efrilmandClaude Opus 5.5
8370851ed2
Adds the 6-digit customer PIN that approves every action moving EnakPoint or EnakCoin on the customer's request (docs/prd-point-coin.md K8, F11, Q16, Q17, PC-301). Migration 000093 adds the PIN columns to customers and the customer_security_events table. PIN data is read and written only through CustomerPinRepository, never the Customer entity, so the hash cannot reach a customer response. Only a bcrypt hash is stored. - /customer/pin: status, OTP (pin_setup, pin_reset), create, change, reset. The OTP must be for that purpose and sent to the customer's own number; the existing OTP validation checks neither. A new PIN is checked (6 digits, confirmed, not one digit, not a run up or down, not the birth date as DDMMYY or YYMMDD) before the OTP is spent. - Five wrong attempts in a row lock the PIN for 30 minutes; the counter is incremented in one statement so attempts at the same time all count, and a lock that ran out starts a new series. A locked PIN is refused even when right. The customer is told by WhatsApp, as there is no push channel to customers yet; only the attempt that reached the limit alerts. - A reset through OTP lifts the lock and holds outgoing transfers for 24 hours; paying and exchanging still work, and a held transfer costs no attempt. - VerifyPin(ctx, customer, pin, action) for the flows that follow, with PIN_NOT_SET, PIN_INVALID (attempts left), PIN_LOCKED and TRANSFER_BLOCKED (until when), which PinErrorResponse turns into distinct codes and statuses. - DELETE /marketing/customers/:id/pin (loyalty managers, reason required) and GET /marketing/customers/:id/security-events, scoped to the organization. Every PIN event is in the security log with IP and user agent. No message or binding error contains a PIN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
99 lines
4.3 KiB
Go
99 lines
4.3 KiB
Go
package constants
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
)
|
|
|
|
const (
|
|
InternalServerErrorCode = "900"
|
|
MissingFieldErrorCode = "303"
|
|
MalformedFieldErrorCode = "310"
|
|
ValidationErrorCode = "304"
|
|
InvalidFieldErrorCode = "305"
|
|
NotFoundErrorCode = "404"
|
|
// PIN outcomes the customer app tells apart (docs/prd-point-coin.md ยง9).
|
|
PinNotSetErrorCode = "PIN_NOT_SET"
|
|
PinInvalidErrorCode = "PIN_INVALID"
|
|
PinLockedErrorCode = "PIN_LOCKED"
|
|
TransferBlockedErrorCode = "TRANSFER_BLOCKED"
|
|
TooManyRequestsErrorCode = "429"
|
|
)
|
|
|
|
const (
|
|
RequestEntity = "request"
|
|
UserServiceEntity = "user_service"
|
|
OrganizationServiceEntity = "organization_service"
|
|
CategoryServiceEntity = "category_service"
|
|
ProductServiceEntity = "product_service"
|
|
ProductVariantServiceEntity = "product_variant_service"
|
|
InventoryServiceEntity = "inventory_service"
|
|
OrderServiceEntity = "order_service"
|
|
CustomerServiceEntity = "customer_service"
|
|
UserValidatorEntity = "user_validator"
|
|
AuthHandlerEntity = "auth_handler"
|
|
UserHandlerEntity = "user_handler"
|
|
CategoryHandlerEntity = "category_handler"
|
|
ProductHandlerEntity = "product_handler"
|
|
ProductVariantHandlerEntity = "product_variant_handler"
|
|
InventoryHandlerEntity = "inventory_handler"
|
|
OrderValidatorEntity = "order_validator"
|
|
OrderHandlerEntity = "order_handler"
|
|
OrganizationValidatorEntity = "organization_validator"
|
|
OrgHandlerEntity = "organization_handler"
|
|
PaymentMethodValidatorEntity = "payment_method_validator"
|
|
PaymentMethodHandlerEntity = "payment_method_handler"
|
|
OutletServiceEntity = "outlet_service"
|
|
VendorServiceEntity = "vendor_service"
|
|
PurchaseOrderServiceEntity = "purchase_order_service"
|
|
PurchaseCategoryServiceEntity = "purchase_category_service"
|
|
IngredientUnitConverterServiceEntity = "ingredient_unit_converter_service"
|
|
IngredientCompositionServiceEntity = "ingredient_composition_service"
|
|
TableEntity = "table"
|
|
// Gamification entities
|
|
CustomerPointsEntity = "customer_points"
|
|
CustomerTokensEntity = "customer_tokens"
|
|
TierEntity = "tier"
|
|
GameEntity = "game"
|
|
GamePrizeEntity = "game_prize"
|
|
GamePlayEntity = "game_play"
|
|
OmsetTrackerEntity = "omset_tracker"
|
|
RewardEntity = "reward"
|
|
CampaignEntity = "campaign"
|
|
CampaignRuleEntity = "campaign_rule"
|
|
CustomerEntity = "customer"
|
|
SpinGameHandlerEntity = "spin_game_handler"
|
|
UserDeviceServiceEntity = "user_device_service"
|
|
NotificationServiceEntity = "notification_service"
|
|
NotificationHandlerEntity = "notification_handler"
|
|
ProductOutletPriceServiceEntity = "product_outlet_price_service"
|
|
ExpenseServiceEntity = "expense_service"
|
|
CashAdvanceServiceEntity = "cash_advance_service"
|
|
WalletServiceEntity = "wallet_service"
|
|
LoyaltySettingsServiceEntity = "loyalty_settings_service"
|
|
CustomerPinServiceEntity = "customer_pin_service"
|
|
)
|
|
|
|
var HttpErrorMap = map[string]int{
|
|
InternalServerErrorCode: http.StatusInternalServerError,
|
|
MissingFieldErrorCode: http.StatusBadRequest,
|
|
MalformedFieldErrorCode: http.StatusBadRequest,
|
|
ValidationErrorCode: http.StatusBadRequest,
|
|
InvalidFieldErrorCode: http.StatusBadRequest,
|
|
NotFoundErrorCode: http.StatusNotFound,
|
|
PinNotSetErrorCode: http.StatusForbidden,
|
|
PinInvalidErrorCode: http.StatusBadRequest,
|
|
PinLockedErrorCode: http.StatusLocked,
|
|
TransferBlockedErrorCode: http.StatusForbidden,
|
|
TooManyRequestsErrorCode: http.StatusTooManyRequests,
|
|
}
|
|
|
|
// Error messages
|
|
var (
|
|
ErrPaymentMethodNameRequired = fmt.Errorf("payment method name is required")
|
|
ErrPaymentMethodTypeRequired = fmt.Errorf("payment method type is required")
|
|
ErrInvalidPaymentMethodType = fmt.Errorf("invalid payment method type")
|
|
ErrInvalidPageNumber = fmt.Errorf("page number must be greater than 0")
|
|
ErrInvalidLimit = fmt.Errorf("limit must be between 1 and 100")
|
|
)
|