docs: the register covers every account, and counts itself - #213
Conversation
CLAUDE.md says "the whole list is UNVERIFIED.md". It was not: `grep -ci paypal` returned nothing, and neither did stripe, while both crates carried their readings in prose where kasapay-verify's work list cannot see them. A verification run would never have planned a PayPal call. PayPal's five are now section F, ordered the way sandbox-verification asks — retry safety first. F1 is the most expensive entry in the file: PayPal documents that an omitted refund amount is computed when the request is processed, and separately that a repeated `PayPal-Request-Id` answers the cached response. Which wins when a caller retries an omitted-amount refund after another refund landed in between is documented nowhere, and the wrong reading is money out twice from an ordinary retry loop. Two iyzico readings the register did not carry, both from the same audit. A10: `/payment/preauth` is sent a tokenised `paymentCard`, and the specs give that path `PaymentCard`, which requires five card fields and defines neither token field — not spec silence but a different schema, and every hold this crate can take goes through it. A11: `Provider::capture` with no amount captures whatever `/payment/detail` calls "Total collected amount", which for an uncaptured hold plausibly reads zero. Filing. B3 is a PayTR entry and sat inside section C, "A Terminal API merchant agreement and a Pavo device" — so somebody with a PayTR account worked section B, found two entries, and never reached the one that blocks eleven operations. It says eleven now: its own breakdown is five plus four plus two, and it said nine. The same in kasapay-paytr's lib.rs. The file claims each entry names the issue it came from. Three did not; B3 said "— new". Found with `git log -S` and named. D4 sat between D1 and D2, from the change that added it. And the counts. sandbox-verification and kasapay-verify both said "eighteen", which was right when written and is now 28 — this change alone added ten. They say `grep -c '^### ' UNVERIFIED.md` instead, which is what this repository does everywhere else it counts something. Closes #198 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The previous commit's message claimed this was included and it was not. Five card-vault calls plus the Link API's four plus the Havale/EFT iframe's two is eleven; specs/paytr/latest.yaml documents exactly that many matching pages per language. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 7 minutes Limit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Comment |
1 participant
Closes #198.
CLAUDE.md says "The whole list is
UNVERIFIED.md". It was not:grep -ci paypal UNVERIFIED.mdreturned 0, and so didstripe— while both crates carried their readings in prose, wherekasapay-verify's work list cannot see them. A verification run would never have planned a PayPal call.PayPal is now section F
Five entries, ordered the way
sandbox-verificationasks: retry safety first.F1 is the most expensive entry in the file. PayPal documents that an omitted refund
amountrefunds captured minus previous refunds, computed when the request is processed. They separately document that a repeatedPayPal-Request-Idanswers the cached response rather than processing again. Which one wins when a caller retries an omitted-amount refund after another refund landed in between is documented nowhere — and the wrong reading is money out twice, from an ordinary retry loop.F2–F5: the status-resolution order,
403reading asAuth, the account-level defaultreturn_url/cancel_url, and four calls that use documented shapes but have never been made against a sandbox —separate_capture: truerests on them.Two iyzico readings the register did not carry
A10.
/payment/preauthis sent a tokenisedpaymentCard. The specs give that pathPaymentCard, which requires five card fields and defines neither token field, while/payment/authis documented withPaymentCardSaved, which defines both. That is not spec silence — it is a different schema, and every hold this crate can take goes through it. A7 and A8 rest on it too.A11.
Provider::capturewith no amount captures whatever/payment/detailcalls "Total collected amount" — which for a hold nobody has captured plausibly reads zero. Settles alongside A8 in the same pre-authorisation.Filing
B3 is a PayTR entry and it sat inside section C, "A Terminal API merchant agreement and a Pavo device". So somebody with a PayTR merchant account worked section B, found two entries, and never reached the one that blocks eleven operations.
It says eleven now. Its own breakdown is five plus four plus two, and it said nine —
specs/paytr/latest.yamldocuments exactly eleven matching pages per language. Same correction inkasapay-paytr'slib.rs.The file claims "Each entry names the issue it came from, so the argument that produced it is still readable." Three did not; B3 said "— new". Found with
git log -Sand named: #148, #134, #161.D4 sat between D1 and D2, left there by the change that added it.
And the counts
sandbox-verificationandkasapay-verifyboth said "eighteen". That was right when written; the file now has 28, ten of them from this change alone. They saygrep -c '^### ' UNVERIFIED.mdinstead — which is what this repository does everywhere else it counts something, and precisely the lessonkasapay-specsowns.CI decides.