efrilmandClaude Opus 5.5
8370851ed2
Adds the 6-digit customer PIN that approves every action moving EnakPoint or EnakCoin on the customer's request (docs/prd-point-coin.md K8, F11, Q16, Q17, PC-301). Migration 000093 adds the PIN columns to customers and the customer_security_events table. PIN data is read and written only through CustomerPinRepository, never the Customer entity, so the hash cannot reach a customer response. Only a bcrypt hash is stored. - /customer/pin: status, OTP (pin_setup, pin_reset), create, change, reset. The OTP must be for that purpose and sent to the customer's own number; the existing OTP validation checks neither. A new PIN is checked (6 digits, confirmed, not one digit, not a run up or down, not the birth date as DDMMYY or YYMMDD) before the OTP is spent. - Five wrong attempts in a row lock the PIN for 30 minutes; the counter is incremented in one statement so attempts at the same time all count, and a lock that ran out starts a new series. A locked PIN is refused even when right. The customer is told by WhatsApp, as there is no push channel to customers yet; only the attempt that reached the limit alerts. - A reset through OTP lifts the lock and holds outgoing transfers for 24 hours; paying and exchanging still work, and a held transfer costs no attempt. - VerifyPin(ctx, customer, pin, action) for the flows that follow, with PIN_NOT_SET, PIN_INVALID (attempts left), PIN_LOCKED and TRANSFER_BLOCKED (until when), which PinErrorResponse turns into distinct codes and statuses. - DELETE /marketing/customers/:id/pin (loyalty managers, reason required) and GET /marketing/customers/:id/security-events, scoped to the organization. Every PIN event is in the security log with IP and user agent. No message or binding error contains a PIN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.7 KiB
SQL
33 lines
1.7 KiB
SQL
-- Customer PIN (docs/prd-point-coin.md F11, K8). A 6-digit PIN, separate from the
|
|
-- login password, approves everything that moves EnakPoint or EnakCoin on the
|
|
-- customer's request. Only its bcrypt hash is stored.
|
|
ALTER TABLE customers
|
|
ADD COLUMN pin_hash VARCHAR(255),
|
|
ADD COLUMN pin_set_at TIMESTAMP WITH TIME ZONE,
|
|
-- Kept in the database, not a cache, so it cannot be dodged by waiting for a cache
|
|
-- to expire or by hitting another server (Q17).
|
|
ADD COLUMN pin_failed_attempts INT NOT NULL DEFAULT 0,
|
|
ADD COLUMN pin_locked_until TIMESTAMP WITH TIME ZONE,
|
|
-- Outgoing transfers are held for 24 hours after a PIN reset (Q16).
|
|
ADD COLUMN transfer_blocked_until TIMESTAMP WITH TIME ZONE,
|
|
ADD CONSTRAINT chk_customers_pin_failed_attempts CHECK (pin_failed_attempts >= 0);
|
|
|
|
-- Security log of PIN events. Not a balance movement, so not in wallet_transactions.
|
|
CREATE TABLE customer_security_events (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
customer_id UUID NOT NULL REFERENCES customers(id) ON DELETE RESTRICT,
|
|
-- PIN_SET, PIN_CHANGED, PIN_RESET, PIN_FAILED, PIN_LOCKED, PIN_REMOVED_BY_ADMIN
|
|
event VARCHAR(30) NOT NULL,
|
|
-- The admin, for PIN_REMOVED_BY_ADMIN.
|
|
actor_user UUID,
|
|
reason VARCHAR(255),
|
|
ip_address VARCHAR(45),
|
|
user_agent VARCHAR(255),
|
|
created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
|
|
|
|
CONSTRAINT chk_customer_security_events_admin CHECK (
|
|
event <> 'PIN_REMOVED_BY_ADMIN' OR (actor_user IS NOT NULL AND reason IS NOT NULL))
|
|
);
|
|
|
|
CREATE INDEX idx_customer_security_events_customer_id_created_at ON customer_security_events(customer_id, created_at DESC);
|