popertotsandSisyphus 049c361e16 fix: adminnotify observability — money-critical rows sort first, flood-cap suppression surfaced to operator, stale coordination doc fixed ...

- notifications priority ordering: money-critical reasons (webhooks, sweeps, refunds, gift-card, manual-refund failures) above routine
- admin notifications page exposes the flood-cap suppressed count
- adminnotify.go contract doc: removed stale 2FA reissue-fail site, current insert-site list

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

2026-08-22 00:34:51 +01:00

..

auth

fix: refresh-token reuse grace 60s -> 20s (cross-tab coordinated rotation)

2026-08-22 00:34:50 +01:00

clock

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

db

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

handlers

fix: adminnotify observability — money-critical rows sort first, flood-cap suppression surfaced to operator, stale coordination doc fixed

2026-08-22 00:34:51 +01:00

internal

fix: adminnotify observability — money-critical rows sort first, flood-cap suppression surfaced to operator, stale coordination doc fixed

2026-08-22 00:34:51 +01:00

mw

fix: dev-mock/prod parity + fail-closed config gates — 402 verification, cnon:sca binding validation, refund reconcile parity, SNAPSHOT_ENC_KEY fail-closed, webhook config gates, access-token startup validation, ClientIP validation

2026-08-22 00:34:51 +01:00

testutils

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

.golangci.yml

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

Dockerfile

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

go.mod

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

go.sum

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

main_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

main.go

fix: dev-mock/prod parity + fail-closed config gates — 402 verification, cnon:sca binding validation, refund reconcile parity, SNAPSHOT_ENC_KEY fail-closed, webhook config gates, access-token startup validation, ClientIP validation

2026-08-22 00:34:51 +01:00

run-prod-tag-tests.sh

fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed

2026-08-22 00:34:50 +01:00

run-tests.sh

Fix review findings: aggregated-refund/saved-card/legacy-refund idempotency keys, structured Square error classification, CSP for Square SDK

2026-08-22 00:34:49 +01:00

startup_checks_test.go

fix: dev-mock/prod parity + fail-closed config gates — 402 verification, cnon:sca binding validation, refund reconcile parity, SNAPSHOT_ENC_KEY fail-closed, webhook config gates, access-token startup validation, ClientIP validation

2026-08-22 00:34:51 +01:00

testmain_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00