mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
73b7290e7f
Square keeps an event's created_at across every retry, and the receiver refused anything older than five minutes, so every retry of an event first sent while cloud was down (Recreate, ten rollouts a day) was refused until Square gave up. The verifier now lives in payment/providers/square and needs only the key and the URL; thirdparty/square is the API client and no longer registers itself or verifies anything, so every registry holds one Square type. Replay is stopped by the event id instead: each verified event is recorded once for the whole deployment, keyed on the verifying processor and the event id with an insert-if-absent swap, so a repeat is a duplicate under any path or org. The path names the one processor that verifies, and only one that holds its webhook secret may: an unknown name, or a verifier that needs no secret, is refused rather than tried. The books an event lands in are the verifying account's, else the deployment's brand — never a header or session, which on a replay are the replayer's. An effect that did not land (a store or the ledger did not answer) leaves the delivery open with a 503, so the provider redelivers; it used to be acknowledged and never retried. A settlement reads the payment index before the org's books, because an in-session charge's receipt is in the payer's org. POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so standalone and embedded commerce serve the same address; the /v1/billing/webhooks spelling is gone. thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer serves, and was off in production anyway, so per-org payment credentials never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through the host's reader, the caller re-pointed at that org with zip.ActingAs so the KMS tenancy check admits it, and payment.Hydrate loads an org's credentials where the org receives the money: storefront checkout, storefront subscriptions and wire, and the brand's bank for the billing wire rail. Hanzo's own billing no longer reads the paying org's credentials; it charges the deployment's account, as it did. The standalone binary reads through hanzoai/kms/sdk/go.
68 lines
2.7 KiB
Go
68 lines
2.7 KiB
Go
package commerce
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/hanzoai/commerce/billing/depositledger"
|
|
)
|
|
|
|
// TestBootstrapDoesNotStartTheDepositWatcher pins the separation this change
|
|
// exists for: Bootstrap BUILDS the app, it does not RUN it.
|
|
//
|
|
// The watcher was the one background schedule that broke that rule, and the
|
|
// breakage was not academic. cmd/grant and cmd/backfill-events are one-shot
|
|
// tools that call Bootstrap purely for the DB wiring, do work, and exit without
|
|
// ever calling Shutdown — so each of them started a chain scan that writes
|
|
// ledger credits and then died in the middle of a pass. Neither wants a money
|
|
// mover; neither asked for one.
|
|
//
|
|
// The asset table here is deliberately NON-EMPTY, because an empty one would
|
|
// make this vacuous: the watcher would be inert for want of configuration
|
|
// rather than because Bootstrap declined to start it. base/usdc is what the
|
|
// live deployment is actually configured with.
|
|
func TestBootstrapDoesNotStartTheDepositWatcher(t *testing.T) {
|
|
t.Setenv("CRYPTO_DEPOSIT_RPC_BASE", "https://mainnet.base.org")
|
|
t.Setenv("CRYPTO_DEPOSIT_TOKEN_BASE_USDC", "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913")
|
|
|
|
bootTestCommerce(t)
|
|
|
|
svc := depositledger.Default()
|
|
if svc == nil {
|
|
t.Fatal("Bootstrap must install the process-wide watcher so the mint gate has something to ask")
|
|
}
|
|
if !svc.Enabled() {
|
|
t.Fatal("precondition: base/usdc is configured, so the watcher is Enabled")
|
|
}
|
|
if svc.Running() {
|
|
t.Fatal("Bootstrap must NOT start the deposit schedule — a one-shot cmd/ tool that calls Bootstrap would otherwise run a money-moving chain scan and exit mid-pass")
|
|
}
|
|
}
|
|
|
|
// TestBootstrapFailsClosedOnAnIncoherentWatchTable: a token with no endpoint is
|
|
// money nobody is watching. That must stop the boot rather than silently watch
|
|
// less than the operator asked for — and moving Start out of Bootstrap must not
|
|
// have moved this with it, since the table is still PARSED at Bootstrap.
|
|
func TestBootstrapFailsClosedOnAnIncoherentWatchTable(t *testing.T) {
|
|
// A configured token whose chain has no CRYPTO_DEPOSIT_RPC_* endpoint.
|
|
t.Setenv("CRYPTO_DEPOSIT_TOKEN_BASE_USDC", "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913")
|
|
t.Setenv("CRYPTO_DEPOSIT_RPC_BASE", "")
|
|
|
|
dir := t.TempDir()
|
|
cfg := &Config{
|
|
DataDir: dir + "/data", Secret: "test-secret",
|
|
HTTPAddr: "127.0.0.1:0", QueryTimeout: 30e9,
|
|
}
|
|
cfg.IAM.Enabled = false
|
|
t.Setenv("STRIPE_SECRET_KEY", "")
|
|
t.Setenv("COMMERCE_STRIPE_SEED", "false")
|
|
t.Setenv("SQL_URL", "")
|
|
t.Setenv("COMMERCE_DATA_DIR", cfg.DataDir)
|
|
t.Setenv("COMMERCE_BASE_URL", "")
|
|
|
|
app := NewWithConfig(cfg)
|
|
t.Cleanup(func() { _ = app.Shutdown() })
|
|
if err := app.Bootstrap(); err == nil {
|
|
t.Fatal("Bootstrap must refuse a token configured on a chain with no endpoint — that token is money nobody is watching")
|
|
}
|
|
}
|