popertots
b7122be3a0
7 review agents (pipeline run, self-review, codebase-context, frontend-placement, backend testing-gaps, Square-API, docs-parity) audited the SCA-primary work. ALL findings fixed, including every pre-existing red CI job: GDPR (HIGH): - anonymize_user() now scrubs admin_audit_log.target_user_id (mirrors delete_guest_user) so 2fa_fallback_charge rows (customer id + card_last4 PII) no longer survive registered-user account deletion; gdpr test added BACKEND TEST GAPS (all 10): - delivery-unavailable 503 branch: prod-tag predicate test + dev-variant marker - twoFactorFallbackEnabled alias/case/default matrix tests + exported wrapper - insertTwoFAFallbackAudit details-JSON shape + audit-row assertions for all 6 gate sites (booking/tip/gift-card/payment-method/terminal/till, both actors) - CreateTerminalPayment.VerificationToken: passthrough, too-long 400, 2FA-skip, token-less fallback + SCA-required (new terminal_sca_test.go) - isVerificationRequiredError at all 5 charge sites (402 + code:verification_required) - customer_initiated handler-level assertions (MIT false admin / CIT true customer) - Mock: ApprovePendingVerification, ChallengeResult auto/deny, _deny token suffix, parseVerifyToken unit tests FRONTEND SCA + Square-API (CRITICAL): - tokenizeSavedCardWithVerification reads result.token (the verified token) not result.verificationResult (deprecated verifyBuyer shape — saved-card SCA could never succeed in production before); parseTokenizeVerificationResult pure fn extracted + pinned in square.test.ts; 'verified' with no token proceeds tokenless - HIGH: saved-card idempotency key regenerated after a definitive 402 (fresh token under the same key = IDEMPOTENCY_KEY_REUSED dead-loop); kept on 503/cancelled - challenge-cancelled copy no longer promises a 2FA fallback the UI doesn't show; 'waiting for approval in your banking app' state on CIT surfaces - sca-unavailable demotion resets per attempt; card selection disabled mid-challenge; genuine saved-card declines no longer relabeled 'requires verification'; modal-close guard during processing; retry affordance standardized PIPELINE (every red job now green): - prod-tag build break fixed (shared square stub + test_helpers_test.go, prod-safe) - govulncheck: x/image 0.45.0 bumped (x/text resolved); go mod tidy clean - race: TestDeleteAccount_InvalidatesSquareCustomerCache made deterministic - DAV_ADMIN_PASSWORD placeholder in .env.example (compose config passes) - frontend: prettier 28 files, eslint, a11y 38 errors, knip (currentZIndex), deps in-range, audit vulns (nanoid/postcss) — all fixed; 67 vitest cases DOCS PARITY (6 DRIFTs + 5 GAPs): payments doc Ch4/Ch14/Appendix A, Technical Manual 2FA + counter-reset + payment sections, README test counts + SNAPSHOT_ENC_KEY, Feature Catalog, .env.example REQUIRE_2FA — SCA-primary/2FA-backup posture verified against code everywhere Verified: 26/26 dev + 24/24 prod packages, both vet tags, golangci-lint/staticcheck/ gosec 0 on both tags, gitleaks clean, 2,464 backend + 67 frontend tests.
75 lines
3.3 KiB
AMPL
75 lines
3.3 KiB
AMPL
module crussell
|
|
|
|
go 1.26
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2 v1.42.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.25
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.24
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.104.0
|
|
github.com/aws/smithy-go v1.27.2
|
|
github.com/dop251/goja v0.0.0-20260618133527-c9b2ea77db59
|
|
github.com/go-chi/jwtauth/v5 v5.4.0
|
|
github.com/go-playground/validator/v10 v10.30.3
|
|
github.com/kovidgoyal/imaging v1.8.21
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/stretchr/testify v1.11.1
|
|
golang.org/x/text v0.41.0
|
|
)
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/dlclark/regexp2/v2 v2.2.2 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
|
|
github.com/google/pprof v0.0.0-20260604005048-7023385849c0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/kovidgoyal/go-parallel v1.1.1 // indirect
|
|
github.com/kovidgoyal/go-shm v1.0.0 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/lestrrat-go/dsig v1.3.0 // indirect
|
|
github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
|
|
github.com/lestrrat-go/httprc/v3 v3.0.6 // indirect
|
|
github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
|
|
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
|
github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
|
|
github.com/valyala/fastjson v1.6.10 // indirect
|
|
golang.org/x/image v0.45.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|
|
|
|
require (
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
|
|
github.com/go-chi/chi/v5 v5.3.0
|
|
github.com/goccy/go-json v0.10.6 // indirect
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
|
|
github.com/lestrrat-go/httpcc v1.0.1 // indirect
|
|
github.com/nyaruka/phonenumbers v1.8.0
|
|
github.com/segmentio/asm v1.2.1 // indirect
|
|
golang.org/x/crypto v0.53.0
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
)
|