mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
73b7290e7f
Square keeps an event's created_at across every retry, and the receiver refused anything older than five minutes, so every retry of an event first sent while cloud was down (Recreate, ten rollouts a day) was refused until Square gave up. The verifier now lives in payment/providers/square and needs only the key and the URL; thirdparty/square is the API client and no longer registers itself or verifies anything, so every registry holds one Square type. Replay is stopped by the event id instead: each verified event is recorded once for the whole deployment, keyed on the verifying processor and the event id with an insert-if-absent swap, so a repeat is a duplicate under any path or org. The path names the one processor that verifies, and only one that holds its webhook secret may: an unknown name, or a verifier that needs no secret, is refused rather than tried. The books an event lands in are the verifying account's, else the deployment's brand — never a header or session, which on a replay are the replayer's. An effect that did not land (a store or the ledger did not answer) leaves the delivery open with a 503, so the provider redelivers; it used to be acknowledged and never retried. A settlement reads the payment index before the org's books, because an in-session charge's receipt is in the payer's org. POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so standalone and embedded commerce serve the same address; the /v1/billing/webhooks spelling is gone. thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer serves, and was off in production anyway, so per-org payment credentials never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through the host's reader, the caller re-pointed at that org with zip.ActingAs so the KMS tenancy check admits it, and payment.Hydrate loads an org's credentials where the org receives the money: storefront checkout, storefront subscriptions and wire, and the brand's bank for the billing wire rail. Hanzo's own billing no longer reads the paying org's credentials; it charges the deployment's account, as it did. The standalone binary reads through hanzoai/kms/sdk/go.
123 lines
4.1 KiB
Go
123 lines
4.1 KiB
Go
package billing
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/zap-proto/zip"
|
|
|
|
"github.com/hanzoai/commerce/secrets"
|
|
"github.com/hanzoai/commerce/util/test/ae"
|
|
)
|
|
|
|
// wireReference must survive a bank memo field: uppercase [A-Z0-9-] only, and
|
|
// distinct payers must stay distinct after the trip (reconciliation depends on
|
|
// recovering the payer from exactly this alphabet).
|
|
func TestWireReference(t *testing.T) {
|
|
cases := []struct{ payer, want string }{
|
|
{"hanzo", "TOPUP-HANZO"},
|
|
{"hanzo/z", "TOPUP-HANZO-Z"},
|
|
{"acme-labs/alice.b", "TOPUP-ACME-LABS-ALICE-B"},
|
|
{"org_1", "TOPUP-ORG-1"},
|
|
}
|
|
for _, tc := range cases {
|
|
if got := wireReference(tc.payer); got != tc.want {
|
|
t.Errorf("wireReference(%q) = %q, want %q", tc.payer, got, tc.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
// brandStore is the host's secret plane with cloud's tenancy rule: orgs/<org>/…
|
|
// answers only a call acting for <org>.
|
|
type brandStore map[string]string
|
|
|
|
func (s brandStore) GetSecret(ctx context.Context, ref string) ([]byte, error) {
|
|
rest, ok := strings.CutPrefix(ref, "orgs/")
|
|
if !ok {
|
|
return nil, errors.New("not a tenant ref")
|
|
}
|
|
if org, _, _ := strings.Cut(rest, "/"); zip.CallerOf(ctx).Org != org {
|
|
return nil, errors.New("refused: the call acts for another org")
|
|
}
|
|
if v, ok := s[ref]; ok {
|
|
return []byte(v), nil
|
|
}
|
|
return nil, errors.New("no such secret")
|
|
}
|
|
|
|
// The brand that owns the host is where the wire is sent, so a customer of any
|
|
// org paying on pay.lux.network reads lux's bank and one on pay.hanzo.ai reads
|
|
// Hanzo's — each from orgs/<brand>/wire, asked as the brand, whoever is asking.
|
|
func TestWireForReadsTheBrandsOwnBank(t *testing.T) {
|
|
ctx := ae.NewContext()
|
|
defer ctx.Close()
|
|
webhookOrg(t, ctx, "hanzo", true)
|
|
webhookOrg(t, ctx, "lux", true)
|
|
prev := secrets.Get()
|
|
secrets.Set(brandStore{
|
|
"orgs/hanzo/wire/WIRE_ACCOUNT_NUMBER": "000488108457",
|
|
"orgs/hanzo/wire/WIRE_BANK_NAME": "Hanzo Bank",
|
|
"orgs/lux/wire/WIRE_ACCOUNT_NUMBER": "000999900001",
|
|
"orgs/lux/wire/WIRE_BANK_NAME": "Lux Bank",
|
|
})
|
|
t.Cleanup(func() { secrets.Set(prev) })
|
|
|
|
payer := zip.WithCaller(ctx, zip.Caller{Org: "acme", User: "alice"})
|
|
for host, want := range map[string]string{"pay.hanzo.ai": "000488108457", "pay.lux.network": "000999900001"} {
|
|
w, err := WireFor(payer, host, "acme/alice")
|
|
if err != nil {
|
|
t.Fatalf("%s: %v", host, err)
|
|
}
|
|
if w.AccountNumber != want || w.Reference != "TOPUP-ACME-ALICE" {
|
|
t.Fatalf("%s: account %q reference %q, want %q and the payer's reference", host, w.AccountNumber, w.Reference, want)
|
|
}
|
|
}
|
|
}
|
|
|
|
// A brand with no bank in its secrets has nowhere to send the money: one refusal.
|
|
func TestWireForWithNoBankRefuses(t *testing.T) {
|
|
ctx := ae.NewContext()
|
|
defer ctx.Close()
|
|
webhookOrg(t, ctx, "hanzo", true)
|
|
prev := secrets.Get()
|
|
secrets.Set(brandStore{})
|
|
t.Cleanup(func() { secrets.Set(prev) })
|
|
if _, err := WireFor(ctx, "pay.hanzo.ai", "acme/alice"); !IsWireUnconfigured(err) {
|
|
t.Fatalf("err = %v, want the wire rail's one refusal", err)
|
|
}
|
|
}
|
|
|
|
// GET /v1/billing/wire, through the handler: the request's caller reaches the
|
|
// host's KMS (Forward), so a customer of acme paying on pay.hanzo.ai reads
|
|
// Hanzo's bank.
|
|
func TestWireEndpointReadsTheBrandsBankAsTheCaller(t *testing.T) {
|
|
ctx := ae.NewContext()
|
|
defer ctx.Close()
|
|
webhookOrg(t, ctx, "hanzo", true)
|
|
acme := webhookOrg(t, ctx, "acme", true)
|
|
prev := secrets.Get()
|
|
secrets.Set(brandStore{
|
|
"orgs/hanzo/wire/WIRE_ACCOUNT_NUMBER": "000488108457",
|
|
"orgs/hanzo/wire/WIRE_BANK_NAME": "Hanzo Bank",
|
|
})
|
|
t.Cleanup(func() { secrets.Set(prev) })
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/v1/billing/wire", nil)
|
|
req.Host = "pay.hanzo.ai"
|
|
req.Header.Set(zip.HeaderOrg, "acme")
|
|
req.Header.Set(zip.HeaderUser, "alice")
|
|
resp := driveSeeded(func(c *zip.Ctx) {
|
|
c.SetContext(ctx)
|
|
c.Locals("organization", acme)
|
|
}, "/v1/billing/wire", req, GetBillingWireInstructions)
|
|
raw, _ := io.ReadAll(resp.Body)
|
|
if resp.StatusCode != http.StatusOK || !strings.Contains(string(raw), "000488108457") {
|
|
t.Fatalf("GET /v1/billing/wire = %d %s, want Hanzo's bank", resp.StatusCode, raw)
|
|
}
|
|
}
|