popertots
78e6d00dc5
Money-safety: - Deterministic till idempotency fallback (Square-charging only); cash/on_the_house keep unique keys; £250 till gift-card cap; 45-char key validation - Gift-card admin caps £250/tx + £5,000/day; user buy £500/day; BuyGiftCard allowlist unchanged - CancelGiftCard: CCR 2013 14-day right with partial-spend refund of the unspent balance (spend verified via payments.gift_card_id); atomic vs redeem/transfer; refunds stay pending until reversal commits; admin cancel surface (AdminCancelGiftCard) - Sweep: cancelled-booking charges failed+notified instead of silently completed; source-override replay uses live square_source_id; legacy square-less refund sweep; snapshot refresh on pending reuse - Refund lock consolidation; recordTerminalPaymentTx shared recorder; structured Square error codes; terminal checkout CustomerID GDPR / security: - Notes retained as de-identified medical/safety record at erasure (single field treated as health data; rest of record wiped, no re-identification map) + comments updated per UK GDPR/Art 9/Equality Act 2010 - square_request_snapshot PII scrubbed on all erasure paths; delete_guest_user FK unlinks; verification codes + dispute reasons handled; idle/stale-guest erasure deletes Square cards/customers + CardDAV/R2 - Durable square-erasure outbox job (retry-square-erasures); 2FA dev/prod build split, pepper fail-closed, no prod code-in-log; prod 2FA delivery fail-loud without a channel - Webhook unknown-type family split (non-money acked, money retried); untracked dispute notifications; rate-limit CF/X-Real-IP trust gating; nginx CSP nonce + api_limit Frontend: - Dynamic z-index stack (ui/dialog/zindex.ts) claimed in open order via data-state observer; re-claims on every reopen; removes stale !z-* overrides — nested modals (booking→user→booking) always paint newest-on-top (browser-verified 3-level + reopen) - Mobile: iOS zoom fixes, bottom-sheet dialogs, 44px touch targets, inputmode decimal, dvh - Gift-card buy/cancel UI, admin £250 + daily limits, cancellation/privacy/terms policy accuracy S3: - Connect() creates buckets before probing; in-memory fallback only on genuine unreachability; health reports degraded; stale S3_PUBLIC_URL documented (host-specific) Tests/docs: - 2263 test functions; all 22 backend packages green; round8/9/10 regression suites; NextEditWindowTime removes wall-clock flake; docs reconciled (notes retention, gift-card partial-use, modal T15 future work)
75 lines
3.3 KiB
AMPL
75 lines
3.3 KiB
AMPL
module crussell
|
|
|
|
go 1.26
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2 v1.42.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.25
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.24
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.104.0
|
|
github.com/aws/smithy-go v1.27.2
|
|
github.com/dop251/goja v0.0.0-20260618133527-c9b2ea77db59
|
|
github.com/go-chi/jwtauth/v5 v5.4.0
|
|
github.com/go-playground/validator/v10 v10.30.3
|
|
github.com/kovidgoyal/imaging v1.8.21
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/stretchr/testify v1.11.1
|
|
golang.org/x/text v0.38.0
|
|
)
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/dlclark/regexp2/v2 v2.2.2 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
|
|
github.com/google/pprof v0.0.0-20260604005048-7023385849c0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/kovidgoyal/go-parallel v1.1.1 // indirect
|
|
github.com/kovidgoyal/go-shm v1.0.0 // indirect
|
|
github.com/kr/text v0.2.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/lestrrat-go/dsig v1.3.0 // indirect
|
|
github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
|
|
github.com/lestrrat-go/httprc/v3 v3.0.6 // indirect
|
|
github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
|
|
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
|
github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
|
|
github.com/valyala/fastjson v1.6.10 // indirect
|
|
golang.org/x/image v0.43.0 // indirect
|
|
golang.org/x/sync v0.21.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|
|
|
|
require (
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
|
|
github.com/go-chi/chi/v5 v5.3.0
|
|
github.com/goccy/go-json v0.10.6 // indirect
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
|
|
github.com/lestrrat-go/httpcc v1.0.1 // indirect
|
|
github.com/nyaruka/phonenumbers v1.8.0
|
|
github.com/segmentio/asm v1.2.1 // indirect
|
|
golang.org/x/crypto v0.53.0
|
|
golang.org/x/sys v0.46.0 // indirect
|
|
)
|