- till.go: the saved-card till charge carries the C6 consent fields and enforces
them on the (unreachable) 2FA fallback path; the card ownership SELECT became
owner-agnostic with the owner read at the gate (F1 — no charge surface can
act on a card it does not own); a till sale's gift-card creation/top-up now
runs under the SAME per-admin daily-cap advisory lock as the admin API
surfaces (F5) so two concurrent distinct sales cannot overshoot the £5,000
day ceiling; money-F4: an expired gift card can never be topped up (expiry
gate mirrors RedeemGiftCard's DB-clock comparison) — the top-up would
otherwise resurrect a card the nightly cleanup already forfeited.
- charge_helpers_test.go: TestResolveChargeSource_SCATokenizeResult_UsesTokenAsSource
pins the SCA tokenize-result wire contract (token as source, card row for the
customer).
- errors_test.go: token-less saved-card charges are refused 402
verification_required under 2FA enforcement (create-payment, gift-card buy +
save-card), even for a user with 2FA enabled — the homegrown gate can never
substitute for SCA.
popertots
8dcfe52ac8