efrilmandClaude Opus 5.5
8370851ed2
Adds the 6-digit customer PIN that approves every action moving EnakPoint or EnakCoin on the customer's request (docs/prd-point-coin.md K8, F11, Q16, Q17, PC-301). Migration 000093 adds the PIN columns to customers and the customer_security_events table. PIN data is read and written only through CustomerPinRepository, never the Customer entity, so the hash cannot reach a customer response. Only a bcrypt hash is stored. - /customer/pin: status, OTP (pin_setup, pin_reset), create, change, reset. The OTP must be for that purpose and sent to the customer's own number; the existing OTP validation checks neither. A new PIN is checked (6 digits, confirmed, not one digit, not a run up or down, not the birth date as DDMMYY or YYMMDD) before the OTP is spent. - Five wrong attempts in a row lock the PIN for 30 minutes; the counter is incremented in one statement so attempts at the same time all count, and a lock that ran out starts a new series. A locked PIN is refused even when right. The customer is told by WhatsApp, as there is no push channel to customers yet; only the attempt that reached the limit alerts. - A reset through OTP lifts the lock and holds outgoing transfers for 24 hours; paying and exchanging still work, and a held transfer costs no attempt. - VerifyPin(ctx, customer, pin, action) for the flows that follow, with PIN_NOT_SET, PIN_INVALID (attempts left), PIN_LOCKED and TRANSFER_BLOCKED (until when), which PinErrorResponse turns into distinct codes and statuses. - DELETE /marketing/customers/:id/pin (loyalty managers, reason required) and GET /marketing/customers/:id/security-events, scoped to the organization. Every PIN event is in the security log with IP and user agent. No message or binding error contains a PIN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
40 lines
1.2 KiB
Go
40 lines
1.2 KiB
Go
package models
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// CustomerPinStatus is GET /customer/pin/status.
|
|
type CustomerPinStatus struct {
|
|
HasPin bool `json:"has_pin"`
|
|
LockedUntil *time.Time `json:"locked_until"`
|
|
TransferBlockedUntil *time.Time `json:"transfer_blocked_until"`
|
|
}
|
|
|
|
// CustomerPinOtp is what POST /customer/pin/otp returns: the token to send back with
|
|
// the code the customer received.
|
|
type CustomerPinOtp struct {
|
|
Purpose string `json:"purpose"`
|
|
OtpToken string `json:"otp_token"`
|
|
ExpiresAt time.Time `json:"expires_at"`
|
|
}
|
|
|
|
// CustomerSecurityEventView is one row of GET /marketing/customers/:id/security-events.
|
|
type CustomerSecurityEventView struct {
|
|
ID uuid.UUID `json:"id"`
|
|
Event string `json:"event"`
|
|
ActorUser *uuid.UUID `json:"actor_user,omitempty"`
|
|
Reason *string `json:"reason,omitempty"`
|
|
IPAddress *string `json:"ip_address,omitempty"`
|
|
UserAgent *string `json:"user_agent,omitempty"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
|
|
// CustomerPinRequestInfo is where a PIN request came from, for the security log.
|
|
type CustomerPinRequestInfo struct {
|
|
IPAddress string
|
|
UserAgent string
|
|
}
|