feat(cart): pass off_session=true on PaymentIntent for SCA exemption eligibility

api/handlers/cart.go

@@ -430,7 +430,7 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 			case stripe.ErrorTypeCard:
 				middleware.RecordCartConversion("card_declined")
 				audit.OrderFailed(userID, order.ID, total, stripeErr.Msg)
-				utils.RespondError(w, http.StatusPaymentRequired, mapStripeCardErrCode(stripeErr.Code), stripeErr.Msg, nil)
+				utils.RespondError(w, http.StatusPaymentRequired, "CARD_DECLINED", stripeErr.Msg, nil)
 			case stripe.ErrorTypeInvalidRequest:
 				middleware.RecordCartConversion("stripe_invalid_request")
 				audit.OrderFailed(userID, order.ID, total, stripeErr.Msg)
@@ -490,36 +490,3 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 		"order": order,
 	})
 }
-
-func mapStripeCardErrCode(code stripe.ErrorCode) string {
-	switch code {
-	case stripe.ErrorCodeAuthenticationRequired:
-		return "AUTHENTICATION_REQUIRED"
-	case "authentication_not_supported":
-		return "AUTHENTICATION_NOT_SUPPORTED"
-	case "card_declined", "":
-		return "CARD_DECLINED"
-	case "expired_card":
-		return "CARD_EXPIRED"
-	case "incorrect_cvc":
-		return "CARD_CVC_FAILED"
-	case "insufficient_funds":
-		return "CARD_INSUFFICIENT_FUNDS"
-	case "processing_error":
-		return "CARD_PROCESSING_ERROR"
-	}
-	return "CARD_DECLINED"
-}
-
-//nolint:unused // wired into Convert cart later
-func appURLForHandler(r *http.Request) string {
-	scheme := "http"
-	if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
-		scheme = "https"
-	}
-	host := r.Host
-	if fh := r.Header.Get("X-Forwarded-Host"); fh != "" {
-		host = fh
-	}
-	return fmt.Sprintf("%s://%s", scheme, host)
-}

api/handlers/orders.go

@@ -145,29 +145,6 @@ func (h *OrderHandler) GetOrders(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-func (h *OrderHandler) GetOrderStatus(w http.ResponseWriter, r *http.Request) {
-	db := database.GetDB().WithContext(r.Context())
-	userID := middleware.UserIDFromContext(r.Context())
-
-	idStr := chi.URLParam(r, "id")
-	id, err := strconv.ParseUint(idStr, 10, 32)
-	if err != nil {
-		utils.RespondError(w, http.StatusBadRequest, "INVALID_ID", "invalid order id", nil)
-		return
-	}
-
-	var order models.Order
-	if err := db.Where("id = ? AND user_id = ?", id, userID).First(&order).Error; err != nil {
-		utils.RespondError(w, http.StatusNotFound, "ORDER_NOT_FOUND", "order not found", nil)
-		return
-	}
-
-	utils.RespondSuccess(w, http.StatusOK, map[string]any{
-		"id":     order.ID,
-		"status": string(order.Status),
-	})
-}
-
 // RefundOrder issues a full refund for an order via Stripe and marks it as
 // refunded. Only orders in paid or shipped status can be refunded.
 func (h *OrderHandler) RefundOrder(w http.ResponseWriter, r *http.Request) {

api/routes/routes.go

@@ -126,7 +126,6 @@ func SetupRoutes(
 
 			// Orders
 			r.Get("/orders", orderHandler.GetOrders)
-			r.Get("/orders/{id}/status", orderHandler.GetOrderStatus)
 			r.Post("/orders/{id}/refund-request", orderHandler.CreateRefundRequest)
 			r.Post("/orders/{id}/refund", orderHandler.RefundOrder)
 

pkg/api/client.go

@@ -56,6 +56,7 @@ type TokenResponse struct {
 }
 
 func (c *Client) GetOrCreateToken(fingerprint, pubKeyStr, clientSecret string) (string, models.PublicUser, error) {
+
 	url := fmt.Sprintf("%s/api/v1/auth/token", c.BaseURL)
 
 	reqBody := TokenRequest{
@@ -496,40 +497,6 @@ func (c *Client) ConvertCart() (*models.Order, error) {
 	return &convertResp.Data.Order, nil
 }
 
-type OrderStatusResponse struct {
-	Success bool `json:"success"`
-	Data    struct {
-		ID     uint   `json:"id"`
-		Status string `json:"status"`
-	} `json:"data"`
-	Error *APIError `json:"error,omitempty"`
-}
-
-func (c *Client) GetOrderStatus(id uint) (string, error) {
-	url := fmt.Sprintf("%s/api/v1/orders/%d/status", c.BaseURL, id)
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		return "", fmt.Errorf("failed to create request: %w", err)
-	}
-	resp, err := c.doRequest(req)
-	if err != nil {
-		return "", fmt.Errorf("failed to fetch order status: %w", err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	var sResp OrderStatusResponse
-	if err := json.NewDecoder(resp.Body).Decode(&sResp); err != nil {
-		return "", fmt.Errorf("failed to decode order status response: %w", err)
-	}
-	if !sResp.Success {
-		if sResp.Error != nil {
-			return "", fmt.Errorf("%s: %s", sResp.Error.Code, sResp.Error.Message)
-		}
-		return "", fmt.Errorf("failed to fetch order status")
-	}
-	return sResp.Data.Status, nil
-}
-
 // GetCards fetches all saved cards for the user.
 func (c *Client) GetCards() ([]models.Card, error) {
 	url := fmt.Sprintf("%s/api/v1/cards", c.BaseURL)

pkg/audit/audit.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"log/slog"
-
 	"terminalShop/pkg/models"
 
 	"gorm.io/gorm"
@@ -22,7 +21,6 @@ const (
 	eventOrderPaid              eventType = "order_paid"
 	eventOrderShipped           eventType = "order_shipped"
 	eventOrderFailed            eventType = "order_failed"
-	eventOrderRequiresAction    eventType = "order_requires_action"
 	eventOrderRefunded          eventType = "order_refunded"
 	eventPaymentCritical        eventType = "payment_critical"
 	eventLabelPurchased         eventType = "label_purchased"
@@ -300,15 +298,3 @@ func attrsToMap(a []any) map[string]any {
 	}
 	return m
 }
-
-//nolint:unused // called from ConvertCart in the next update
-func OrderRequiresAction(userID, orderID uint, paymentIntentID string) {
-	e := event{
-		Event:    eventOrderRequiresAction,
-		UserID:   userID,
-		OrderID:  orderID,
-		StripeID: paymentIntentID,
-	}
-	slog.Info("audit", e.attrs()...)
-	persist(orderID, eventOrderRequiresAction, e)
-}

pkg/tui/confirmation.go

@@ -3,7 +3,6 @@ package tui
 import (
 	"fmt"
 	"strings"
-
 	"terminalShop/pkg/models"
 
 	"charm.land/bubbles/v2/viewport"
@@ -193,7 +192,7 @@ func (m Model) ReviewUpdate(msg tea.Msg) (Model, tea.Cmd) {
 		m.CheckingOut = false
 		if msg.Err != nil {
 			m = m.SwitchPage(paymentPage)
-			m.error = &VisibleError{message: friendlyCheckoutError(msg.Err)}
+			m.error = &VisibleError{message: fmt.Sprintf("checkout failed: %v", msg.Err)}
 			m.review.cardJustAdded = false
 			m.payment.view = 0
 			m.payment.form = nil
@@ -235,24 +234,3 @@ func (m Model) ReviewUpdate(msg tea.Msg) (Model, tea.Cmd) {
 	}
 	return m, nil
 }
-
-func friendlyCheckoutError(raw error) string {
-	s := raw.Error()
-	switch {
-	case strings.Contains(s, "AUTHENTICATION_REQUIRED"):
-		return "your bank wants to verify this charge, authentication step coming soon."
-	case strings.Contains(s, "AUTHENTICATION_NOT_SUPPORTED"):
-		return "this card doesn't support online authentication. Try another card"
-	case strings.Contains(s, "CARD_EXPIRED"):
-		return "card expired. Add a new card and try again"
-	case strings.Contains(s, "CARD_CVC_FAILED"):
-		return "card cvc incorrect. Check the back of the card and try again"
-	case strings.Contains(s, "CARD_INSUFFICIENT_FUNDS"):
-		return "insufficient funds on this card"
-	case strings.Contains(s, "CARD_PROCESSING_ERROR"):
-		return "card processing error. Try again in a moment"
-	case strings.Contains(s, "CARD_DECLINED"):
-		return "card declined"
-	}
-	return "checkout failed, try again."
-}

pkg/tui/views.go

@@ -82,10 +82,6 @@ func (m Model) renderString() string {
 		content = loadingStyle.Render("Loading products from API...")
 	} else if m.error != nil {
 		errorStyle := m.theme.PanelError().Padding(0, 1).MarginBottom(1)
-		// soft-wrap long messages instead of clipping.
-		if m.widthContent > 4 {
-			errorStyle = errorStyle.Width(m.widthContent - 4)
-		}
 		errorBanner := errorStyle.Render(m.error.message)
 		content = errorBanner + "\n" + m.buildPageContent(availableContentHeight)
 	} else if m.notice != nil {