Files
Crussell/backend/handlers/scheduling/scheduled-cleanup.go
T
popertots a6a4683b74 fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment
Three fresh reviews (money/security/dup-mod) cross-validated findings:
- MEDIUM: B1 'new charge' discrimination adds a lower-bound tolerance (replayRescueLowerBoundSkew) so a retained-key replay of the ORIGINAL charge (DB clock ahead of Square) is never auto-refunded; ambiguous margins leave PENDING + CRITICAL
- MEDIUM: B1 re-poll escalates after stalePendingB1RefundAge (48h) — FAILED/REJECTED refunds go terminal (fail parent, claw back till-sale funding, CRITICAL notification); no more unbounded re-polling / stranded parents without webhooks
- DRIFT-REAL: processManualPaymentGroup now checks PENDING/FAILED/REJECTED on the synchronous refund response (mirrors processChargeGroup/manual handler) — no more premature 'completed'
- HIGH: refresh-token family kill now also invalidates the attacker's freshly-minted ACCESS token — access tokens carry a family_id claim and VerifyToken rejects tokens whose family was deleted (GenerateTokenForFamily + family-alive check); 30s grace window for concurrent two-tab refresh (no false theft alert)
- LOW: 2FA mint endpoint returns remaining_seconds; in-memory 2FA counters documented; 90-day refresh expiry single-sourced (RefreshTokenLifetime + make_interval)
- Dup/mod: NEW shared useTwoFactorCodeForSavedCard Svelte composable replaces 6 surface copies of the 2FA gate logic (Request-a-new-code added to BookingFlow + TillPurchases); account page adopts generateUUID
- Test architecture: removed t.Parallel() from 8 global-SquareClient-swapping tests per Testing Architecture doc line 89 (B1 flaky-test lesson) — fixes within-package race
- SQL alias pence rename (total_cents/paid_cents -> total_pence/paid_pence)

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.
2026-08-22 00:34:50 +01:00

365 lines
11 KiB
Go

package scheduling
import (
"context"
"encoding/json"
"errors"
"fmt"
"log/slog"
"time"
"crussell/auth"
"crussell/clock"
"crussell/db"
"github.com/jackc/pgx/v5"
)
// NotifyUnpaidOneWeek inserts admin_notifications for bookings that ended
// 7+ days ago with no completed payment. Runs daily.
// TODO: Notify affected user via email/SMS when SMTP is wired (E5).
func NotifyUnpaidOneWeek(ctx context.Context) (int, error) {
tx, err := db.Conn.Begin(ctx)
if err != nil {
return 0, fmt.Errorf("failed to begin transaction: %w", err)
}
defer func() {
if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
slog.Error("failed to rollback transaction", "err", err)
}
}()
rows, err := tx.Query(ctx, `
SELECT b.id, b.user_id
FROM bookings b
WHERE b.status NOT IN ('client_cancelled', 'we_cancelled')
AND NOT EXISTS (
SELECT 1 FROM payments p
WHERE p.booking_id = b.id AND p.status = 'completed'
)
AND b.end_time >= NOW() - INTERVAL '30 days'
AND b.end_time < NOW() - INTERVAL '7 days'
AND NOT EXISTS (
SELECT 1 FROM admin_notifications an
WHERE an.booking_id = b.id AND an.reason = '1_week_no_pay'
)
`)
if err != nil {
return 0, fmt.Errorf("failed to query unpaid 1-week bookings: %w", err)
}
defer rows.Close()
var ids, userIDs []string
for rows.Next() {
var id, userID string
if err := rows.Scan(&id, &userID); err != nil {
return 0, fmt.Errorf("failed to scan row: %w", err)
}
ids = append(ids, id)
userIDs = append(userIDs, userID)
}
if err := rows.Err(); err != nil {
return 0, fmt.Errorf("rows iteration error: %w", err)
}
if len(ids) == 0 {
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return 0, nil
}
_, err = tx.Exec(ctx, `
INSERT INTO admin_notifications (reason, booking_id, user_id)
SELECT '1_week_no_pay', unnest($1::text[]), unnest($2::text[])
`, ids, userIDs)
if err != nil {
return 0, fmt.Errorf("failed to insert 1_week_no_pay notifications: %w", err)
}
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return len(ids), nil
}
// NotifyUnpaidOneMonth inserts admin_notifications for bookings that ended
// 30+ days ago with no completed payment. Runs daily.
// TODO: Notify affected user via email/SMS when SMTP is wired (E5).
func NotifyUnpaidOneMonth(ctx context.Context) (int, error) {
tx, err := db.Conn.Begin(ctx)
if err != nil {
return 0, fmt.Errorf("failed to begin transaction: %w", err)
}
defer func() {
if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
slog.Error("failed to rollback transaction", "err", err)
}
}()
rows, err := tx.Query(ctx, `
SELECT b.id, b.user_id
FROM bookings b
WHERE b.status NOT IN ('client_cancelled', 'we_cancelled')
AND NOT EXISTS (
SELECT 1 FROM payments p
WHERE p.booking_id = b.id AND p.status = 'completed'
)
AND b.end_time < NOW() - INTERVAL '30 days'
AND NOT EXISTS (
SELECT 1 FROM admin_notifications an
WHERE an.booking_id = b.id AND an.reason = '1_month_no_pay'
)
`)
if err != nil {
return 0, fmt.Errorf("failed to query unpaid 1-month bookings: %w", err)
}
defer rows.Close()
var ids, userIDs []string
for rows.Next() {
var id, userID string
if err := rows.Scan(&id, &userID); err != nil {
return 0, fmt.Errorf("failed to scan row: %w", err)
}
ids = append(ids, id)
userIDs = append(userIDs, userID)
}
if err := rows.Err(); err != nil {
return 0, fmt.Errorf("rows iteration error: %w", err)
}
if len(ids) == 0 {
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return 0, nil
}
_, err = tx.Exec(ctx, `
INSERT INTO admin_notifications (reason, booking_id, user_id)
SELECT '1_month_no_pay', unnest($1::text[]), unnest($2::text[])
`, ids, userIDs)
if err != nil {
return 0, fmt.Errorf("failed to insert 1_month_no_pay notifications: %w", err)
}
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return len(ids), nil
}
// TransitionDiscountCampaigns auto-transitions campaign statuses based on
// dates and redemption limits:
// - draft → active when start_date <= NOW()
// - active → completed when end_date < NOW() or max_redemptions reached
func TransitionDiscountCampaigns(ctx context.Context) (int, error) {
tx, err := db.Conn.Begin(ctx)
if err != nil {
return 0, fmt.Errorf("failed to begin transaction: %w", err)
}
defer func() {
if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
slog.Error("failed to rollback transaction", "err", err)
}
}()
result, err := tx.Exec(ctx, `
UPDATE discount_campaigns
SET status = 'active'
WHERE status = 'draft'
AND campaign_type = 'time_based'
AND start_date <= NOW()
`)
if err != nil {
return 0, fmt.Errorf("failed to activate campaigns: %w", err)
}
activated := result.RowsAffected()
result, err = tx.Exec(ctx, `
UPDATE discount_campaigns
SET status = 'completed'
WHERE status = 'active'
AND (
end_date < NOW()
OR (max_redemptions IS NOT NULL AND times_redeemed >= max_redemptions)
)
`)
if err != nil {
return 0, fmt.Errorf("failed to complete campaigns: %w", err)
}
completed := result.RowsAffected()
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return int(activated + completed), nil
}
// CleanupExpiredVerificationCodes deletes expired verification codes and
// used codes older than 30 days.
func CleanupExpiredVerificationCodes(ctx context.Context) (int, error) {
tx, err := db.Conn.Begin(ctx)
if err != nil {
return 0, fmt.Errorf("failed to begin transaction: %w", err)
}
defer func() {
if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
slog.Error("failed to rollback transaction", "err", err)
}
}()
result, err := tx.Exec(ctx, `
DELETE FROM verification_codes
WHERE (used_at IS NOT NULL AND used_at < NOW() - INTERVAL '30 days')
OR (expires_at < NOW() AND used_at IS NULL)
`)
if err != nil {
return 0, fmt.Errorf("failed to cleanup verification codes: %w", err)
}
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return int(result.RowsAffected()), nil
}
// CleanupExpiredRefreshTokens deletes expired refresh tokens and
// revoked tokens older than the shared RefreshTokenLifetime window (auth).
func CleanupExpiredRefreshTokens(ctx context.Context) (int, error) {
tx, err := db.Conn.Begin(ctx)
if err != nil {
return 0, fmt.Errorf("failed to begin transaction: %w", err)
}
defer func() {
if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
slog.Error("failed to rollback transaction", "err", err)
}
}()
result, err := tx.Exec(ctx, `
DELETE FROM refresh_tokens
WHERE expires_at < NOW()
OR (revoked = TRUE AND created_at < NOW() - make_interval(days => $1))
`, int64(auth.RefreshTokenLifetime/(24*time.Hour)))
if err != nil {
return 0, fmt.Errorf("failed to cleanup refresh tokens: %w", err)
}
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
return int(result.RowsAffected()), nil
}
// LondonDateString returns the Europe/London calendar date (YYYY-MM-DD) for
// the given instant. ApplyScheduledDefaultHours uses this so staged
// default-hours changes roll over at London midnight rather than UTC midnight:
// during BST a London date begins at 23:00 UTC the previous day, so using the
// UTC date would misdate the effective day inside the 00:00-01:00 BST window.
func LondonDateString(t time.Time) string {
return t.In(clock.London).Format("2006-01-02")
}
// ApplyScheduledDefaultHours applies any pending default hours changes that
// have reached their effective_date. Runs daily at 00:05 to catch midnight
// roll-overs even if the cron is slightly delayed.
func ApplyScheduledDefaultHours(ctx context.Context) (int, error) {
todayStr := LondonDateString(clock.Now())
tx, err := db.Conn.Begin(ctx)
if err != nil {
return 0, fmt.Errorf("failed to begin transaction: %w", err)
}
defer func() {
if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
slog.Error("failed to rollback transaction", "err", err)
}
}()
// Find any changes where effective_date <= today (London) and not yet applied/cancelled
var rowID int
var hoursJSON string
err = tx.QueryRow(ctx, `
SELECT id, hours::text
FROM default_hours_scheduled_changes
WHERE effective_date <= $1::date
AND applied_at IS NULL
AND cancelled_at IS NULL
LIMIT 1
`, todayStr).Scan(&rowID, &hoursJSON)
if err != nil {
// No matching change — nothing to do
return 0, tx.Commit(ctx)
}
// Parse the staged hours
var hours []struct {
Weekday int `json:"weekday"`
StartTime string `json:"startTime"`
EndTime string `json:"endTime"`
IsOpen bool `json:"isOpen"`
}
if err := json.Unmarshal([]byte(hoursJSON), &hours); err != nil {
return 0, fmt.Errorf("failed to parse hours JSON for change %d: %w", rowID, err)
}
// Bulk-update working_hours with staged values
weekdays := make([]int, len(hours))
startTimes := make([]string, len(hours))
endTimes := make([]string, len(hours))
isOpenFlags := make([]bool, len(hours))
for i, h := range hours {
weekdays[i] = h.Weekday
startTimes[i] = h.StartTime
endTimes[i] = h.EndTime
isOpenFlags[i] = h.IsOpen
}
if _, err := tx.Exec(ctx, `
UPDATE working_hours AS wh
SET start_time = v.start_time,
end_time = v.end_time,
is_open = v.is_open
FROM (
SELECT unnest($1::smallint[]) AS weekday,
unnest($2::time[]) AS start_time,
unnest($3::time[]) AS end_time,
unnest($4::boolean[]) AS is_open
) v
WHERE wh.weekday = v.weekday
`, weekdays, startTimes, endTimes, isOpenFlags); err != nil {
return 0, fmt.Errorf("failed to update working_hours for change %d: %w", rowID, err)
}
// Mark change as applied
if _, err := tx.Exec(ctx, `
UPDATE default_hours_scheduled_changes
SET applied_at = NOW()
WHERE id = $1
`, rowID); err != nil {
return 0, fmt.Errorf("failed to mark change %d as applied: %w", rowID, err)
}
// Insert admin notification
if _, err := tx.Exec(ctx, `
INSERT INTO admin_notifications (reason, created_at)
VALUES ('default_hours_changed', NOW())
`); err != nil {
return 0, fmt.Errorf("failed to insert notification for change %d: %w", rowID, err)
}
if err := tx.Commit(ctx); err != nil {
return 0, fmt.Errorf("failed to commit: %w", err)
}
slog.Info("Applied scheduled default hours change", "change_id", rowID, "effective_date", todayStr)
return 1, nil
}