core/php-commerce
8
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
10 commits 2 branches 0 tags 463 KiB
Commit graph

10 commits

This branch
This branch
All branches
Author SHA1 Message Date
Snider
2e5cd499b9 security: complete rate limiting and fraud service implementation (P1-040) 
Add missing files from P1-040/P1-041 implementation:
- CheckoutRateLimitException for 429 responses when rate limit exceeded
- FraudAssessment data object for fraud scoring results
- FraudService for velocity checks and Stripe Radar integration
- Register services in Boot.php
- Add fraud detection configuration in config.php
- Add CouponServiceTest for input sanitisation

The CheckoutRateLimiter (already tracked) is now properly integrated with
the exception handling, and the FraudService provides defence-in-depth
with velocity-based and geo-anomaly detection.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 16:09:29 +00:00
Snider
26e30cca83 security: add fraud scoring integration and coupon code sanitisation 
P1-040: Verified rate limiting already integrated in checkout flow
P1-041: Integrated FraudService into checkout and webhook handlers
P1-042: Added coupon code sanitisation in CouponService

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 13:14:47 +00:00
Snider
c19e467735 security: add webhook idempotency and payment amount verification 
Idempotency (replay attack protection):
- Add WebhookEvent model for tracking processed events
- Add webhook_events migration with unique constraint
- Add isAlreadyProcessed() to BTCPay and Stripe controllers
- Reject duplicate events with 200 response

Payment amount verification (BTCPay):
- Add verifyPaymentAmount() method
- Reject underpayments (mark order failed, create audit record)
- Reject currency mismatches
- Log overpayments for manual review
- Add 0.01 tolerance for floating point precision

Add comprehensive tests for both features.
Update TODO.md to mark P1 issues as fixed.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-29 12:32:25 +00:00
Snider
9113cede8a fix: remove FK to non-existent invoice_items, shorten index names 
- Remove FK constraint to invoice_items table (not yet created)
- Shorten index names to avoid MariaDB 64-char limit

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-28 19:46:15 +00:00
Snider
eca97466b8 fix: remove FK constraints to non-existent orders/refunds tables 
Credit notes can exist independently of orders. Foreign keys will be
added when orders and refunds modules are implemented.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-28 17:23:48 +00:00
Snider
8b0eac7bef docs: tailor CLAUDE.md to core-commerce package 
Replace generic Core PHP Framework template with documentation specific
to this commerce package, including service layer architecture, payment
gateways, domain events, and correct directory structure.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-28 14:09:01 +00:00
Snider
8f27fe85c3 refactor: update Tenant module imports after namespace migration 
Updates all references from Core\Mod\Tenant to Core\Tenant following
the monorepo separation. The Tenant module now lives in its own package
with the simplified namespace.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-27 17:39:12 +00:00
Snider
a774f4e285 refactor: migrate namespace from Core\Commerce to Core\Mod\Commerce 
Align commerce module with the monorepo module structure by updating
all namespaces to use the Core\Mod\Commerce convention. This change
supports the recent monorepo separation and ensures consistency with
other modules.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-27 16:23:12 +00:00
Snider
a74a02f406 monorepo sepration 2026-01-27 00:24:22 +00:00
Snider
aa53f48850
Initial commit 2026-01-26 23:18:22 +00:00