marcus06 aa446cdfa5 feat(sca): add per-user spend cap override (#53) ...

* feat(sca): add per-user spend cap override

* feat(sca): add admin endpoint to set per-user order cap

- PATCH /api/v1/users/{id}/order-cap (RequireAdmin / X-Admin-Key) sets or
  clears User.MaxOrderCents; null clears (revert to global), >=0 sets,
  negative rejected 400 INVALID_CAP at the write boundary
- harden ConvertCart: a negative override falls back to the global cap with
  a slog.Warn (mirrors loadMaxOrderCents) so a bad DB write cannot silently
  void the fraud control
- emit user_order_cap_set audit event (set/cleared)
- tests: admin handler table + RequireAdmin gate router test + negative
  read-path fallback case

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(api): drop orphan comment referencing nonexistent request struct

The paragraph above SetUserOrderCap documented a setUserOrderCapRequest
struct that does not exist; the handler decodes into a raw map instead.
The raw-map rationale already lives inline at the decode site.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-16 14:56:38 +02:00

..

addresses_test.go

chore(repo): change all instances of interface{} to any as of newer go standards (#35)

2026-06-06 13:59:09 +02:00

addresses.go

chore(repo): change all instances of interface{} to any as of newer go standards (#35)

2026-06-06 13:59:09 +02:00

admin_users_test.go

feat(sca): add per-user spend cap override (#53)

2026-06-16 14:56:38 +02:00

admin_users.go

feat(sca): add per-user spend cap override (#53)

2026-06-16 14:56:38 +02:00

auth_test.go

add ci (#1)

2026-05-23 21:43:30 +02:00

auth.go

chore(repo): change all instances of interface{} to any as of newer go standards (#35)

2026-06-06 13:59:09 +02:00

card_test.go

feat(sca): sweep abandoned 3ds requires_action orders to failed (#37)

2026-06-07 18:16:33 +02:00

cards_expire_test.go

refactor(sca): thread context.Context through reconciler entry points (#41)

2026-06-09 00:31:56 +02:00

cards.go

feat(sca): sweep abandoned 3ds requires_action orders to failed (#37)

2026-06-07 18:16:33 +02:00

cart_test.go

feat(sca): add per-user spend cap override (#53)

2026-06-16 14:56:38 +02:00

cart.go

feat(sca): add per-user spend cap override (#53)

2026-06-16 14:56:38 +02:00

doc.go

docs(docs): update docs to get rid of gopls warnings. update some code to newer standards (#49)

2026-06-14 21:42:02 +02:00

health_test.go

first commit after chaning git structure on pc

2026-02-16 11:42:43 +01:00

health.go

first commit after chaning git structure on pc

2026-02-16 11:42:43 +01:00

orders_test.go

feat(sca): sweep abandoned 3ds requires_action orders to failed (#37)

2026-06-07 18:16:33 +02:00

orders.go

feat(sca): sweep abandoned 3ds requires_action orders to failed (#37)

2026-06-07 18:16:33 +02:00

products_test.go

add ci (#1)

2026-05-23 21:43:30 +02:00

products.go

chore(repo): change all instances of interface{} to any as of newer go standards (#35)

2026-06-06 13:59:09 +02:00

reconcile_test.go

feat/sca pay redirects sweep (#50)

2026-06-15 00:39:31 +02:00

reconcile.go

feat/sca pay redirects sweep (#50)

2026-06-15 00:39:31 +02:00

slack.go

feat(refund): add refund request flow (#10)

2026-05-25 22:04:03 +02:00

tracking.go

feat(tui): add tracking redirect endpoint, render the short uril in the tui order detail instead of the old broken stuff ive been trying. this change is made by claude code and has not been reviewed carefully, this might break

2026-05-20 15:26:38 +02:00

view_test.go

feat(sca): expire inactive saved cards (#29)

2026-06-02 21:49:48 +02:00

view.go

chore(repo): change all instances of interface{} to any as of newer go standards (#35)

2026-06-06 13:59:09 +02:00

webhook_test.go

fix(webhook): fail closed when stripe webhook secret is not set (#45)

2026-06-14 22:12:36 +02:00

webhook.go

fix(webhook): fail closed when stripe webhook secret is not set (#45)

2026-06-14 22:12:36 +02:00