fix(fix): revert the 10-second ticker to 10m after forgetting to revert it after testing

.gitignore

@@ -7,6 +7,7 @@
 
 docs/sca-psd2-compliance.md
 accept-a-payment/
+codemap/
 
 
 FULFILLMENT.md

api/doc.go

@@ -0,0 +1,3 @@
+// Command api is the HTTP backend: it boots the router, bolts on all the
+// middleware, and answers the requests the TUI throws at it.
+package main

api/handlers/doc.go

@@ -0,0 +1,3 @@
+// Package handlers is where the real work happens, one function per endpoint:
+// carts, orders, products, addresses, cards, webhooks, and the rest.
+package handlers

api/handlers/reconcile.go

@@ -225,6 +225,23 @@ func ReconcileExpiredCards(ctx context.Context) {
 	}
 }
 
+// ReconcilePayRedirects deletes pay_redirects rows whose ExpiresAt had passed.
+// Lazy deletion on read (PayRedirect) is the primary path, this sweep only
+// reclaims tokens nobody ever followed so the table stays bounded.
+func ReconcilePayRedirects(ctx context.Context) {
+	db := database.GetDB().WithContext(ctx)
+
+	res := db.Where("expires_at < ?", time.Now()).Delete(&models.PayRedirect{})
+	if res.Error != nil {
+		reconcileLog().Error("pay_redirects sweep failed", "error", res.Error)
+		return
+	}
+	if res.RowsAffected == 0 {
+		return
+	}
+	reconcileLog().Info("swept expired pay_redirects", "count", res.RowsAffected)
+}
+
 // ReconcileUnshipped finds paid orders older than 24h with no tracking
 // number and posts a single Slack reminder. Pure read + notify.
 func ReconcileUnshipped(ctx context.Context) {

api/handlers/reconcile_test.go

@@ -518,3 +518,81 @@ func seedRequiresActionOrder(t *testing.T, userID uint, piID string, updatedAt t
 	}
 	return order
 }
+
+// TestReconcilePayRedirects_DeleteExpiredKeepsLive verifies the predicate
+// boundary: a row past ExpiresAt is hard-deleted while a row whose ExpiresAt
+// is still in the future survives. Seeding both sides through GORM keeps the
+// stored timestamp format identical to the one the sweep binds for time.Now(),
+// so the comparison is exercised exactly as it runs in production.
+func TestReconcilePayRedirects_DeleteExpiredKeepsLive(t *testing.T) {
+	testDB := setupTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	db := database.GetDB()
+
+	now := time.Now()
+	expired := models.PayRedirect{
+		Token:     "tok_expired",
+		URL:       "https://example.test/expired",
+		Purpose:   models.RedirectPurposeCheckout3DS,
+		CreatedAt: now.Add(-20 * time.Minute),
+		ExpiresAt: now.Add(-10 * time.Minute),
+	}
+
+	live := models.PayRedirect{
+		Token:     "tok_live",
+		URL:       "https://example.test/live",
+		Purpose:   models.RedirectPurposeAddCard,
+		CreatedAt: now,
+		ExpiresAt: now.Add(10 * time.Minute),
+	}
+	if err := db.Create(&expired).Error; err != nil {
+		t.Fatalf("seed expired: %v", err)
+	}
+	if err := db.Create(&live).Error; err != nil {
+		t.Fatalf("seed live: %v", err)
+	}
+
+	ReconcilePayRedirects(context.Background())
+
+	var remaining []models.PayRedirect
+	if err := db.Find(&remaining).Error; err != nil {
+		t.Fatalf("list remaining: %v", err)
+	}
+	if len(remaining) != 1 {
+		t.Fatalf("want 1 row remaining, got %d", len(remaining))
+	}
+	if remaining[0].Token != "tok_live" {
+		t.Fatalf("wrong row survived: want tok_live, got %q", remaining[0].Token)
+	}
+}
+
+func TestReconcilePayRedirects_NoExpiredIsNoOp(t *testing.T) {
+	testDB := setupTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	db := database.GetDB()
+
+	live := models.PayRedirect{
+		Token:     "tok_live_only",
+		URL:       "https://example.test/live",
+		Purpose:   models.RedirectPurposeCheckout3DS,
+		CreatedAt: time.Now(),
+		ExpiresAt: time.Now().Add(10 * time.Minute),
+	}
+	if err := db.Create(&live).Error; err != nil {
+		t.Fatalf("seed live: %v", err)
+	}
+
+	ReconcilePayRedirects(context.Background())
+
+	var count int64
+	if err := db.Model(&models.PayRedirect{}).Count(&count).Error; err != nil {
+		t.Fatalf("count: %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("want 1 row preserved, got %d", count)
+	}
+}

api/handlers/webhook.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -52,8 +53,17 @@ func (h *WebhookHandler) HandleStripe(w http.ResponseWriter, r *http.Request) {
 
 	// Verify the Stripe signature. Reject anything that doesn't match.
 	if h.webhookSecret == "" {
-		// No secret configured — log a loud warning but still process in dev.
-		webhookLog().Warn("stripe webhook secret not set; skipping signature verification")
+		// Fail closed in production. config.validate() requires STRIPE_WEBHOOK_SECRET
+		// in production, so the server should never boot into this state; this is
+		// defense in depth against a misconfigured deploy. Mirrors the Shippo and
+		// Slack handlers, which already refuse to run without their secret.
+		if os.Getenv("ENVIRONMENT") == "production" {
+			webhookLog().Error("stripe webhook secret not set in production; refusing to process event")
+			utils.RespondError(w, http.StatusServiceUnavailable, "WEBHOOK_NOT_CONFIGURED", "webhook verification not configured", nil)
+			return
+		}
+		// Development only; warn loudly but still process so local testing works.
+		webhookLog().Warn("stripe webhook secret not set; skipping signature verification (development only)")
 	} else {
 		sig := r.Header.Get("Stripe-Signature")
 		if _, err := webhook.ConstructEventWithOptions(body, sig, h.webhookSecret, webhook.ConstructEventOptions{
@@ -124,6 +134,20 @@ func (h *WebhookHandler) handlePaymentIntentSucceeded(ctx context.Context, event
 		return
 	}
 
+	// Defense in depth: even behind a valid signature, refuse to mark an order
+	// paid unless the PaymentIntent's amount and currency match what we charged.
+	// Under ConvertCart these always match (Amount == order.Total at creation), so
+	// a mismatch means a malformed or unexpected event we should not trust.
+	if pi.Amount != int64(order.Total) {
+		webhookLog().Error("payment intent amount mismatch; refusing to mark paid", "order_id", orderIDStr, "pi", pi.ID, "pi_amount", pi.Amount, "order_total", order.Total)
+		return
+	}
+	if pi.Currency != "" && pi.Currency != stripe.CurrencyUSD {
+		webhookLog().Error("payment intent currency mismatch; refusing to mark paid",
+			"order_id", orderIDStr, "pi", pi.ID, "currency", string(pi.Currency))
+		return
+	}
+
 	txErr := db.Transaction(func(tx *gorm.DB) error {
 		if err := tx.Model(&order).Updates(map[string]any{
 			"status":            models.OrderStatusPaid,

api/handlers/webhook_test.go

@@ -222,3 +222,38 @@ func TestHandlePaymentIntentSucceeded_RequiresActionFlipsToPaid(t *testing.T) {
 		t.Fatalf("stripe_payment_id: want %q, got %q", order.StripePaymentID, reloaded.StripePaymentID)
 	}
 }
+
+func TestHandlePaymentIntentSucceeded_AmountMismatchDoesNotPay(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	order := seedOrderForWebhook(t, user.ID, models.OrderStatusRequiresAction, "pi_test_amount_mismatch")
+
+	// PI claims 1 cent; seed order.Total is 500.
+	pi := map[string]any{
+		"id":       order.StripePaymentID,
+		"amount":   1,
+		"metadata": map[string]string{"order_id": fmt.Sprintf("%d", order.ID)},
+	}
+	raw, err := json.Marshal(pi)
+	if err != nil {
+		t.Fatalf("marshal pi: %v", err)
+	}
+	evt := stripe.Event{
+		Type: "payment_intent.succeeded",
+		Data: &stripe.EventData{Raw: raw},
+	}
+
+	h := NewWebhookHandler("", "")
+	h.handlePaymentIntentSucceeded(context.Background(), evt)
+
+	db := database.GetDB()
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reloaded order: %v", err)
+	}
+	if reloaded.Status == models.OrderStatusPaid {
+		t.Fatalf("order marked paid despite amount mismatch")
+	}
+}

api/main.go

@@ -170,6 +170,19 @@ func main() {
 		}
 	}()
 
+	go func() {
+		ticker := time.NewTicker(10 * time.Minute)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ticker.C:
+				handlers.ReconcilePayRedirects(ctx)
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+
 	log.Println("API server started. Press Ctrl+C to shutdown.")
 
 	// Block until signal received

api/middleware/doc.go

@@ -0,0 +1,4 @@
+// Package middleware holds the stuff that runs on every request before a
+// handler ever sees it: auth, CORS, logging, rate limiting, metrics, and a
+// recovery net for panics.
+package middleware

api/routes/doc.go

@@ -0,0 +1,3 @@
+// Package routes is the switchboard: it maps every URL to the handler that
+// knows what to do with it.
+package routes

cmd/reconcile-cards/doc.go

@@ -0,0 +1,3 @@
+// Command reconcile-cards hunts down saved cards that Stripe no longer knows
+// about and detaches them. Run it with -dry-run first if you're nervous.
+package main

pkg/api/doc.go

@@ -0,0 +1,3 @@
+// Package api is the client side of the house: it talks to our HTTP backend
+// so other Go code doesn't have to hand-roll requests.
+package api

pkg/auth/doc.go

@@ -0,0 +1,3 @@
+// Package auth sorts out who you are: logging in with an SSH key and minting
+// the JWT you carry around afterwards.
+package auth

pkg/bring/doc.go

@@ -0,0 +1,3 @@
+// Package bring talks to Bring, the Norwegian postal service, for booking
+// shipments and printing labels.
+package bring

pkg/config/config.go

@@ -92,6 +92,7 @@ func (c *Config) validate() error {
 		{"JWT_SECRET", c.JWTSecret},
 		{"STRIPE_SECRET_KEY", c.StripeSecretKey},
 		{"AUTH_FINGERPRINT_KEY", c.AuthFingerprintKey},
+		{"STRIPE_WEBHOOK_SECRET", c.StripeWebhookSecret},
 	}
 
 	var missing []string

pkg/config/doc.go

@@ -0,0 +1,3 @@
+// Package config reads everything out of the environment so secrets and
+// settings stay out of the source code.
+package config

pkg/database/doc.go

@@ -0,0 +1,3 @@
+// Package database opens the SQLite connection, runs the migrations, and
+// drops in some seed data so the shop isn't empty on a fresh boot.
+package database

pkg/database/seed.go

@@ -26,6 +26,7 @@ func Seed(db *gorm.DB) error {
 		{
 			Name:        "Espresso",
 			RoastType:   "Dark Roast",
+			RoastLevel:  5,
 			Ounces:      2,
 			BeanType:    "Arabica",
 			Price:       1800, // $18.00
@@ -35,6 +36,7 @@ func Seed(db *gorm.DB) error {
 		{
 			Name:        "Americano",
 			RoastType:   "Medium Roast",
+			RoastLevel:  3,
 			Ounces:      8,
 			BeanType:    "Arabica",
 			Price:       2200, // $22.00
@@ -44,6 +46,7 @@ func Seed(db *gorm.DB) error {
 		{
 			Name:        "Cappuccino",
 			RoastType:   "Medium Roast",
+			RoastLevel:  3,
 			Ounces:      6,
 			BeanType:    "Arabica",
 			Price:       2200, // $22.00
@@ -53,6 +56,7 @@ func Seed(db *gorm.DB) error {
 		{
 			Name:        "Latte",
 			RoastType:   "Medium Roast",
+			RoastLevel:  2,
 			Ounces:      12,
 			BeanType:    "Arabica",
 			Price:       2500, // $25.00
@@ -62,6 +66,7 @@ func Seed(db *gorm.DB) error {
 		{
 			Name:        "Mocha",
 			RoastType:   "Dark Roast",
+			RoastLevel:  4,
 			Ounces:      12,
 			BeanType:    "Arabica",
 			Price:       3000, // $30.00
@@ -71,6 +76,7 @@ func Seed(db *gorm.DB) error {
 		{
 			Name:        "Macchiato",
 			RoastType:   "Dark Roast",
+			RoastLevel:  4,
 			Ounces:      3,
 			BeanType:    "Robusta Blend",
 			Price:       1800, // $18.00

pkg/models/coffee.go

@@ -11,6 +11,7 @@ type Coffee struct {
 	ID          uint           `gorm:"primaryKey" json:"id"`
 	Name        string         `gorm:"size:255;not null" json:"name"`
 	RoastType   string         `gorm:"size:100" json:"roast_type"`
+	RoastLevel  int            `json:"roast_level"` // 1-5 roast-intensity
 	Ounces      int            `json:"ounces"`
 	BeanType    string         `gorm:"size:100" json:"bean_type"`
 	Price       int            `gorm:"not null" json:"price"`

pkg/models/doc.go

@@ -0,0 +1,3 @@
+// Package models is the shared vocabulary of the app: coffee, carts, orders,
+// addresses, cards, users, and the other nouns everything passes around.
+package models

pkg/observability/doc.go

@@ -0,0 +1,3 @@
+// Package observability sets up tracing and structured logs so that when
+// something breaks at 3am you stand a chance of figuring out why.
+package observability

pkg/shipping/doc.go

@@ -0,0 +1,3 @@
+// Package shipping holds the plain shipping types that the rest of the app
+// passes back and forth.
+package shipping

pkg/shippo/doc.go

@@ -0,0 +1,2 @@
+// Package shippo talks to the Shippo API for shipping rates and labels.
+package shippo

pkg/stripeclient/doc.go

@@ -0,0 +1,3 @@
+// Package stripeclient wires up the Stripe SDK once at startup (with tracing
+// baked in) so everyone else can just make calls.
+package stripeclient

pkg/tui/doc.go

@@ -0,0 +1,3 @@
+// Package tui is the terminal UI you see over SSH: the shop, the cart, your
+// account, and the checkout flow, all drawn with Bubbletea.
+package tui

pkg/tui/model.go

@@ -837,6 +837,7 @@ func NewModel(username string) Model {
 			{
 				Name:        "Espresso",
 				RoastType:   "Dark Roast",
+				RoastLevel:  5,
 				Ounces:      2,
 				BeanType:    "Arabica",
 				Price:       350, // $3.50
@@ -846,6 +847,7 @@ func NewModel(username string) Model {
 			{
 				Name:        "Latte",
 				RoastType:   "Medium Roast",
+				RoastLevel:  2,
 				Ounces:      12,
 				BeanType:    "Arabica Blend",
 				Price:       500, // $5.00
@@ -855,6 +857,7 @@ func NewModel(username string) Model {
 			{
 				Name:        "Cappuccino",
 				RoastType:   "Medium Roast",
+				RoastLevel:  3,
 				Ounces:      8,
 				BeanType:    "Italian Blend",
 				Price:       450, // $4.50
@@ -864,6 +867,7 @@ func NewModel(username string) Model {
 			{
 				Name:        "Americano",
 				RoastType:   "Dark Roast",
+				RoastLevel:  4,
 				Ounces:      16,
 				BeanType:    "Arabica",
 				Price:       400, // $4.00
@@ -873,6 +877,7 @@ func NewModel(username string) Model {
 			{
 				Name:        "Mocha",
 				RoastType:   "Medium Roast",
+				RoastLevel:  3,
 				Ounces:      16,
 				BeanType:    "Colombian",
 				Price:       550, // $5.50
@@ -882,6 +887,7 @@ func NewModel(username string) Model {
 			{
 				Name:        "Macchiato",
 				RoastType:   "Dark Roast",
+				RoastLevel:  4,
 				Ounces:      3,
 				BeanType:    "Robusta Blend",
 				Price:       425, // $4.25

pkg/tui/payment_form.go

@@ -276,9 +276,7 @@ func (m Model) updatePaymentViewport() Model {
 	breadH := lipgloss.Height(m.BuildBreadcrumbs())
 	footerH := lipgloss.Height(m.BuildFooter())
 	availH := m.heightContainer - headerH - footerH - breadH
-	if availH < 1 {
-		availH = 1
-	}
+	availH = max(availH, 1)
 	if !m.payment.viewportReady {
 		m.payment.viewport = viewport.New(viewport.WithWidth(m.widthContent), viewport.WithHeight(availH))
 		m.payment.viewport.KeyMap = viewport.KeyMap{}
@@ -303,7 +301,7 @@ func (m Model) PaymentPageView() string {
 			m.widthContainer,
 			m.payment.viewport.Height(),
 			lipgloss.Center, lipgloss.Center,
-			m.renderPaymentHttpsView(),
+			m.renderPaymentHTTPSView(),
 		)
 	} else if m.payment.view == 0 && m.payment.form == nil {
 		content = m.RenderCardList()
@@ -374,7 +372,7 @@ func (m Model) RenderCardList() string {
 	return lipgloss.JoinVertical(lipgloss.Left, parts...)
 }
 
-func (m Model) renderPaymentHttpsView() string {
+func (m Model) renderPaymentHTTPSView() string {
 	baseStyle := m.theme.TextLabel()
 	accentStyle := m.theme.TextHighlight()
 

pkg/tui/qrfefe/doc.go

@@ -0,0 +1,3 @@
+// Package qrfefe turns text into a QR code drawn with terminal block
+// characters, handy for showing links you can scan right off the screen.
+package qrfefe

pkg/tui/shop.go

@@ -24,9 +24,7 @@ const (
 // menu(menuW+4) + gap(1) + detail(detailW+4) = contentW = wideW + 4.
 func (m Model) shopLayout() (contentW, menuW, detailW, wideW int) {
 	contentW = m.widthContent
-	if contentW > 74 {
-		contentW = 74
-	}
+	contentW = min(contentW, 74)
 	wideW = contentW - 4
 	if m.size < large {
 		// Stacked layout: both panels span the full content width.
@@ -38,6 +36,7 @@ func (m Model) shopLayout() (contentW, menuW, detailW, wideW int) {
 }
 
 // roastLevel maps a roast type to a 1-5 intensity for the roast meter.
+// It is the fallback for products stored before the roast_level column existed.
 func roastLevel(roastType string) int {
 	rt := strings.ToLower(roastType)
 	switch {
@@ -65,6 +64,7 @@ func clampLines(s string, n int) string {
 
 // roastMeter renders the strength dots, e.g. ● ● ● ○ ○
 func roastMeter(n int) string {
+	n = max(0, min(n, 5))
 	on := lipgloss.NewStyle().Foreground(cGold).Render(strings.Repeat("● ", n))
 	off := pDim.Render(strings.Repeat("○ ", 5-n))
 	return strings.TrimRight(on+off, " ")
@@ -105,7 +105,11 @@ func (m Model) shopDetailContent(w int) string {
 		pDim.Render(fmt.Sprintf("%dOZ", coffee.Ounces)) + sep +
 		pDim.Render(strings.ToUpper(coffee.BeanType))
 
-	strength := pDim.Render("roast  ") + roastMeter(roastLevel(coffee.RoastType))
+	level := coffee.RoastLevel
+	if level < 1 || level > 5 {
+		level = roastLevel(coffee.RoastType)
+	}
+	strength := pDim.Render("roast  ") + roastMeter(level)
 
 	price := lipgloss.NewStyle().Foreground(lipgloss.Color(coffee.Color)).Bold(true).
 		Render(fmt.Sprintf("$%d.%02d", coffee.Price/100, coffee.Price%100)) +
@@ -213,12 +217,8 @@ func (m Model) shopMoveSelected(previous bool) Model {
 	} else {
 		next++
 	}
-	if next < 0 {
-		next = 0
-	}
-	if next >= len(m.Coffees) {
-		next = len(m.Coffees) - 1
-	}
+	next = max(next, 0)
+	next = min(next, len(m.Coffees)-1)
 	m.shop.selected = next
 	return m
 }

pkg/tui/theme/doc.go

@@ -0,0 +1,3 @@
+// Package theme keeps the colors and styles in one spot so the whole UI
+// looks like it was built by the same person.
+package theme

pkg/utils/doc.go

@@ -0,0 +1,3 @@
+// Package utils is the catch-all drawer for tiny HTTP helpers that didn't
+// earn a package of their own.
+package utils

pkg/validate/doc.go

@@ -0,0 +1,3 @@
+// Package validate gives user input a once-over before the rest of the app
+// trusts it.
+package validate