mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
73b7290e7f
Square keeps an event's created_at across every retry, and the receiver refused anything older than five minutes, so every retry of an event first sent while cloud was down (Recreate, ten rollouts a day) was refused until Square gave up. The verifier now lives in payment/providers/square and needs only the key and the URL; thirdparty/square is the API client and no longer registers itself or verifies anything, so every registry holds one Square type. Replay is stopped by the event id instead: each verified event is recorded once for the whole deployment, keyed on the verifying processor and the event id with an insert-if-absent swap, so a repeat is a duplicate under any path or org. The path names the one processor that verifies, and only one that holds its webhook secret may: an unknown name, or a verifier that needs no secret, is refused rather than tried. The books an event lands in are the verifying account's, else the deployment's brand — never a header or session, which on a replay are the replayer's. An effect that did not land (a store or the ledger did not answer) leaves the delivery open with a 503, so the provider redelivers; it used to be acknowledged and never retried. A settlement reads the payment index before the org's books, because an in-session charge's receipt is in the payer's org. POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so standalone and embedded commerce serve the same address; the /v1/billing/webhooks spelling is gone. thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer serves, and was off in production anyway, so per-org payment credentials never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through the host's reader, the caller re-pointed at that org with zip.ActingAs so the KMS tenancy check admits it, and payment.Hydrate loads an org's credentials where the org receives the money: storefront checkout, storefront subscriptions and wire, and the brand's bank for the billing wire rail. Hanzo's own billing no longer reads the paying org's credentials; it charges the deployment's account, as it did. The standalone binary reads through hanzoai/kms/sdk/go.
122 lines
4.1 KiB
Go
122 lines
4.1 KiB
Go
// Copyright (c) 2014-present Hanzo AI, Inc.
|
|
// Licensed under MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
|
|
|
|
package payment
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/zap-proto/zip"
|
|
|
|
"github.com/hanzoai/commerce/models/organization"
|
|
"github.com/hanzoai/commerce/payment/processor"
|
|
"github.com/hanzoai/commerce/payment/providers/square"
|
|
"github.com/hanzoai/commerce/secrets"
|
|
)
|
|
|
|
// tenancyStore is the host's secret plane with cloud's tenancy rule (apps/kms
|
|
// admit): orgs/<org>/… is served only to a call acting for <org>.
|
|
type tenancyStore struct {
|
|
values map[string]string
|
|
asked []string
|
|
}
|
|
|
|
func (s *tenancyStore) GetSecret(ctx context.Context, ref string) ([]byte, error) {
|
|
s.asked = append(s.asked, ref)
|
|
rest, ok := strings.CutPrefix(ref, "orgs/")
|
|
if !ok {
|
|
return nil, errors.New("not a tenant ref")
|
|
}
|
|
if org, _, _ := strings.Cut(rest, "/"); zip.CallerOf(ctx).Org != org {
|
|
return nil, errors.New("refused: the call does not act for " + org)
|
|
}
|
|
if v, ok := s.values[ref]; ok {
|
|
return []byte(v), nil
|
|
}
|
|
return nil, errors.New("no such secret")
|
|
}
|
|
|
|
func withStore(t *testing.T, s *tenancyStore) {
|
|
t.Helper()
|
|
prev := secrets.Get()
|
|
secrets.Set(s)
|
|
t.Cleanup(func() { secrets.Set(prev) })
|
|
}
|
|
|
|
// A per-org Square credential loads: what the org holds at
|
|
// orgs/<org>/square/<NAME> reaches its integration fields, and from there the
|
|
// processor its registry charges with — on a request sent by someone else.
|
|
func TestHydrateLoadsTheOrgsOwnSquareCredential(t *testing.T) {
|
|
ensureDefaultProcessorPolicy(t)
|
|
s := &tenancyStore{values: map[string]string{
|
|
"orgs/acme/square/SQUARE_SANDBOX_ACCESS_TOKEN": "sb-acme-token",
|
|
"orgs/acme/square/SQUARE_SANDBOX_LOCATION_ID": "LOC-ACME",
|
|
"orgs/acme/square/SQUARE_SANDBOX_APPLICATION_ID": "sandbox-sq0idb-acme",
|
|
}}
|
|
withStore(t, s)
|
|
t.Setenv("SQUARE_SANDBOX_ACCESS_TOKEN", "deployment-token")
|
|
t.Setenv("SQUARE_SANDBOX_LOCATION_ID", "DEPLOYMENT-LOC")
|
|
|
|
org := &organization.Organization{Name: "acme"} // not Live: sandbox
|
|
shopper := zip.WithCaller(context.Background(), zip.Caller{Org: "someone-else", User: "bob"})
|
|
Hydrate(shopper, org)
|
|
|
|
if org.Square.Sandbox.AccessToken != "sb-acme-token" || org.Square.Sandbox.LocationId != "LOC-ACME" {
|
|
t.Fatalf("acme's credential did not load: %+v (asked %v)", org.Square.Sandbox, s.asked)
|
|
}
|
|
p, err := ProcessorsForOrg(org).Get(processor.Square)
|
|
if err != nil {
|
|
t.Fatalf("no Square processor for a hydrated org: %v", err)
|
|
}
|
|
if sp := p.(*square.Provider); sp.LocationID() != "LOC-ACME" || sp.ApplicationID() != "sandbox-sq0idb-acme" {
|
|
t.Fatalf("the registry charges location %q app %q, want acme's own, not the deployment's", sp.LocationID(), sp.ApplicationID())
|
|
}
|
|
for _, ref := range s.asked {
|
|
if !strings.HasPrefix(ref, "orgs/acme/") {
|
|
t.Fatalf("hydrating acme asked for %q", ref)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Narrowed to one provider, the read asks for that provider's names only.
|
|
func TestHydrateNarrowsToTheProvidersAskedFor(t *testing.T) {
|
|
s := &tenancyStore{values: map[string]string{
|
|
"orgs/hanzo/wire/WIRE_ACCOUNT_NUMBER": "000123456789",
|
|
"orgs/hanzo/wire/WIRE_BANK_NAME": "Bank",
|
|
}}
|
|
withStore(t, s)
|
|
org := &organization.Organization{Name: "hanzo"}
|
|
payer := zip.WithCaller(context.Background(), zip.Caller{Org: "acme", User: "alice"})
|
|
Hydrate(payer, org, "wire")
|
|
if org.Wire.AccountNumber != "000123456789" || org.Wire.BankName != "Bank" {
|
|
t.Fatalf("wire did not load: %+v", org.Wire)
|
|
}
|
|
for _, ref := range s.asked {
|
|
if !strings.HasPrefix(ref, "orgs/hanzo/wire/") {
|
|
t.Fatalf("a wire-only hydrate asked for %q", ref)
|
|
}
|
|
}
|
|
if len(s.asked) != 9 {
|
|
t.Fatalf("asked %d wire names, want the 9 the wire set holds", len(s.asked))
|
|
}
|
|
}
|
|
|
|
func TestHydrateWithNoOrgOrNoReaderReadsNothing(t *testing.T) {
|
|
s := &tenancyStore{values: map[string]string{}}
|
|
withStore(t, s)
|
|
Hydrate(context.Background(), nil)
|
|
Hydrate(context.Background(), &organization.Organization{})
|
|
if len(s.asked) != 0 {
|
|
t.Fatalf("asked %v for no org", s.asked)
|
|
}
|
|
secrets.Set(nil)
|
|
org := &organization.Organization{Name: "acme"}
|
|
Hydrate(context.Background(), org)
|
|
if org.Square.Production.AccessToken != "" {
|
|
t.Fatal("a commerce with no reader loaded a credential")
|
|
}
|
|
}
|