Repository navigation
Validate refund totals and redact endpoint errors - #391
Merged
Merged
Conversation
added 15 commits
October 2, 2026 15:29
Bring the branch up to date with main after the account recovery change. The schema policy keeps both raised minima: dispatcher 20 from the account recovery migration and executor 7 from the operator disposition migration. Both require the explicit stopped-service database upgrade. GitHub issue #168.
Preserve dispatcher schema 23 alongside executor schema 7 and keep the configuration guide aligned with both schema boundaries. GitHub issue #168.
Ask operators to verify endpoint and payment kit properties during their deployment rehearsal while retaining the documented recovery limits. GitHub issue #87.
Report endpoint field names and validation reasons without echoing configured URLs, which can contain credentials or query tokens. Cover malformed gRPC and GraphQL endpoints through handler construction. GitHub issue #82.
Check each stored order amount and the aggregate before preparing a refund or recording its decision. Preserve zero refunds and the maximum supported amount, with rejected state unchanged after reopening SQLite. GitHub issue #81.
ctfbruce
marked this pull request as ready for review
October 5, 2026 16:05
ctfbruce
added
the
Ready to merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reject negative or overflowing stored order totals before preparing a chain refund or changing financial records. Sui configuration errors now name the invalid endpoint field without echoing a value that could contain credentials or query tokens.
The refund guard preserves valid zero and maximum totals and the existing empty-order behavior. Real SQLite regressions check unchanged records after rejection and reopen; constructor regressions cover credential-bearing malformed endpoints.
Validation: the new refund regressions reproduce the old failure; the corrected refund/settlement/rehearsal race selection, Sui constructor/address race tests, formatting and vet pass on Linux. Full CI runs on this combined branch.
Related to #81 and #82. Includes the pending #388 dependency; merge after #388.