popertots a6a4683b74 fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment ...

Three fresh reviews (money/security/dup-mod) cross-validated findings:
- MEDIUM: B1 'new charge' discrimination adds a lower-bound tolerance (replayRescueLowerBoundSkew) so a retained-key replay of the ORIGINAL charge (DB clock ahead of Square) is never auto-refunded; ambiguous margins leave PENDING + CRITICAL
- MEDIUM: B1 re-poll escalates after stalePendingB1RefundAge (48h) — FAILED/REJECTED refunds go terminal (fail parent, claw back till-sale funding, CRITICAL notification); no more unbounded re-polling / stranded parents without webhooks
- DRIFT-REAL: processManualPaymentGroup now checks PENDING/FAILED/REJECTED on the synchronous refund response (mirrors processChargeGroup/manual handler) — no more premature 'completed'
- HIGH: refresh-token family kill now also invalidates the attacker's freshly-minted ACCESS token — access tokens carry a family_id claim and VerifyToken rejects tokens whose family was deleted (GenerateTokenForFamily + family-alive check); 30s grace window for concurrent two-tab refresh (no false theft alert)
- LOW: 2FA mint endpoint returns remaining_seconds; in-memory 2FA counters documented; 90-day refresh expiry single-sourced (RefreshTokenLifetime + make_interval)
- Dup/mod: NEW shared useTwoFactorCodeForSavedCard Svelte composable replaces 6 surface copies of the 2FA gate logic (Request-a-new-code added to BookingFlow + TillPurchases); account page adopts generateUUID
- Test architecture: removed t.Parallel() from 8 global-SquareClient-swapping tests per Testing Architecture doc line 89 (B1 flaky-test lesson) — fixes within-package race
- SQL alias pence rename (total_cents/paid_cents -> total_pence/paid_pence)

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

2026-08-22 00:34:50 +01:00

..

adversarial_attack_test.go

fix: comprehensive payment system hardening (4 review passes)

2026-08-22 00:34:49 +01:00

charge_helpers_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

charge_helpers.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

completion.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

concurrency_test.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

discount_preview_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

discounts.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

dst_timezone_test.go

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

errors_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

errors.go

fix: review round 6 — P0 deposit charge, idempotency rotation, dev-safety guard, 2FA/webhook hardening

2026-08-22 00:34:49 +01:00

giftcard_clawback.go

fix: review round 4 — per-dispute chargeback alerts, single-source clawback, 2FA lockout coherence, docs

2026-08-22 00:34:49 +01:00

giftcard_limits.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

giftcards_test.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

giftcards.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

guest_payment_block_test.go

Block guest-role tokens from online payment routes (RequireNonGuest middleware)

2026-08-22 00:34:49 +01:00

handlers.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

idempotency_helpers.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

locks_test.go

Add bounded advisory-lock helper; convert loyalty redemption to try-lock

2026-08-22 00:34:49 +01:00

locks.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

loop_b_fixes_test.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

loyalty_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

loyalty.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

m4_tip_refund_redesign_test.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

m5_fully_paid_completion_test.go

fix: tip double-count, fully-paid auto-completion, discount-refund hardening

2026-08-22 00:34:49 +01:00

money_safety_fixes_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

p14_payment_fixes_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

payment_status_test.go

Expand payment remediation test coverage

2026-08-22 00:34:49 +01:00

payments_fixes_test.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

payments_r6_review_test.go

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

payments_review_fixes_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

payments_round7_test.go

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

payments_round8_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

payments_round9_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

payments_round10_test.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

payments_test.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

refund_exclude_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

refund_policy.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

refunds_test.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

refunds.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

save_card_verified_test.go

Block card saving for unverified accounts at the charge-handler level

2026-08-22 00:34:49 +01:00

service.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

sweep_test.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

sweep.go

fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

2026-08-22 00:34:50 +01:00

testmain_test.go

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

till_test.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

till.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

twofa_test.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

twofa.go

fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

2026-08-22 00:34:50 +01:00

validators_test.go

Expand payment test coverage: lock contention, nonce-direct, provisional rows, GDPR scrub, validators

2026-08-22 00:34:49 +01:00

validators.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

vat_test.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

vat.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00