efrilmandClaude Opus 5.5
0c4dd72583
Adds POST /customer/wallet/payment-code (docs/prd-point-coin.md F9, K8, PC-304). The customer approves with their PIN on their own phone and gets a 6-digit code, as digits and as a QR payload (enakpoint:<code>) for the app to render, valid for two minutes. The PIN is never typed at the cashier. Codes are drawn from crypto/rand and stored in Redis with SET NX and a TTL, bound to the customer; a new code retires the previous one. Redeeming is a single Lua step that uses the code up only if it belongs to the order's customer, so it stays one-time under a race, and a cashier scanning it against the wrong order does not burn it for its owner, which a plain GETDEL would. Expired, used, unknown and other customers' codes are all refused alike. Tests run against miniredis, added as a test dependency. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.5 KiB
Go
48 lines
1.5 KiB
Go
package models
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// CustomerPinStatus is GET /customer/pin/status.
|
|
type CustomerPinStatus struct {
|
|
HasPin bool `json:"has_pin"`
|
|
LockedUntil *time.Time `json:"locked_until"`
|
|
TransferBlockedUntil *time.Time `json:"transfer_blocked_until"`
|
|
}
|
|
|
|
// CustomerPinOtp is what POST /customer/pin/otp returns: the token to send back with
|
|
// the code the customer received.
|
|
type CustomerPinOtp struct {
|
|
Purpose string `json:"purpose"`
|
|
OtpToken string `json:"otp_token"`
|
|
ExpiresAt time.Time `json:"expires_at"`
|
|
}
|
|
|
|
// CustomerSecurityEventView is one row of GET /marketing/customers/:id/security-events.
|
|
type CustomerSecurityEventView struct {
|
|
ID uuid.UUID `json:"id"`
|
|
Event string `json:"event"`
|
|
ActorUser *uuid.UUID `json:"actor_user,omitempty"`
|
|
Reason *string `json:"reason,omitempty"`
|
|
IPAddress *string `json:"ip_address,omitempty"`
|
|
UserAgent *string `json:"user_agent,omitempty"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
|
|
// CustomerPinRequestInfo is where a PIN request came from, for the security log.
|
|
type CustomerPinRequestInfo struct {
|
|
IPAddress string
|
|
UserAgent string
|
|
}
|
|
|
|
// PaymentCode is what POST /customer/wallet/payment-code returns: a one-time code the
|
|
// customer shows the cashier, as digits or as a QR of QRPayload.
|
|
type PaymentCode struct {
|
|
Code string `json:"code"`
|
|
QRPayload string `json:"qr_payload"`
|
|
ExpiresAt time.Time `json:"expires_at"`
|
|
}
|