the big colored status on the order detail page used to just say
"Shipped" the moment i bought the label, which didnt really feel right
since the carrier hadnt actually picked anything up yet. now it walks
through "Label created" -> "In transit" -> "Delivered" as real scans
come in, and keeps the "Delivery Issue" / "Returned to sender" labels
for unhappy paths
also wired up the existing tracking_status_details column to the tui. i
skipped it before but the response actually includes a description of
the delivery, that is now subtext under the colored statu.
and the shippo webhook now returns a small json body instead of an empty
200. this is just for the operator that runs the curls commands to
update the shipment, which makes debugging a lot less guesswork
Adds POST /api/v1/orders/{id}/label (admin-only) that buys a shipping
label through Shippo and writes carrier + tracking + label fields back
onto the order, transitioning paid -> shipped.
realized per-shipment table is kinda bad, switched to single embedded tracking blob. since im only
shipping from my house no split is needed. adds tracking_status, tracking_status_details,
tracking_status_updated_at columns. reverse-backfills any historical shipments rows back onto orders
(idempotent, table-guarded). UpdateTracking rewritten to write to otder columns direcly
Package-level slog.With() vars are evaluated at init time, before
observability.InitLogger() runs in main. They captured the original default
slog handler and bypassed the countingHandler that increments
log_messages_total — so warn/error calls from these packages weren't being
counted.
Convert to functions so each call resolves slog.Default() at use time and
inherits the active counting handler.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Convert log.Printf calls in webhook, reconcile, addresses, and auth handlers
to slog with a consistent `component` attribute. Severity now reflects
operational urgency:
- warn: signature failures, declined cards, unknown fingerprints, vendor
validation rejections, reconciler patching a missed charge
- error: DB write failures, malformed Stripe payloads, token generation
failures
- info: successful order/card events, normal reconciler ticks
Lets Loki/Prometheus filter by component (e.g. {component="webhook"}) and
gives the log-level dashboard panel real warn/error series instead of a
flat info line.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Audit events now emit at Info/Warn/Error so the log-level counter has variety
instead of being pinned to info. Panic recovery uses structured slog.Error
with method/path/stack attrs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds Prometheus instrumentation across the checkout funnel, auth flow,
Stripe calls, rate limiters, and HTTP middleware (inflight gauge, request
and response sizes). Introduces a slog handler that counts log lines by
level so the dashboard can show error/warn rates; existing log.Printf
calls are routed through slog and counted as info.
Backs the new "terminalshop — Service Overview" Grafana dashboard.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Default prometheus.DefBuckets bottoms out at 5ms, which made every
route's p95 collapse to 4.75ms (histogram_quantile interpolation
within the smallest bucket). Custom buckets from 100µs to 5s now
distinguish microsecond-fast routes (health) from slower ones
(stripe-backed cart endpoints).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds Counter (http_requests_total) and Histogram
(http_request_duration_seconds) labeled by method, chi route pattern,
and status. Wired through a new Metrics middleware (after Recovery so
panics-turned-500s are still counted) and an unauthenticated /metrics
endpoint at the root for Prometheus to scrape.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Auth handler used FirstOrCreate which couldn't see soft-deleted keys
(GORM filters by deleted_at IS NULL) but also couldn't insert (unique
index still covers deleted rows), returning 500 on every login after
a key deletion. Use Unscoped lookup and restore soft-deleted keys.
Splash screen also got permanently stuck when auth failed because
splashViewInitCmd was never fired, leaving splash.dataReady false.
Remove compiled binaries (main, terminalShop, api/main, api/api-server)
and server.go.old from git tracking. Add them to .gitignore. Update
README to reflect current project state accurately.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Update Caddyfile from placeholder api.yourdomain.com to api.sshops.uk
- Use ConstructEventWithOptions with IgnoreAPIVersionMismatch to handle
Stripe account API version (2026-01-28.clover) vs stripe-go v78 (2024-04-10)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
adds a /pay/{token} redirect endpoint that generates a short URL
pointing to a stripe checkout sessions in setup mode. The TUI shows a QR
code and URL on the payment page so users can add a card via the browser
instead of entering raw card data over SSH.
the checkout.session.completed webhook saves the card to the database.
the TUI polls GET /api/v1/cards every second and auto-proceeds to
confirmation once the new card is detected.
also adds a dev.sh startup script that runs all four required processes.
(SSH server, API server, Stripe CLI listener, ngrok) in a single
terminal
Stripe checkout URLs are too long to produce a scannable QR code in a
terminal. Add an in-memory token→URL store and a /pay/{token} redirect
endpoint so the TUI shows a short URL (e.g. localhost:8080/pay/a3f1c2b4)
that fits in a QR. APP_URL config controls the base URL (defaults to
API_URL). Revert to returning sess.URL directly in CollectCard if this
approach needs to be abandoned.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three bugs fixed, two of them from the last commit, one of them has been
long living.
- the cart query in the ViewInit handler used user_id on cart_items, but
that column does not exist, cart_items links to carts via cart_id. Fixed
by first finding the users cart and then querying items by cart_id,
which is how the reso of the cart handlers already do it.
- GetViewInit was missing the json.Decode call entirely. so the response
body was never parsed. This meant m.User was never set, blocking all
cart syncs and address saves, and the cart always loaded empty.
- after a successful order, the cart was never cleared locally even
though the server deleted the cart items. this meant that the user had
to quit and ssh back in to see the cart update. fixed by clreaing
m.Cart, m.CartCursor and m.ShippingInfo in the CheckoutResultMsg success
handler
previously main.go handled auth directly, it connected to the database,
ran migrations, created a JWT manager and SSHAuthService, and
authenticated the SSH key before the TUI even started. this commit rips
all of that out
Auth now happens inside the TUI during the splash screen via
splashAuthCmd, which calls the /auth/token endpoint. if no user exists
or the fingerprint it auto-creates one using the SSH public ke, so there
is no longer a separate registartion flow. The token and user com back
in the response.
once authed splashViewInitCmd fires a single /view/init request that
loads everything needed to start the app, products, cart, addresses,
cards, and orders, before switching to the shop page
on the model side, User/*models.user and gossh.PublicKey were replaced
with plain Fingerprint and SSHPublicKeyStr strings, and NewModelWithAuth
was updated too
prices stored as float64 could lead to rounding errors when converting to cents for stripe (19.99 * 100 = 1998.99... truncating to 1998). canged Coffee.Price to int, storing cents directly. Updated the seed data, fallback products, API handlers, and all TUI display code to be in sync with this change.
Adds a background goruotine that runs every 5 minutes to find pending
orders with no Stripe ID older than 10 mins and patches them if stripe
shows a succeeded PaymentIntent. Covers the edge case where the server
crashes after charging but before the DB transaction commits. Also tags
PaymentIntents with order_id metadata at createion to make them
searchable
When paying the application charges the card and then sends a payment
record to the database after, in a situation where something goes wrong
between those two steps, we could potentially end up where a users card
was charged but no record on what is was charged for. The fix is to
re-order ConvertCart to write a pending order record before calling
Stripe, this way a DB record always exists if anything fails
mid-operation. This implementation uses an idempotency key keyed to the
order ID to prevent double-charges on retry. Wraps the post-charge DB
updates in a transaction so marking paid andd clearing the cart are
atomic. Adds OrderStatusFailed and a CRITICAL log for the unrecoverable
case. Includes a checkout flow doc with test cards and reconcilation
steps.
replaced ViewingCart/ViewingAccount booleans and CheckoutStep int with a
single 'page' type and a SwitchPage() method, this is just almost
copying the reference implementation (terminalDotShop)'s routing
pattern. Adds inCartFlow(), chechoutStep(), and buildPageContent()
helpers to clean up those huge if/else chains in views, footer, header,
and breadcrumds. code is looking a lot better now!
