sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
566 Commits 25 Branches 12 Tags
d87ca00e5884bc9cdbeb4665cfc022fdebe09fed
Commit Graph
4 Commits
Author SHA1 Message Date
Hermes b6678cf591 DC-061: remove superseded status/pricing/index.html and obsolete pricing-page-catalog test
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details
2026-08-23 20:24:42 -07:00
Hermes e8ab0e09a0 [mm-grade=A] DC-058: Stripe license + invoice email automation 
[mm-grade=A] (MiniMax-M3 adversarial review, 3 rounds)

Codex quota exhausted 2026-08-19 21:26 UTC. Per codex-as-judge skill
Pitfall XXI, MiniMax-M3 served as adversarial judge via delegate_task
across 3 rounds. Final grade: A. No blocking defects remaining.

Round 1 (initial: C — 14 issues):
  CRITICAL/HIGH fixed:
  1. Layer-2 delivery idempotency (different event + same session)
  2. Mislabeled idempotency test (#2 was layer-1 not layer-2)
  3. CRLF test was vacuous (regex matched space-after-colon)
  4. Currency: native symbols for EUR/GBP/JPY/etc, ISO code fallback
  5. PDF graceful degradation on poison-pill inputs
  6. Retry uses claim.createdAt as stable issuedAt

Round 2 (B → C again, found new issues):
  CRITICAL fixed:
  1. amountCents accepted string/NaN/Infinity/negative → rendered $0.00
     silently (financial-document bug)
  2. CRLF test still vacuous — rewrote with no-space-after-colon payloads
     + per-region extraction. Mutation-tested: deleting stripControlChars
     → test FAILS.
  3. Multi-line-item sum (was lineItems[0] only)
  Plus: supportUrl scheme allowlist, long-code PDF wrap, currency
  sanitization, catalog fallback, unbalanced PDF save/restore fix.

Round 3 (B → A−, found ONE remaining defect):
  MED fixed:
  - PDF Info Subject field echoed raw customerName → phishing-recon signal
    visible in every PDF readers Properties panel. Now constant.
  - PDF body Bill To had raw <script> visible (no XSS but phishing).
    Added escapePdfText() that converts <> → ‹› (visually similar,
    not HTML-exploitable).

Polish:
- Bridge wiring: claim.createdAt as issuedAt, DASHCADDY_SUPPORT_URL env
- Long license codes auto-shrink font in PDF box (13/11/9/7pt tiers)
- Two-page PDF with empty page 2 (PDFKit pagination boundary)

Test counts:
- 131/131 billing pass (was 119 before)
- 1836/1837 full api suite (1 pre-existing public-routes drift unrelated)

When Codex quota returns 2026-08-19 21:26 UTC, re-run judge-artifact.sh
for the canonical verdict and supersede [mm-grade=A] if needed.
 2026-08-14 22:39:22 -07:00
Krystie 503de258b8 [grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work 
Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.
 2026-08-12 17:34:10 -07:00
Hermes 9b9711bf24 DC-057: close checkout-to-license contract drift (grade B)
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details 
Canonical product catalog at src/billing/catalog.js shared by Stripe
Checkout client (src/billing/stripe-client.js), webhook bridge
(scripts/stripe-license-bridge.js), and pricing page
(status/pricing/index.html). One-time payment keyed by productId at
$20/$50/$70/$99 — no more monthly/annual subscription drift.

Bridge resolves duration via metadata.productId (single contract),
requires payment_status === 'paid' before fulfillment (rejects
unpaid/no_payment_required/missing with ack 200), handles
async_payment_succeeded for ACH/SEPA delayed-payment flow. License
persisted to fulfillment-store BEFORE email — SMTP failure path serves
the persisted code via the new /api/v1/billing/lookup/:sessionId
endpoint (the documented customer recovery path).

Layer-1 (event-id) + layer-2 (session-id) idempotency prevent
duplicate issuance. Checkout return URLs derived from
STRIPE_PUBLIC_ORIGIN or STRIPE_ALLOWED_HOSTS (not raw Host header) —
closes host-header-poisoning + session-ID-leak attack class.

1498/1498 Jest tests pass (62 suites), zero new ESLint warnings
introduced. Test files:
  - stripe-license-bridge.test.js (24 tests)
  - billing-lookup.test.js (8 tests, HTTP-level)
  - bridge-lookup-http.test.js (5 tests, uses exported createServer)
  - pricing-page-catalog.test.js (9 tests, per-tier consistency)
  - checkout-origin.test.js (6 tests, host injection rejection)
  - stripe-client.test.js (rewrite for productId + mode:payment)

Bridge code refactored: handleWebhook decomposed into verifySignature +
parseEventBody + checkEventIdempotency + fulfillCheckout +
ensureLicensePersisted (under ESLint complexity=20 cap). New
createServer()/createRequestHandler() factories guarded by
require.main === module.

Removed 3 stale test files from the rolled-back DC-055 attempt.
 2026-08-04 14:18:49 -07:00