* feat(audit): emit cart_rejected event when per-order cap blocks checkout
* refactor(audit): drop dead persist call + harden cart_rejected test capture
* feat(sca): sweep abandoned 3ds requires_action orders to failed
* fix(sca): address pr review on abandoned 3ds sweep
- Drop stripe.Key write in ReconcileStale3DSOrders; wire once in api/main.go after cfg.Load so concurrent reconcilers don't
race the SDK global.
- Add empty-PI short-circuit before paymentintent.Get to bury a future regression in a slog.Warn instead of a Stripe 4xx.
- Swap fmt.Printf for slog.Warn with k/v attrs in loadAbandoned3DSThresholdMinutes so Loki sees structured fields instead of
literal %q/%d.
- Comment the updated_at predicate (RetryAuth bumps it via GORM auto-stamp, intentional grace-window extension) + the
conditional-UPDATE/map-form choice.
- Tests: processing/requires_capture skip, unknown-status skip, stripe-error skip, empty-PI skip, full env-parse table for
loadAbandoned3DSThresholdMinutes.
* fix(stripe): wire key once at init drop per-call writes
* refactor(stripe): drop dead stripeKey fields and pre-call sdk params
* fix(products): update pricing on products
* fix(test): pin coffee price in cart-limit fixture
TestConvertCartLimit's quantities and expected totals were keyed to
the original 500-cent latte price. After the product price bump in
1ce63fb, coffee_id=4 became 2500 cents, so under_cap/at_cap subtests
overshot the $200 cap and over_cap's expected total magnitude was
wrong by 5x. Override coffee_id=4's price to 500 in test setup so the
cap math stays stable regardless of seed changes.
* feat(sca): add retry-auth endpoint for failed 3ds challenges
* fix(sca): retry-auth unexpected-state branch out of card-decline
just fixes up in some of the things the review of the last commit
noticed
* feat(sca): expire inactive saved cards
* fix(sca): address card ttl review feedback
- Correct sql typos breaking GET /cards and /view/init (used_id, id_default)
- Stop swallowing backfillCardStorageExpiration error in Migrate
- Wrap expireStoredCard local writes in a transaction and run stripe
detach + audit only after commit, preventing double-fire on retry
- Drop redundant ttl refresh in ConvertCart; webhook is authoritative
- Rename validation_expired_at metric label to validation_card_expired
- Fix CardStorageExpiresAt doc comment and test failure message typos
- Add handler-level tests for expireStoredCards (user scoping + cart deref)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(sca): move card expiration to periodic reconciler
Read paths (GetCards, GetViewInit) now filter expired cards from
query results instead of detaching them inline, so request handlers
no longer block on Stripe API calls. Physical deletion runs in a
new ReconcileExpiredCards goroutine on an hourly ticker, mirroring
the existing ReconcileOrders / ReconcileUnshipped jobs. Per-card
action sites (SetCard, SetDefaultCard, ConvertCart) still expire
synchronously since they operate on one row the user is acting on.
ViewHandler's stripeKey dependency is dropped now that GetViewInit
no longer touches Stripe.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(sca): address card ttl review feedback
- guard zero order.CardID before refreshing card storage ttl in
payment_intent.succeeded webhook to avoid noisy warn logs on payment
paths that did not use a saved card
- delete unused Card.RefreshStorageTTL model method; the SQL-only
refreshCardStorageTTL helper is the single canonical path
- clarify duplicate-card webhook path: storage_expires_at reset is a
card-add refresh, not a payment-success refresh, so last_used_at
intentionally stays untouched
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(sca): cover card ttl read paths and expired-card sync sites
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(sca): add order status endpoint adn SCA error code mapping
adds server-side infra for the upcoming SCA / 3DS challenge flow im
working on. No behavior change to existing checkout paths.
* fix(sca): suppress unused lint on SCA scaffolding helpers
* feat(refund): add refund request flow
- tui modal composer with reason select + free-form message
(pkg/tui/refund.go)
- POST /api/v1/orders/{id}/refund-request posts to orders slack thread
- 15 min server side cooldown via Order.LastRefundRequestAt (429 +
retry-after)
- shared refundrequestreasons + can requestrefund hoisted to pkg/models
- slack message includes customer name, email, order total, quoted body
- tests over invalid-state, missing-message, and cooldown paths
* style(tui): run gofmt to fix formatting
so the ain was that older paid orders were getting buried in the #orders
channel in slack and i would just forget about them. Pin/unpin from
earlier helped, but if i missed pinning one or the channel got noisy, it
was still easy to lose track.
this adds a 24h cron that queries any paid order older than 24h with no
label yet and dumps them all into one #orders message. Each line shows
the order id, how old it is, total, where it is going, and a permalink
back to the orders slack thread so i can hop in and hit Buy Label
Ports the idea from terminal.shops cron/unshipped.ts but out stuch state
is different( we auto-promote paid->shipped on label-buy so
PRE_TRANSIT-stuck can not happen), so the query is "paid + no tracking
number + >24h" instead.
NO orders get a "Bring blocked" tag since i dont have the norwegian org
set up yet and can not actually ship those today. Also fires once 40s
after startup so a deploy does not black out the reminder for a full
day.
Pulls events off the new order_events table and shows them as a timeline
block in the order detail view: Paid, Label created, In transit,
Delivered (etc) with timestamps. Filters out ops-only events like
payment_critical, label_orphaned, and tracking_marked_manually so the
customer never sees internal plumbing.
DisplayLabel on OrderEvent decides what's customer-visible and what's
redacted, so the same order_events rows can later power an admin view
with no filter.
the big colored status on the order detail page used to just say
"Shipped" the moment i bought the label, which didnt really feel right
since the carrier hadnt actually picked anything up yet. now it walks
through "Label created" -> "In transit" -> "Delivered" as real scans
come in, and keeps the "Delivery Issue" / "Returned to sender" labels
for unhappy paths
also wired up the existing tracking_status_details column to the tui. i
skipped it before but the response actually includes a description of
the delivery, that is now subtext under the colored statu.
and the shippo webhook now returns a small json body instead of an empty
200. this is just for the operator that runs the curls commands to
update the shipment, which makes debugging a lot less guesswork
Adds POST /api/v1/orders/{id}/label (admin-only) that buys a shipping
label through Shippo and writes carrier + tracking + label fields back
onto the order, transitioning paid -> shipped.
realized per-shipment table is kinda bad, switched to single embedded tracking blob. since im only
shipping from my house no split is needed. adds tracking_status, tracking_status_details,
tracking_status_updated_at columns. reverse-backfills any historical shipments rows back onto orders
(idempotent, table-guarded). UpdateTracking rewritten to write to otder columns direcly
Package-level slog.With() vars are evaluated at init time, before
observability.InitLogger() runs in main. They captured the original default
slog handler and bypassed the countingHandler that increments
log_messages_total — so warn/error calls from these packages weren't being
counted.
Convert to functions so each call resolves slog.Default() at use time and
inherits the active counting handler.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Convert log.Printf calls in webhook, reconcile, addresses, and auth handlers
to slog with a consistent `component` attribute. Severity now reflects
operational urgency:
- warn: signature failures, declined cards, unknown fingerprints, vendor
validation rejections, reconciler patching a missed charge
- error: DB write failures, malformed Stripe payloads, token generation
failures
- info: successful order/card events, normal reconciler ticks
Lets Loki/Prometheus filter by component (e.g. {component="webhook"}) and
gives the log-level dashboard panel real warn/error series instead of a
flat info line.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
