popertots
3866cc5963
Round 2 Loop A fresh money/security/dup-mod review. 23 findings fixed: MONEY: - CRITICAL: B1 duplicate auto-refund gains an attempt cap (b1_attempts col, cap 3) — a rejected auto-refund no longer re-replays the expired key every sweep run (which minted a stacking unauthorized charge each time); FAILED-webhook demotion respects the cap; never re-replay a key whose B1 refund failed - HIGH: A6 deposit_covered_by_discount skip path now APPLIES the eligible campaign discount rows immediately (capped) instead of skipping with no discount recorded — no more promised-discount-not-recorded overcharge - MEDIUM: 2FA code burned by the SAVE gate is re-issued on failed new-card+save_card charges (re-issue guard now covers req.SaveCard) - LOW: GetBookingPaymentSummary excludes tip rows from paidAmount (remaining now matches the authoritative tip-excluded balance) SECURITY: - MEDIUM: unacknowledged CRITICAL admin-notification flood capped (global cap on critical_payment_log + refresh_token_reuse rows) - MEDIUM: 2FA reissue no longer bypasses the mint cooldown (Check no longer clears LastMintAt on gate-verify; cleared on terminal charge success) - MEDIUM: twofa.StateFor map-saturation returns a shared permanently-locked state instead of a fresh 5-guess budget per request - MEDIUM: ProgressiveRateLimit rejects 429 past maxProgressiveSleepDelayMs instead of sleeping unboundedly; login bcrypt concurrency semaphore added - LOW: loginInProgress 409->429; webhook key-set/URL-unset startup check; email-verification per-user attempt counter DUP/MOD: - formatCurrency single source (frontend format.ts, 7 files consolidated); SquareRefundStatusToLocal single source (errors.go, all sites); admin audit-log helper dedup; SCA retry model unified (proactive on all 6 surfaces); buyDailyTotal/daily-cap mirror via backend; lock TTL from backend; generateUUID at all card-form sites; magic numbers named (defaultPostgresHost, epsilon, fee constants); admin CASH + gift-card terminal charges now audited; DAV_SKIP_INIT documented in manuals Verified: 26/26 dev + 24/24 prod (GO_TESTING=1, the CI condition), both vet tags, frontend tests+build, env-docs 42/42.
67 lines
1.5 KiB
Go
67 lines
1.5 KiB
Go
//go:build !dev
|
|
|
|
package dav
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
var Service *BaseService
|
|
|
|
// defaultPostgresHost is the fallback Postgres address used when
|
|
// POSTGRES_HOST is unset — the pipeline/CI postgres service default.
|
|
const defaultPostgresHost = "127.0.0.1"
|
|
|
|
func init() {
|
|
// Test builds wire their own pool in TestMain (testutils/testdb) — a real
|
|
// connect here would race that and panic a bare-shell `go test`. Skip.
|
|
if os.Getenv("GO_TESTING") != "" || os.Getenv("DAV_SKIP_INIT") != "" {
|
|
return
|
|
}
|
|
if err := connect(); err != nil {
|
|
panic("failed to initialize prod service: " + err.Error())
|
|
}
|
|
}
|
|
|
|
func connect() error {
|
|
host := getEnv("POSTGRES_HOST")
|
|
if host == "" {
|
|
host = defaultPostgresHost
|
|
}
|
|
dsn := fmt.Sprintf(
|
|
"postgres://%s:%s@%s:5432/%s?timezone=UTC&require_auth=scram-sha-256",
|
|
getEnv("POSTGRES_USER"),
|
|
getEnv("POSTGRES_PASSWORD"),
|
|
host,
|
|
getEnv("POSTGRES_DB"),
|
|
)
|
|
pool, err := pgxpool.New(context.Background(), dsn)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
Service = newBaseService(pool)
|
|
return testDB(pool)
|
|
}
|
|
|
|
func testDB(pool *pgxpool.Pool) error {
|
|
var n int
|
|
err := pool.QueryRow(context.Background(), "SELECT 1").Scan(&n)
|
|
if err != nil || n != 1 {
|
|
return fmt.Errorf("db test failed: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func getEnv(key string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
// Return empty string instead of fatal error - allows tests to run without prod env vars
|
|
return ""
|
|
}
|