mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
73b7290e7f
Square keeps an event's created_at across every retry, and the receiver refused anything older than five minutes, so every retry of an event first sent while cloud was down (Recreate, ten rollouts a day) was refused until Square gave up. The verifier now lives in payment/providers/square and needs only the key and the URL; thirdparty/square is the API client and no longer registers itself or verifies anything, so every registry holds one Square type. Replay is stopped by the event id instead: each verified event is recorded once for the whole deployment, keyed on the verifying processor and the event id with an insert-if-absent swap, so a repeat is a duplicate under any path or org. The path names the one processor that verifies, and only one that holds its webhook secret may: an unknown name, or a verifier that needs no secret, is refused rather than tried. The books an event lands in are the verifying account's, else the deployment's brand — never a header or session, which on a replay are the replayer's. An effect that did not land (a store or the ledger did not answer) leaves the delivery open with a 503, so the provider redelivers; it used to be acknowledged and never retried. A settlement reads the payment index before the org's books, because an in-session charge's receipt is in the payer's org. POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so standalone and embedded commerce serve the same address; the /v1/billing/webhooks spelling is gone. thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer serves, and was off in production anyway, so per-org payment credentials never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through the host's reader, the caller re-pointed at that org with zip.ActingAs so the KMS tenancy check admits it, and payment.Hydrate loads an org's credentials where the org receives the money: storefront checkout, storefront subscriptions and wire, and the brand's bank for the billing wire rail. Hanzo's own billing no longer reads the paying org's credentials; it charges the deployment's account, as it did. The standalone binary reads through hanzoai/kms/sdk/go.
96 lines
2.7 KiB
Go
96 lines
2.7 KiB
Go
// Copyright (c) 2014-present Hanzo AI, Inc.
|
|
// Licensed under MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
|
|
commerce "github.com/hanzoai/commerce"
|
|
luxlog "github.com/luxfi/log"
|
|
"github.com/zap-proto/zip"
|
|
"github.com/zap-proto/zip/middleware"
|
|
)
|
|
|
|
// bootCloud serves commerce as a subsystem inside a zip.App per the
|
|
// HIP-0106 unified Hanzo Cloud binary contract. commerce.Mount registers
|
|
// commerce's handlers natively on that app under /v1/commerce + /_/commerce;
|
|
// zip owns the listener.
|
|
//
|
|
// Same artifact runs every white-label deployment — only the gateway and
|
|
// brand differ.
|
|
func bootCloud(dataDir, httpAddr string, dev, requireIdentity bool) error {
|
|
logger := luxlog.New("commerce")
|
|
|
|
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
|
defer stop()
|
|
|
|
// Build the zip.App with the canonical middleware pipeline. Match
|
|
// cmd/cloud/main.go ordering so the cloud-mounted commerce and the
|
|
// in-cloud-binary commerce behave identically at the boundary:
|
|
// Recover → RequestID. The report is the framework's: zip installs it at
|
|
// build, outermost, so it sees the requests no route matched and the ones a
|
|
// later middleware refused. Auth/Telemetry are gateway-owned
|
|
// per the HIP-0026 trust boundary.
|
|
app := zip.New(zip.Config{Logger: logger})
|
|
app.Use(middleware.Recover())
|
|
app.Use(middleware.RequestID())
|
|
|
|
// commerce.Mount boots the embedded server via commerce.Embed, which
|
|
// honors COMMERCE_DIR/HTTPAddr/etc. via DefaultConfig when dataDir is
|
|
// empty. Set the env so the embedded server reads the same shape the
|
|
// legacy boot does; the listener inside Embed stays unused because the
|
|
// zip.App owns the listener.
|
|
_ = os.Setenv("COMMERCE_DIR", dataDir)
|
|
_ = os.Setenv("COMMERCED_REQUIRE_IDENTITY", boolStr(requireIdentity))
|
|
if dev {
|
|
_ = os.Setenv("COMMERCE_DEV", "true")
|
|
}
|
|
|
|
secrets, err := secretReader()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := commerce.Mount(app, dataDir, logger, secrets); err != nil {
|
|
return err
|
|
}
|
|
|
|
listenErr := make(chan error, 1)
|
|
go func() {
|
|
logger.Info("http listener",
|
|
"addr", httpAddr,
|
|
"version", commerce.Version,
|
|
"mode", "cloud",
|
|
)
|
|
if err := app.Listen(httpAddr); err != nil {
|
|
listenErr <- err
|
|
stop()
|
|
}
|
|
}()
|
|
|
|
<-ctx.Done()
|
|
logger.Info("shutting down")
|
|
shutdownCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
|
|
defer cancel()
|
|
if err := app.ShutdownWithContext(shutdownCtx); err != nil {
|
|
return err
|
|
}
|
|
select {
|
|
case err := <-listenErr:
|
|
return err
|
|
default:
|
|
return nil
|
|
}
|
|
}
|
|
|
|
func boolStr(b bool) string {
|
|
if b {
|
|
return "true"
|
|
}
|
|
return "false"
|
|
}
|