popertots
9bb812669e
Second fresh-eyes review pass (7 agents: goal, security, code-quality, context-mining, webhooks+2FA, client+mock+sweep, refunds/giftcards/handlers). Money-safety core verified sound (identical-body replay byte-lossless, clawback gated on definitive proof, no double-charge window). This round fixes the issues the fresh pass surfaced: 2FA: - Setup now DELIVERS the code via the [2FA] server log in ALL modes (was: nothing in enforced mode -> production 2FA was an unbreakable dead-end and saved-card charges were permanently 403). Enforced mode still withholds the code from the API response; the log line is the fake delivery channel until email/SMS lands (P6). - Disabling 2FA now requires a fresh verification code when enforcement is ON (previously ignored the code -> a password-only attacker could lift the gate). Shares the 5-attempt lockout and timing-safe compare. Dev bypass retained. - REQUIRE_2FA parsing normalized (false/0/off/no, case-insensitive); startup warning extended to the empty-env/mock-client/enforced-2FA confusion. GDPR: - anonymize_user() SQL now scrubs two_factor_* columns + staff notes, so the idle-account batch cleanup (CleanupIdleAccounts) is erasure-clean, not just the user-initiated delete path. Webhooks: - dispute.created for an untracked Square payment now raises a critical_payment_log admin notification (chargeback the app can't reconcile is never silent). Reason strings truncated on rune boundaries (valid UTF-8). Stale at-most-once comment corrected; revertTillSaleGiftCardFunding duplication noted. Sweep/mock parity: - Mock CreatePayment dedup is now source-aware (IDEMPOTENCY_KEY_REUSED on source mismatch) matching ReplayPaymentByKey and real Square. - COMPLETED-but-never-polled terminal till-sale checkouts are now recorded by the sweep (previously only booking checkouts were; till charges were invisible until the 24h blind-fail WARN). - Legacy snapshot-less minimal-body replay, SQUARE_LOCATION_ID drift, and in-memory-mock-restart limitations documented. Docs: - Webhook path corrected everywhere (/webhooks/square, not /api/webhooks/square - a deployer following the old path would 404 and silently lose all webhook reconciliation). - 2FA enforcement semantics + code-delivery mechanism documented accurately (fail-closed default; log-delivery channel; disable re-verification). - README/User Manual note the 2FA requirement on online saved-card payments. Tests: 2,151 (up from 2,142). Backend 26/27 packages green (crussell/db fails only in this environment: local postgres doesn't offer scram-sha-256 for the test role; package is byte-identical to HEAD and untouched here). Frontend builds; svelte-check 0 errors.
101 lines
3.9 KiB
Bash
101 lines
3.9 KiB
Bash
# Database Credentials for all services
|
|
|
|
# These are used by the 'postgres' service to initialize the database
|
|
# These are used by 'backend' (Go) and 'sabredav' (PHP)
|
|
POSTGRES_USER=myuser
|
|
POSTGRES_PASSWORD=mypassword
|
|
POSTGRES_DB=mydb
|
|
|
|
# and to connect to the 'postgres' service on the Docker network
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
|
|
JWT_SECRET_KEY="a-very-secret-key-that-should-be-in-env"
|
|
|
|
# S3/R2 Configuration (for image storage)
|
|
# Dev: Uses local Rustfs container (see compose.yml)
|
|
# Prod: Use Cloudflare R2 credentials
|
|
S3_ENDPOINT=http://localhost:9000
|
|
S3_PUBLIC_URL=http://192.168.1.135:9000
|
|
S3_ACCESS_KEY=rustfsadmin
|
|
S3_SECRET_KEY=rustfsadmin
|
|
S3_BUCKET=crussell
|
|
S3_PROFILE_PICS_BUCKET=crussell-profile-pics
|
|
AWS_REGION=eu-west-2
|
|
|
|
# Set DAV_SKIP_INIT=1 to skip CardDAV server initialization (e.g., in CI/test environments).
|
|
DAV_SKIP_INIT=1
|
|
|
|
# Prod only: Cloudflare R2 (overrides S3_* vars in non-dev builds).
|
|
# Local dev uses the S3_* vars above (from .env). Not needed for local builds.
|
|
R2_ENDPOINT=
|
|
# Required for production object storage — the prod S3 client (backend/internal/s3/s3.go,
|
|
# via getEnv) reads all four below; not needed for local dev builds.
|
|
R2_ACCESS_KEY=
|
|
R2_SECRET_KEY=
|
|
R2_BUCKET=crussell
|
|
R2_PUBLIC_URL=
|
|
|
|
# Square Payment Gateway
|
|
SQUARE_ACCESS_TOKEN=
|
|
SQUARE_LOCATION_ID=
|
|
SQUARE_TERMINAL_DEVICE_ID=
|
|
SQUARE_ENVIRONMENT=mock
|
|
# 2FA (PSD2 SCA stand-in) for online card payments. Enforcement is FAIL-CLOSED:
|
|
# ON unless REQUIRE_2FA explicitly disables it (false/0/off/no, case-insensitive)
|
|
# OR SQUARE_ENVIRONMENT explicitly equals one of mock/dev/development/test.
|
|
# Empty or unknown SQUARE_ENVIRONMENT values are treated as production-enforced
|
|
# (a mistyped env var can never silently disarm the gate; the backend logs a
|
|
# startup warning in that case). Set REQUIRE_2FA=false only in controlled
|
|
# environments.
|
|
# Code delivery: there is NO email/SMS transport yet. The verification code is
|
|
# delivered via the server log (a [2FA]-prefixed line). In enforced/production
|
|
# environments an operator must relay the logged code to the user out-of-band;
|
|
# the API never returns the code while enforcement is ON.
|
|
REQUIRE_2FA=true
|
|
# Webhook config MUST exactly match the Square Dashboard webhook subscription
|
|
# (URL + signature key). If SQUARE_WEBHOOK_NOTIFICATION_URL is left unset it
|
|
# defaults to http://localhost:8080/webhooks/square, which is fail-closed (503
|
|
# without the signing key, 403 on missing/bad signature). Leave both empty if
|
|
# you do not use webhooks.
|
|
SQUARE_WEBHOOK_SIGNATURE_KEY=
|
|
SQUARE_WEBHOOK_NOTIFICATION_URL=
|
|
|
|
# Frontend (public — safe for the browser). Square Web Payments SDK:
|
|
# VITE_SQUARE_APPLICATION_ID — client-side application ID (sandbox IDs start with "sandbox-")
|
|
# VITE_SQUARE_LOCATION_ID — Square location ID
|
|
# VITE_SQUARE_ENVIRONMENT — 'mock' | 'sandbox' | 'production'. Local dev: 'mock' renders the
|
|
# frontend's built-in mock card form (tokens only; pairs with
|
|
# SQUARE_ENVIRONMENT=mock above). NEVER set 'mock' in production.
|
|
VITE_SQUARE_APPLICATION_ID=
|
|
VITE_SQUARE_LOCATION_ID=
|
|
VITE_SQUARE_ENVIRONMENT=mock
|
|
|
|
# Test Database (separate from main DB)
|
|
# Used by testutils/testdb for running tests without corrupting dev data
|
|
TEST_DB_HOST=localhost
|
|
TEST_DB_DSN=
|
|
|
|
# Dev/CI mode — set to "true" to enable mock services
|
|
# Disables zxcvbn password checks, skips artificial Square mock delays,
|
|
# skips DAV sync, and relaxes production guardrails
|
|
GO_TESTING=
|
|
|
|
# CardDAV (SabreDAV) — profile photo sync
|
|
DAV_BASE_URL=http://localhost:8080
|
|
DAV_ADMIN_PASSWORD=admin
|
|
|
|
# Logging
|
|
# Set to "true" to disable ANSI color escape sequences in log output
|
|
NO_COLOR=
|
|
|
|
# Frontend
|
|
VITE_BACKEND_URL=http://localhost:8080
|
|
|
|
# Local S3 (Rustfs) — requires GO_TESTING=1 or dev build tag
|
|
# These are dev-only overrides used by the dev S3 implementation
|
|
RUSTFS_ENDPOINT=http://rustfs:9000
|
|
RUSTFS_ACCESS_KEY=rustfsadmin
|
|
RUSTFS_SECRET_KEY=rustfsadmin
|
|
RUSTFS_BUCKET=crussell
|