mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
73b7290e7f
Square keeps an event's created_at across every retry, and the receiver refused anything older than five minutes, so every retry of an event first sent while cloud was down (Recreate, ten rollouts a day) was refused until Square gave up. The verifier now lives in payment/providers/square and needs only the key and the URL; thirdparty/square is the API client and no longer registers itself or verifies anything, so every registry holds one Square type. Replay is stopped by the event id instead: each verified event is recorded once for the whole deployment, keyed on the verifying processor and the event id with an insert-if-absent swap, so a repeat is a duplicate under any path or org. The path names the one processor that verifies, and only one that holds its webhook secret may: an unknown name, or a verifier that needs no secret, is refused rather than tried. The books an event lands in are the verifying account's, else the deployment's brand — never a header or session, which on a replay are the replayer's. An effect that did not land (a store or the ledger did not answer) leaves the delivery open with a 503, so the provider redelivers; it used to be acknowledged and never retried. A settlement reads the payment index before the org's books, because an in-session charge's receipt is in the payer's org. POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so standalone and embedded commerce serve the same address; the /v1/billing/webhooks spelling is gone. thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer serves, and was off in production anyway, so per-org payment credentials never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through the host's reader, the caller re-pointed at that org with zip.ActingAs so the KMS tenancy check admits it, and payment.Hydrate loads an org's credentials where the org receives the money: storefront checkout, storefront subscriptions and wire, and the brand's bank for the billing wire rail. Hanzo's own billing no longer reads the paying org's credentials; it charges the deployment's account, as it did. The standalone binary reads through hanzoai/kms/sdk/go.
74 lines
2.4 KiB
Go
74 lines
2.4 KiB
Go
// Copyright (c) 2014-present Hanzo AI, Inc.
|
|
// Licensed under MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
// The standalone reader speaks the KMS REST surface as one machine identity: the
|
|
// org's ref orgs/<org>/<path>/<name> is GET /v1/kms/secrets/<path>/<name> with the
|
|
// identity's bearer, and a ref under any other org never leaves the process.
|
|
func TestOrgReaderReadsItsOwnOrg(t *testing.T) {
|
|
var got []string
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/v1/iam/oauth/token":
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"access_token": "tok", "expires_in": 3600})
|
|
default:
|
|
got = append(got, r.URL.Path+"?"+r.URL.RawQuery)
|
|
if r.Header.Get("Authorization") != "Bearer tok" {
|
|
http.Error(w, "no bearer", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"secret": map[string]string{"value": "LOC-ACME"}})
|
|
}
|
|
}))
|
|
defer srv.Close()
|
|
t.Setenv("KMS_URL", srv.URL)
|
|
t.Setenv("HANZO_IAM_URL", srv.URL)
|
|
t.Setenv("KMS_CLIENT_ID", "acme-commerce")
|
|
t.Setenv("KMS_CLIENT_SECRET", "s")
|
|
t.Setenv("KMS_ORG", "acme")
|
|
|
|
rd, err := secretReader()
|
|
if err != nil || rd == nil {
|
|
t.Fatalf("secretReader: %v", err)
|
|
}
|
|
v, err := rd.GetSecret(context.Background(), "orgs/acme/square/SQUARE_SANDBOX_LOCATION_ID")
|
|
if err != nil || string(v) != "LOC-ACME" {
|
|
t.Fatalf("read = %q, %v", v, err)
|
|
}
|
|
if len(got) != 1 || got[0] != "/v1/kms/secrets/square/SQUARE_SANDBOX_LOCATION_ID?env=default" {
|
|
t.Fatalf("asked %v, want the org-relative REST address in the default env", got)
|
|
}
|
|
if _, err := rd.GetSecret(context.Background(), "orgs/other/square/SQUARE_SANDBOX_LOCATION_ID"); err == nil {
|
|
t.Fatal("a ref under another org was read")
|
|
}
|
|
if len(got) != 1 {
|
|
t.Fatalf("a foreign ref reached the server: %v", got)
|
|
}
|
|
}
|
|
|
|
func TestSecretReaderConfiguration(t *testing.T) {
|
|
t.Setenv("KMS_URL", "")
|
|
if rd, err := secretReader(); rd != nil || err != nil {
|
|
t.Fatalf("no KMS_URL: reader %v err %v, want none and no error", rd, err)
|
|
}
|
|
t.Setenv("KMS_URL", "https://kms.example.test")
|
|
t.Setenv("KMS_ORG", "")
|
|
if _, err := secretReader(); err == nil {
|
|
t.Fatal("KMS_URL without KMS_ORG booted")
|
|
}
|
|
t.Setenv("KMS_ORG", "acme")
|
|
t.Setenv("KMS_CLIENT_ID", "")
|
|
if _, err := secretReader(); err == nil {
|
|
t.Fatal("KMS_URL without a client identity booted")
|
|
}
|
|
}
|