Files
Crussell/backend/handlers/webhooks/testmain_test.go
T
popertots 78e6d00dc5 fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking
Money-safety:
- Deterministic till idempotency fallback (Square-charging only); cash/on_the_house keep unique keys; £250 till gift-card cap; 45-char key validation
- Gift-card admin caps £250/tx + £5,000/day; user buy £500/day; BuyGiftCard allowlist unchanged
- CancelGiftCard: CCR 2013 14-day right with partial-spend refund of the unspent balance (spend verified via payments.gift_card_id); atomic vs redeem/transfer; refunds stay pending until reversal commits; admin cancel surface (AdminCancelGiftCard)
- Sweep: cancelled-booking charges failed+notified instead of silently completed; source-override replay uses live square_source_id; legacy square-less refund sweep; snapshot refresh on pending reuse
- Refund lock consolidation; recordTerminalPaymentTx shared recorder; structured Square error codes; terminal checkout CustomerID

GDPR / security:
- Notes retained as de-identified medical/safety record at erasure (single field treated as health data; rest of record wiped, no re-identification map) + comments updated per UK GDPR/Art 9/Equality Act 2010
- square_request_snapshot PII scrubbed on all erasure paths; delete_guest_user FK unlinks; verification codes + dispute reasons handled; idle/stale-guest erasure deletes Square cards/customers + CardDAV/R2
- Durable square-erasure outbox job (retry-square-erasures); 2FA dev/prod build split, pepper fail-closed, no prod code-in-log; prod 2FA delivery fail-loud without a channel
- Webhook unknown-type family split (non-money acked, money retried); untracked dispute notifications; rate-limit CF/X-Real-IP trust gating; nginx CSP nonce + api_limit

Frontend:
- Dynamic z-index stack (ui/dialog/zindex.ts) claimed in open order via data-state observer; re-claims on every reopen; removes stale !z-* overrides — nested modals (booking→user→booking) always paint newest-on-top (browser-verified 3-level + reopen)
- Mobile: iOS zoom fixes, bottom-sheet dialogs, 44px touch targets, inputmode decimal, dvh
- Gift-card buy/cancel UI, admin £250 + daily limits, cancellation/privacy/terms policy accuracy

S3:
- Connect() creates buckets before probing; in-memory fallback only on genuine unreachability; health reports degraded; stale S3_PUBLIC_URL documented (host-specific)

Tests/docs:
- 2263 test functions; all 22 backend packages green; round8/9/10 regression suites; NextEditWindowTime removes wall-clock flake; docs reconciled (notes retention, gift-card partial-use, modal T15 future work)
2026-08-22 00:34:50 +01:00

40 lines
1.5 KiB
Go

//go:build test
package webhooks
import (
"os"
"testing"
"crussell/db"
"crussell/testutils/testdb"
)
// resetSquareWebhookEventsSeen clears the process-global in-memory webhook
// dedup cache (squareWebhookEventsSeen in square.go). square.go exposes no
// reset — the cache is a deliberate process-lifetime fast-path for handler
// dedup — so the test suite provides its own test-only accessor: the test files
// compile into the same package and can reach the unexported cache. Without a
// reset the suite is order-dependent: tests reuse event_ids (e.g. "evt_1") and
// a delivery from an earlier test would fast-path-drop a later test's delivery
// BEFORE dispatch, silently skipping the state mutation the later test asserts.
func resetSquareWebhookEventsSeen() {
squareWebhookEventsSeen.mu.Lock()
squareWebhookEventsSeen.seen = make(map[string]struct{})
squareWebhookEventsSeen.order = make([]string, 0, squareWebhookEventsSeen.max)
squareWebhookEventsSeen.mu.Unlock()
}
func TestMain(m *testing.M) {
pool := testdb.CreateTestDatabase("crussell_test_handlers_webhooks")
db.Conn = db.NewPoolProxy(pool)
testdb.SeedBaseline(pool)
// Start from a clean in-memory dedup cache: the handler's fast-path cache
// is a package global that would otherwise leak event_ids across tests
// (they share ids like "evt_1"), making the suite order-dependent.
resetSquareWebhookEventsSeen()
code := m.Run()
testdb.DestroyTestDatabase(pool, "crussell_test_handlers_webhooks")
os.Exit(code)
}