popertots 16304bd295 fix: refund sweep — manual-refund audit rows (admin_refund) + refund_failed flood cap ...

- MEDIUM-3a audit coverage: the refund sweep's re-issue of manual refund rows
  now records the admin actor, payment, pence amount and reason under
  action_type 'admin_refund' via the shared InsertAdminAuditCharge helper
  (best-effort own-transaction, non-fatal; distinct from the booking-level
  'admin_booking_refund'); legacy rows with NULL created_by fail harmlessly.
- C5 flood cap: the unacknowledged 'refund_failed' notification queue is capped
  at adminnotify.MaxUnacknowledgedCriticalLogs — pre-check logs the suppression,
  the fold inside the INSERT enforces it atomically, and the (reason,
  booking_id) NOT EXISTS dedup is preserved.

2026-08-22 00:34:50 +01:00

..

adversarial_attack_test.go

fix: comprehensive payment system hardening (4 review passes)

2026-08-22 00:34:49 +01:00

charge_helpers_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

charge_helpers.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

completion_idempotency_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

completion_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

completion.go

fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

2026-08-22 00:34:50 +01:00

concurrency_test.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

discount_preview_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

discounts.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

dst_timezone_test.go

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

errors_test.go

fix: loop-B adversarial (503c326 baseline) — IDEMPOTENCY_KEY_REUSED reclassified ambiguous, 2FA reissue fail-closed alerts, family-cache crash window, consolidation regression checks

2026-08-22 00:34:50 +01:00

errors.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

giftcard_clawback_test.go

fix: gift-card money fixes — partial clawback surfaces CRITICAL (M6), per-admin daily-cap lock (M7), DB-clock expiry

2026-08-22 00:34:50 +01:00

giftcard_clawback.go

fix: gift-card money fixes — partial clawback surfaces CRITICAL (M6), per-admin daily-cap lock (M7), DB-clock expiry

2026-08-22 00:34:50 +01:00

giftcard_limits.go

fix: loop-A fresh review (503c326 baseline) — overflow-guard bypass, discounted-deposit retry, GDPR audit scrub, till cap, sweep rescue, 2FA reissue + SCA retry, consolidation round

2026-08-22 00:34:50 +01:00

giftcard_redeem_touctoc_test.go

fix: gift-card money fixes — partial clawback surfaces CRITICAL (M6), per-admin daily-cap lock (M7), DB-clock expiry

2026-08-22 00:34:50 +01:00

giftcards_test.go

fix: gift-card money fixes — partial clawback surfaces CRITICAL (M6), per-admin daily-cap lock (M7), DB-clock expiry

2026-08-22 00:34:50 +01:00

giftcards.go

fix: gift-card money fixes — partial clawback surfaces CRITICAL (M6), per-admin daily-cap lock (M7), DB-clock expiry

2026-08-22 00:34:50 +01:00

guest_payment_block_test.go

Block guest-role tokens from online payment routes (RequireNonGuest middleware)

2026-08-22 00:34:49 +01:00

handlers_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

handlers.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

idempotency_helpers_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

idempotency_helpers.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

locks_test.go

Add bounded advisory-lock helper; convert loyalty redemption to try-lock

2026-08-22 00:34:49 +01:00

locks.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

loop_a_money_fixes_test.go

fix: round-2 loop-B adversarial (503c326 baseline) — B1 webhook race, APPROVED refund semantics, notification cap single-source, 2FA cooldown/StateFor hardening, register bcrypt semaphore

2026-08-22 00:34:50 +01:00

loop_b_fixes_test.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

loop_b_money_fixes_round2_test.go

fix: round-2 loop-B adversarial (503c326 baseline) — B1 webhook race, APPROVED refund semantics, notification cap single-source, 2FA cooldown/StateFor hardening, register bcrypt semaphore

2026-08-22 00:34:50 +01:00

loop_b_money_fixes_test.go

fix: round-2 loop-A fresh review (503c326 baseline) — B1 replay cap, A6 discount record, 2FA reissue+cooldown, notification flood, lockout saturation, VAT/refund-status consolidation

2026-08-22 00:34:50 +01:00

loyalty_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

loyalty.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

m4_tip_refund_redesign_test.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

m5_fully_paid_completion_test.go

fix: tip double-count, fully-paid auto-completion, discount-refund hardening

2026-08-22 00:34:49 +01:00

money_safety_fixes_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

p14_payment_fixes_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

payment_status_test.go

Expand payment remediation test coverage

2026-08-22 00:34:49 +01:00

payments_fixes_test.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

payments_r6_review_test.go

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

payments_review_fixes_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

payments_round7_test.go

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

payments_round8_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

payments_round9_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

payments_round10_test.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

payments_test.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

refund_exclude_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

refund_policy_boundary_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

refund_policy.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

refunds_test.go

fix: refund sweep — manual-refund audit rows (admin_refund) + refund_failed flood cap

2026-08-22 00:34:50 +01:00

refunds.go

fix: refund sweep — manual-refund audit rows (admin_refund) + refund_failed flood cap

2026-08-22 00:34:50 +01:00

save_card_verified_test.go

Block card saving for unverified accounts at the charge-handler level

2026-08-22 00:34:49 +01:00

service.go

fix: round-2 loop-A fresh review (503c326 baseline) — B1 replay cap, A6 discount record, 2FA reissue+cooldown, notification flood, lockout saturation, VAT/refund-status consolidation

2026-08-22 00:34:50 +01:00

sweep_boundary_test.go

fix: stale-pending sweep hardening — auto-refund stranded charges (M2), VAT re-apply (M5), single clock source (M3)

2026-08-22 00:34:50 +01:00

sweep_test.go

fix: stale-pending sweep hardening — auto-refund stranded charges (M2), VAT re-apply (M5), single clock source (M3)

2026-08-22 00:34:50 +01:00

sweep.go

fix: stale-pending sweep hardening — auto-refund stranded charges (M2), VAT re-apply (M5), single clock source (M3)

2026-08-22 00:34:50 +01:00

terminal_sca_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

testmain_test.go

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

till_test.go

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

till.go

fix: loop-B adversarial (503c326 baseline) — IDEMPOTENCY_KEY_REUSED reclassified ambiguous, 2FA reissue fail-closed alerts, family-cache crash window, consolidation regression checks

2026-08-22 00:34:50 +01:00

twofa_delivery_dev.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

twofa_delivery_prod_test.go

fix: loop-A fresh review (503c326 baseline) — overflow-guard bypass, discounted-deposit retry, GDPR audit scrub, till cap, sweep rescue, 2FA reissue + SCA retry, consolidation round

2026-08-22 00:34:50 +01:00

twofa_delivery_prod.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

twofa_delivery_variant_dev_test.go

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

twofa_delivery_variant_prod_test.go

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

twofa_failclosed_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

twofa_gate_consume_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

twofa_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

twofa.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

validators_test.go

Expand payment test coverage: lock contention, nonce-direct, provisional rows, GDPR scrub, validators

2026-08-22 00:34:49 +01:00

validators.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

vat_test.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

vat.go

fix: loop-A fresh review (503c326 baseline) — overflow-guard bypass, discounted-deposit retry, GDPR audit scrub, till cap, sweep rescue, 2FA reissue + SCA retry, consolidation round

2026-08-22 00:34:50 +01:00