Drop off_session from the initial PaymentIntent so the checkout charge is a Customer-Initiated Transaction (the customer is present in the TUI), not a Merchant-Initiated Transaction. MIT exemptions require a stored mandate we never capture; as a CIT, an SCA challenge surfaces as status=requires_action, the path the handler already had. The re-confirm in respondRequiresAction and the authentication_required error branch remain as defensive fallbacks. Source: stripe-samples accept-a-payment custom-payment-flow (no off_session on customer-present confirms).
Also clarify the MAX_ORDER_CENTS TRA-ceiling anchor comment as an approximate USD/EUR figure (config.go), and carry an unrelated 1-line spend-limit input width fix in pkg/tui/account.go.
Tests: add paymentIntentNewFn stub seam, TestConvertCartIsCustomerInitiated (asserts no off_session) and TestConvertCartRequiresAction (202 + redirect + audit row).
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Spend-limit input now takes dollars (e.g. 25.50) instead of raw cents.
Parsed to integer cents as dollars*100 + cents (no float multiply) so an
amount like 50.01 never loses a cent to binary rounding; the persisted
column and API still use cents. Current limit and prefill render via
formatCentsDollars. Tests updated to the dollar grammar.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat(sca): add per-user spend cap override
* feat(sca): add admin endpoint to set per-user order cap
- PATCH /api/v1/users/{id}/order-cap (RequireAdmin / X-Admin-Key) sets or
clears User.MaxOrderCents; null clears (revert to global), >=0 sets,
negative rejected 400 INVALID_CAP at the write boundary
- harden ConvertCart: a negative override falls back to the global cap with
a slog.Warn (mirrors loadMaxOrderCents) so a bad DB write cannot silently
void the fraud control
- emit user_order_cap_set audit event (set/cleared)
- tests: admin handler table + RequireAdmin gate router test + negative
read-path fallback case
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs(api): drop orphan comment referencing nonexistent request struct
The paragraph above SetUserOrderCap documented a setUserOrderCapRequest
struct that does not exist; the handler decodes into a raw map instead.
The raw-map rationale already lives inline at the decode site.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* refactor(sca): thread context.Context through reconciler entry points
* test(sca): add mid-loop cancel test for stale 3ds sweep
* refactor(api): rename shutdown ctx to shutdownCtx for clarity
* style(sca): fix typo in ReconcileUnshipped commend
* feat(audit): emit cart_rejected event when per-order cap blocks checkout
* refactor(audit): drop dead persist call + harden cart_rejected test capture
* feat(sca): sweep abandoned 3ds requires_action orders to failed
* fix(sca): address pr review on abandoned 3ds sweep
- Drop stripe.Key write in ReconcileStale3DSOrders; wire once in api/main.go after cfg.Load so concurrent reconcilers don't
race the SDK global.
- Add empty-PI short-circuit before paymentintent.Get to bury a future regression in a slog.Warn instead of a Stripe 4xx.
- Swap fmt.Printf for slog.Warn with k/v attrs in loadAbandoned3DSThresholdMinutes so Loki sees structured fields instead of
literal %q/%d.
- Comment the updated_at predicate (RetryAuth bumps it via GORM auto-stamp, intentional grace-window extension) + the
conditional-UPDATE/map-form choice.
- Tests: processing/requires_capture skip, unknown-status skip, stripe-error skip, empty-PI skip, full env-parse table for
loadAbandoned3DSThresholdMinutes.
* fix(stripe): wire key once at init drop per-call writes
* refactor(stripe): drop dead stripeKey fields and pre-call sdk params
* fix(products): update pricing on products
* fix(test): pin coffee price in cart-limit fixture
TestConvertCartLimit's quantities and expected totals were keyed to
the original 500-cent latte price. After the product price bump in
1ce63fb, coffee_id=4 became 2500 cents, so under_cap/at_cap subtests
overshot the $200 cap and over_cap's expected total magnitude was
wrong by 5x. Override coffee_id=4's price to 500 in test setup so the
cap math stays stable regardless of seed changes.
* feat(sca): add retry-auth endpoint for failed 3ds challenges
* fix(sca): retry-auth unexpected-state branch out of card-decline
just fixes up in some of the things the review of the last commit
noticed
* feat(sca): expire inactive saved cards
* fix(sca): address card ttl review feedback
- Correct sql typos breaking GET /cards and /view/init (used_id, id_default)
- Stop swallowing backfillCardStorageExpiration error in Migrate
- Wrap expireStoredCard local writes in a transaction and run stripe
detach + audit only after commit, preventing double-fire on retry
- Drop redundant ttl refresh in ConvertCart; webhook is authoritative
- Rename validation_expired_at metric label to validation_card_expired
- Fix CardStorageExpiresAt doc comment and test failure message typos
- Add handler-level tests for expireStoredCards (user scoping + cart deref)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(sca): move card expiration to periodic reconciler
Read paths (GetCards, GetViewInit) now filter expired cards from
query results instead of detaching them inline, so request handlers
no longer block on Stripe API calls. Physical deletion runs in a
new ReconcileExpiredCards goroutine on an hourly ticker, mirroring
the existing ReconcileOrders / ReconcileUnshipped jobs. Per-card
action sites (SetCard, SetDefaultCard, ConvertCart) still expire
synchronously since they operate on one row the user is acting on.
ViewHandler's stripeKey dependency is dropped now that GetViewInit
no longer touches Stripe.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(sca): address card ttl review feedback
- guard zero order.CardID before refreshing card storage ttl in
payment_intent.succeeded webhook to avoid noisy warn logs on payment
paths that did not use a saved card
- delete unused Card.RefreshStorageTTL model method; the SQL-only
refreshCardStorageTTL helper is the single canonical path
- clarify duplicate-card webhook path: storage_expires_at reset is a
card-add refresh, not a payment-success refresh, so last_used_at
intentionally stays untouched
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(sca): cover card ttl read paths and expired-card sync sites
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(sca): add order status endpoint adn SCA error code mapping
adds server-side infra for the upcoming SCA / 3DS challenge flow im
working on. No behavior change to existing checkout paths.
* fix(sca): suppress unused lint on SCA scaffolding helpers
