popertots
7439fa86c1
R1/R4: saved_card branch in CreateTerminalPayment now mirrors CreateTipPayment - advisory lock (crussell:payment:<bookingID>) serializes concurrent double-clicks - deterministic key bookingID-sc-type-amount-cardID (<=45 chars) so a lost-response retry derives the same key and dedups instead of double-charging - idempotency switch inside the lock: completed -> dedup, pending -> reuse with pence amount-guard, failed -> clean 409 - success response includes card_brand/card_last4 (frontend already reads them) R2: add 'failed' case to all four retry switches (tip, booking, gift card, till) - a swept/definitively-rejected record returns 409 instead of 500-ing on the idempotency_key UNIQUE constraint R3: extend SweepStalePendingPayments to till_sales card rows - sweeps pending till_sales (online_square/in_person_card) past Square's ~24h key retention, closing the double-charge window for till sales - swept rows logged with the same CRITICAL manual-reconciliation marker as the refund sweep Webhook fail-closed: reject 503 when SQUARE_WEBHOOK_SIGNATURE_KEY unset, 403 on bad signature (was: skip verification in dev) Refund status resolution: refunds now resolve by Square status (COMPLETED/PENDING/FAILED/REJECTED) instead of assuming completed; real error codes (REFUND_AMOUNT_INVALID, PAYMENT_NOT_REFUNDABLE, REFUND_ALREADY_PENDING) added to the definitive/processed classification HTTP client: CreateCard key truncated to <=45 chars, device_options always sent (env SQUARE_TERMINAL_DEVICE_ID fallback), processing_fee reads amount_money, ListCards cursor loop, refund keys hashed to <=45 chars Other fixes: payment/till/gift-card advisory-lock + FOR UPDATE asymmetries, GetPaymentByID NULL scans, loyalty redemption lock, card upsert on conflict, mock ccof: prefix parity, IsValidSquareCheckoutID for real Square IDs, isAdminRequest defense-in-depth on all 6 admin payment handlers, webhook signature docs, M8/L5 debug markers removed Docs: README/FC/TM/Overview updated (22 jobs, 20 CRITICAL sites, 23-section GDPR export, sweep jobs, webhook fail-closed); P11 plan marks remaining items (sandbox smoke test, M-8 customer_id, saved-card key dedup trade-off) as deferred with rationale; gap backlog pruned of completed items
94 lines
2.0 KiB
Go
94 lines
2.0 KiB
Go
//go:build test
|
|
|
|
package validators
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestIsValidID_ValidHex(t *testing.T) {
|
|
t.Parallel()
|
|
assert.True(t, IsValidID("a1b2c3d4e5f6"))
|
|
}
|
|
|
|
func TestIsValidID_TooShort(t *testing.T) {
|
|
t.Parallel()
|
|
assert.False(t, IsValidID("abc"))
|
|
}
|
|
|
|
func TestIsValidID_TooLong(t *testing.T) {
|
|
t.Parallel()
|
|
assert.False(t, IsValidID("abcdef1234567"))
|
|
}
|
|
|
|
func TestIsValidID_NonHexChars(t *testing.T) {
|
|
t.Parallel()
|
|
assert.False(t, IsValidID("zzzzzzzzzzzz"))
|
|
}
|
|
|
|
func TestIsValidID_Empty(t *testing.T) {
|
|
t.Parallel()
|
|
assert.False(t, IsValidID(""))
|
|
}
|
|
|
|
func TestIsValidID_MixedCase(t *testing.T) {
|
|
t.Parallel()
|
|
assert.True(t, IsValidID("ABCDEF123456"))
|
|
}
|
|
|
|
func TestIsValidID_AllZeros(t *testing.T) {
|
|
t.Parallel()
|
|
assert.True(t, IsValidID("000000000000"))
|
|
}
|
|
|
|
func TestValidate_StructWithJSONTag(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
type withTag struct {
|
|
Name string `json:"name" validate:"required"`
|
|
}
|
|
|
|
err := Validate.Struct(withTag{})
|
|
assert.Error(t, err)
|
|
assert.Contains(t, err.Error(), "name")
|
|
}
|
|
|
|
func TestValidate_StructWithIgnoredTag(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
type withIgnored struct {
|
|
Secret string `json:"-" validate:"required"`
|
|
}
|
|
|
|
err := Validate.Struct(withIgnored{})
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestValidate_ValidStruct(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
type validStruct struct {
|
|
Name string `json:"name" validate:"required"`
|
|
}
|
|
|
|
err := Validate.Struct(validStruct{Name: "hello"})
|
|
assert.NoError(t, err)
|
|
}
|
|
|
|
func TestIsValidSquareCheckoutID_AcceptsRealSquareID(t *testing.T) {
|
|
t.Parallel()
|
|
// Real Square checkout IDs are opaque UUIDs, not local 12-hex DB IDs.
|
|
assert.True(t, IsValidSquareCheckoutID("08YceKh7B3ZqO"))
|
|
assert.True(t, IsValidSquareCheckoutID("a1b2c3d4e5f6"))
|
|
}
|
|
|
|
func TestIsValidSquareCheckoutID_RejectsInvalid(t *testing.T) {
|
|
t.Parallel()
|
|
assert.False(t, IsValidSquareCheckoutID(""))
|
|
assert.False(t, IsValidSquareCheckoutID("../etc/passwd"))
|
|
assert.False(t, IsValidSquareCheckoutID("has spaces"))
|
|
assert.False(t, IsValidSquareCheckoutID("abc")) // too short
|
|
}
|