Money-safety: - Deterministic till idempotency fallback (Square-charging only); cash/on_the_house keep unique keys; £250 till gift-card cap; 45-char key validation - Gift-card admin caps £250/tx + £5,000/day; user buy £500/day; BuyGiftCard allowlist unchanged - CancelGiftCard: CCR 2013 14-day right with partial-spend refund of the unspent balance (spend verified via payments.gift_card_id); atomic vs redeem/transfer; refunds stay pending until reversal commits; admin cancel surface (AdminCancelGiftCard) - Sweep: cancelled-booking charges failed+notified instead of silently completed; source-override replay uses live square_source_id; legacy square-less refund sweep; snapshot refresh on pending reuse - Refund lock consolidation; recordTerminalPaymentTx shared recorder; structured Square error codes; terminal checkout CustomerID GDPR / security: - Notes retained as de-identified medical/safety record at erasure (single field treated as health data; rest of record wiped, no re-identification map) + comments updated per UK GDPR/Art 9/Equality Act 2010 - square_request_snapshot PII scrubbed on all erasure paths; delete_guest_user FK unlinks; verification codes + dispute reasons handled; idle/stale-guest erasure deletes Square cards/customers + CardDAV/R2 - Durable square-erasure outbox job (retry-square-erasures); 2FA dev/prod build split, pepper fail-closed, no prod code-in-log; prod 2FA delivery fail-loud without a channel - Webhook unknown-type family split (non-money acked, money retried); untracked dispute notifications; rate-limit CF/X-Real-IP trust gating; nginx CSP nonce + api_limit Frontend: - Dynamic z-index stack (ui/dialog/zindex.ts) claimed in open order via data-state observer; re-claims on every reopen; removes stale !z-* overrides — nested modals (booking→user→booking) always paint newest-on-top (browser-verified 3-level + reopen) - Mobile: iOS zoom fixes, bottom-sheet dialogs, 44px touch targets, inputmode decimal, dvh - Gift-card buy/cancel UI, admin £250 + daily limits, cancellation/privacy/terms policy accuracy S3: - Connect() creates buckets before probing; in-memory fallback only on genuine unreachability; health reports degraded; stale S3_PUBLIC_URL documented (host-specific) Tests/docs: - 2263 test functions; all 22 backend packages green; round8/9/10 regression suites; NextEditWindowTime removes wall-clock flake; docs reconciled (notes retention, gift-card partial-use, modal T15 future work)
91 lines
2.5 KiB
Go
91 lines
2.5 KiB
Go
//go:build !dev
|
|
|
|
package s3
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"log"
|
|
"os"
|
|
)
|
|
|
|
var Client Uploader
|
|
|
|
// FallbackToInMemory mirrors the dev-build flag so main.go can reference it
|
|
// in non-dev builds. It is always false here: the production/R2 build never
|
|
// uses the in-memory fallback client.
|
|
var FallbackToInMemory bool
|
|
|
|
type Uploader interface {
|
|
Upload(ctx context.Context, bucket, key string, body io.Reader, contentType string) error
|
|
Download(ctx context.Context, bucket, key string, w io.Writer) error
|
|
Delete(ctx context.Context, bucket, key string) error
|
|
GetURL(ctx context.Context, bucket, key string) (string, error)
|
|
HealthCheck(ctx context.Context) error
|
|
}
|
|
|
|
type S3Client struct {
|
|
bucket string
|
|
endpoint string
|
|
region string
|
|
accessKey string
|
|
secretKey string
|
|
publicURL string
|
|
}
|
|
|
|
func Connect() error {
|
|
endpoint := os.Getenv("R2_ENDPOINT")
|
|
if endpoint == "" {
|
|
log.Println("WARNING: R2_ENDPOINT not set, S3 client not initialized")
|
|
return nil
|
|
}
|
|
|
|
Client = &S3Client{
|
|
endpoint: endpoint,
|
|
bucket: getEnv("R2_BUCKET", ""),
|
|
region: getEnv("AWS_REGION", "auto"),
|
|
accessKey: getEnv("R2_ACCESS_KEY", ""),
|
|
secretKey: getEnv("R2_SECRET_KEY", ""),
|
|
publicURL: getEnv("R2_PUBLIC_URL", ""),
|
|
}
|
|
|
|
log.Printf("Connected to R2: bucket=%s, endpoint=%s", Client.(*S3Client).bucket, endpoint)
|
|
return nil
|
|
}
|
|
|
|
func (s *S3Client) Upload(ctx context.Context, bucket, key string, body io.Reader, contentType string) error {
|
|
return fmt.Errorf("not implemented: production S3 upload requires AWS SDK v2 (use RUSTFS in dev)")
|
|
}
|
|
|
|
func (s *S3Client) Download(ctx context.Context, bucket, key string, w io.Writer) error {
|
|
return fmt.Errorf("not implemented: production S3 download requires AWS SDK v2 (use RUSTFS in dev)")
|
|
}
|
|
|
|
func (s *S3Client) Delete(ctx context.Context, bucket, key string) error {
|
|
return fmt.Errorf("not implemented: production S3 delete requires AWS SDK v2 (use RUSTFS in dev)")
|
|
}
|
|
|
|
func (s *S3Client) GetURL(ctx context.Context, bucket, key string) (string, error) {
|
|
return fmt.Sprintf("%s/%s/%s", s.publicURL, bucket, key), nil
|
|
}
|
|
|
|
func (s *S3Client) HealthCheck(_ context.Context) error {
|
|
if s.endpoint == "" {
|
|
return fmt.Errorf("S3 client not initialized: R2_ENDPOINT not set")
|
|
}
|
|
// Production stub — can't perform a real check without the SDK.
|
|
// Actual operations (Upload, Download, Delete) will return errors.
|
|
return nil
|
|
}
|
|
|
|
func getEnv(key, fallback string) string {
|
|
if val := os.Getenv(key); val != "" {
|
|
return val
|
|
}
|
|
if fallback != "" {
|
|
return fallback
|
|
}
|
|
panic("Environment variable not set: " + key)
|
|
}
|