]{8,64}$`)
|
|
|
|
func IsValidSquareCheckoutID(id string) bool {
|
|
if id == "" {
|
|
return false
|
|
}
|
|
return squareCheckoutIDRegex.MatchString(id)
|
|
}
|
|
|
|
// ParseCursor splits a "createdAt|id" cursor string into its components.
|
|
func ParseCursor(cursor string) (time.Time, string, error) {
|
|
parts := strings.SplitN(cursor, "|", 2)
|
|
if len(parts) != 2 {
|
|
return time.Time{}, "", fmt.Errorf("invalid cursor format")
|
|
}
|
|
t, err := time.Parse(time.RFC3339, parts[0])
|
|
if err != nil {
|
|
return time.Time{}, "", fmt.Errorf("invalid cursor created_at: %w", err)
|
|
}
|
|
return t, parts[1], nil
|
|
}
|
|
|
|
func ParseCursor3(cursor string) (int, time.Time, string, error) {
|
|
parts := strings.SplitN(cursor, "|", 3)
|
|
if len(parts) != 3 {
|
|
return 0, time.Time{}, "", fmt.Errorf("invalid cursor format")
|
|
}
|
|
count, err := strconv.Atoi(parts[0])
|
|
if err != nil {
|
|
return 0, time.Time{}, "", fmt.Errorf("invalid cursor completed_count: %w", err)
|
|
}
|
|
t, err := time.Parse(time.RFC3339, parts[1])
|
|
if err != nil {
|
|
return 0, time.Time{}, "", fmt.Errorf("invalid cursor created_at: %w", err)
|
|
}
|
|
return count, t, parts[2], nil
|
|
}
|