popertots
7439fa86c1
R1/R4: saved_card branch in CreateTerminalPayment now mirrors CreateTipPayment - advisory lock (crussell:payment:<bookingID>) serializes concurrent double-clicks - deterministic key bookingID-sc-type-amount-cardID (<=45 chars) so a lost-response retry derives the same key and dedups instead of double-charging - idempotency switch inside the lock: completed -> dedup, pending -> reuse with pence amount-guard, failed -> clean 409 - success response includes card_brand/card_last4 (frontend already reads them) R2: add 'failed' case to all four retry switches (tip, booking, gift card, till) - a swept/definitively-rejected record returns 409 instead of 500-ing on the idempotency_key UNIQUE constraint R3: extend SweepStalePendingPayments to till_sales card rows - sweeps pending till_sales (online_square/in_person_card) past Square's ~24h key retention, closing the double-charge window for till sales - swept rows logged with the same CRITICAL manual-reconciliation marker as the refund sweep Webhook fail-closed: reject 503 when SQUARE_WEBHOOK_SIGNATURE_KEY unset, 403 on bad signature (was: skip verification in dev) Refund status resolution: refunds now resolve by Square status (COMPLETED/PENDING/FAILED/REJECTED) instead of assuming completed; real error codes (REFUND_AMOUNT_INVALID, PAYMENT_NOT_REFUNDABLE, REFUND_ALREADY_PENDING) added to the definitive/processed classification HTTP client: CreateCard key truncated to <=45 chars, device_options always sent (env SQUARE_TERMINAL_DEVICE_ID fallback), processing_fee reads amount_money, ListCards cursor loop, refund keys hashed to <=45 chars Other fixes: payment/till/gift-card advisory-lock + FOR UPDATE asymmetries, GetPaymentByID NULL scans, loyalty redemption lock, card upsert on conflict, mock ccof: prefix parity, IsValidSquareCheckoutID for real Square IDs, isAdminRequest defense-in-depth on all 6 admin payment handlers, webhook signature docs, M8/L5 debug markers removed Docs: README/FC/TM/Overview updated (22 jobs, 20 CRITICAL sites, 23-section GDPR export, sweep jobs, webhook fail-closed); P11 plan marks remaining items (sandbox smoke test, M-8 customer_id, saved-card key dedup trade-off) as deferred with rationale; gap backlog pruned of completed items
102 lines
3.3 KiB
Go
102 lines
3.3 KiB
Go
package webhooks
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
)
|
|
|
|
type SquareWebhookEvent struct {
|
|
Type string `json:"type"`
|
|
EventID string `json:"event_id"`
|
|
CreatedAt string `json:"created_at"`
|
|
Data json.RawMessage `json:"data"`
|
|
LocationID string `json:"location_id"`
|
|
}
|
|
|
|
func HandleSquareWebhook(w http.ResponseWriter, r *http.Request) {
|
|
r.Body = http.MaxBytesReader(w, r.Body, 512*1024)
|
|
body, err := io.ReadAll(r.Body)
|
|
if err != nil {
|
|
log.Printf("Failed to read webhook body: %v", err)
|
|
http.Error(w, "request body too large or unreadable", http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
defer r.Body.Close()
|
|
|
|
// Verification logic per Square spec (HMAC-SHA256, base64, notificationURL + body).
|
|
// Production setup: set SQUARE_WEBHOOK_SIGNATURE_KEY and SQUARE_WEBHOOK_NOTIFICATION_URL
|
|
// in env vars (see Square Developer Console → Webhooks → Subscription).
|
|
// Reference: https://developer.squareup.com/docs/webhooks/step3validate
|
|
|
|
// Fail closed: a missing signing key means the webhook cannot be verified,
|
|
// so reject rather than process unauthenticated events (S-4). Square
|
|
// always sends the signature header, so an unset key in production is a
|
|
// misconfiguration that must not silently accept forged events.
|
|
signingKey := os.Getenv("SQUARE_WEBHOOK_SIGNATURE_KEY")
|
|
notificationURL := os.Getenv("SQUARE_WEBHOOK_NOTIFICATION_URL")
|
|
if notificationURL == "" {
|
|
notificationURL = "http://localhost:8080/webhooks/square"
|
|
}
|
|
if signingKey == "" {
|
|
log.Printf("SQUARE_WEBHOOK_SIGNATURE_KEY is not set — rejecting webhook (fail-closed)")
|
|
http.Error(w, "webhook signature verification unavailable", http.StatusServiceUnavailable)
|
|
return
|
|
}
|
|
signature := r.Header.Get("x-square-hmacsha256-signature")
|
|
if signature == "" {
|
|
log.Printf("Missing Square webhook signature header")
|
|
http.Error(w, "Invalid signature", http.StatusForbidden)
|
|
return
|
|
}
|
|
if !verifySquareSignature(body, signature, signingKey, notificationURL) {
|
|
log.Printf("Invalid Square webhook signature")
|
|
http.Error(w, "Invalid signature", http.StatusForbidden)
|
|
return
|
|
}
|
|
|
|
var event SquareWebhookEvent
|
|
if err := json.Unmarshal(body, &event); err != nil {
|
|
log.Printf("Failed to parse webhook event: %v", err)
|
|
http.Error(w, "Invalid event", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
log.Printf("[SQUARE-WEBHOOK] Received event: %s", event.Type)
|
|
|
|
switch event.Type {
|
|
case "payment.updated":
|
|
handlePaymentUpdated(event.Data)
|
|
case "refund.updated":
|
|
handleRefundUpdated(event.Data)
|
|
case "dispute.created":
|
|
log.Printf("[SQUARE-WEBHOOK] Dispute created: %s", event.EventID)
|
|
default:
|
|
log.Printf("[SQUARE-WEBHOOK] Unknown event type: %s", event.Type)
|
|
}
|
|
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = w.Write([]byte("ok"))
|
|
}
|
|
|
|
func verifySquareSignature(body []byte, signature, signingKey, notificationURL string) bool {
|
|
mac := hmac.New(sha256.New, []byte(signingKey))
|
|
mac.Write([]byte(notificationURL))
|
|
mac.Write(body)
|
|
expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))
|
|
return hmac.Equal([]byte(signature), []byte(expected))
|
|
}
|
|
|
|
func handlePaymentUpdated(data json.RawMessage) {
|
|
log.Printf("[SQUARE-WEBHOOK] payment.updated: %s", string(data))
|
|
}
|
|
|
|
func handleRefundUpdated(data json.RawMessage) {
|
|
log.Printf("[SQUARE-WEBHOOK] refund.updated: %s", string(data))
|
|
}
|