popertots
36887167c6
Loop A fresh money/security/dup-mod review of the whole payments overhaul. 28 consolidated findings fixed:
MONEY:
- HIGH-1: B12 overflow guard now uses the discounted obligation — a pre-start deposit can never mint an unintended tip; the discount is never truncated to £0 when the customer pays the discounted deposit
- HIGH-2: discounted-deposit pending-reuse retry compares pendingStoredAmountPence vs chargeAmount (the actual Square amount), not req.Amount — no more permanent amount_mismatch 400 on lost-response retries
- MEDIUM-3: sweep rescue now carves overflow as a tip record + runs completion side-effects (was booking overflow as service revenue, skipping completion)
- MEDIUM-4 (shared w/ security): admin_audit_log.admin_id made nullable + anonymize_user/delete_guest_user NULL it + scrub details.card_last4 — 2fa_fallback_charge PII no longer survives account deletion
- MEDIUM-5: till gift-card payment now passes the £5,000/day admin cap (giftcard_limits)
- LOW-6: expired gift-card balance surfaced as expired/zero in GetUserGiftCardBalance
SECURITY:
- 2FA single-use consume made atomic at verify time for all 5 saved-card gates (fresh charges consume; pending-reuse retries don't); deferred consumption removed
- reissueTwoFACodeAfterFailedCharge routed through the fail-closed issuance gate (pepper check, cooldown) + fresh-only semantics (only when a code was actually consumed)
- family-alive cache invalidated on the stale-family cleanup DELETE (no 30s warm window after expiry)
- frontend 503-retry no longer reuses a consumed 2FA code — aligns with backend re-issue
DUP/MOD:
- reissue helper single-sourced (5 call sites), squareRefundStatusToLocal (10 inline switches), writeChargeSnapshot (7 sites, immutability guard on gift-card/till), postChargeRecheck (3+1 sites), scanIdempotencySlot (2), applyVATToChargeRecord (3 patterns), user_saved_cards upsert (2), BuyGiftCard pending INSERT via service
- till completed-dedup now re-validates paymentHasLiveRefund (aligns with booking/tip/gift-card)
- frontend 402 idempotency-key regeneration added to PaymentModal (aligns with other CIT surfaces)
- PAYMENT_METHOD_SAVED_CARD constant standardised ('saved_card' everywhere)
- admin audit coverage added for AdminRefundBooking + gift-card buy/top-up
- audit-helper cross-package dedup (user/twofa.go now calls payments' exported insert)
Verified: 26/26 dev + 24/24 prod packages, both vet tags, frontend tests + build, gitleaks clean.
21 lines
1.0 KiB
Go
21 lines
1.0 KiB
Go
//go:build dev || test
|
|
|
|
package payments
|
|
|
|
// twoFADeliveryAvailable reports whether a 2FA code delivery channel exists in
|
|
// this build. Dev/test builds always have one — the [2FA] log line is the
|
|
// documented loose-fake delivery channel — so the 2FA BACKUP authorization
|
|
// (the saved-card gate when SCA is unavailable) is always usable here. Mirrors
|
|
// handlers/user/twofa_dev.go; production builds decide in
|
|
// twofa_delivery_prod.go.
|
|
func twoFADeliveryAvailable() bool { return true }
|
|
|
|
// twoFAReissueIssueAllowed is the re-issue path's issuance gate
|
|
// (reissueTwoFACodeAfterFailedCharge, handlers.go), mirroring the user
|
|
// package's twoFAEnsureIssueAllowed build-tagged semantics: dev/test builds
|
|
// always allow issuance — the [2FA] log line is the delivery channel and the
|
|
// unsalted-digest fallback is the documented loose-fake stand-in (matching
|
|
// twofa_dev.go). Production builds fail closed here — no pepper, no delivery
|
|
// channel, no codes (see twofa_delivery_prod.go).
|
|
func twoFAReissueIssueAllowed() error { return nil }
|