183 lines
9.1 KiB
C++
183 lines
9.1 KiB
C++
|
/*
|
||
|
|
catcrafts.net
|
||
|
|
Copyright (C) 2026 Catcrafts
|
||
|
|
|
||
|
|
The source code of this website is made available for viewing purposes only.
|
||
|
|
No permission is granted to copy, modify, distribute, or create derivative works.
|
||
|
|
*/
|
||
|
|
|
||
|
|
// The financials page over real HTTP, and the bunq mutation callback that
|
||
|
|
// feeds it. Liveness is the page's promise: the aggregates file appears and
|
||
|
|
// the very next request reflects it — no restart, no cache, no delay. The
|
||
|
|
// callback is the only path by which a stranger's money reaches a public
|
||
|
|
// number, so idempotency, default-deny, and the no-leak guarantees are pinned
|
||
|
|
// against the real endpoint here.
|
||
|
|
|
||
|
|
import std;
|
||
|
|
import Catcrafts.E2eHarness;
|
||
|
|
|
||
|
|
using namespace Catcrafts::E2e;
|
||
|
|
|
||
|
|
namespace {
|
||
|
|
|
||
|
|
// fin_attr <attribute> -> its value on the live page
|
||
|
|
std::string FinAttr(TestServer& srv, std::string_view attr) {
|
||
|
|
const std::string body = srv.Body("/financials");
|
||
|
|
std::smatch m;
|
||
|
|
if (std::regex_search(body, m, std::regex(std::format(R"lit({}="([0-9]*)")lit", attr)))) {
|
||
|
|
return m[1].str();
|
||
|
|
}
|
||
|
|
return {};
|
||
|
|
}
|
||
|
|
|
||
|
|
std::string BunqPayload(std::string_view id, std::string_view account,
|
||
|
|
std::string_view value, std::string_view iban,
|
||
|
|
std::string_view description) {
|
||
|
|
std::string p = R"({"NotificationUrl":{"category":"MUTATION","event_type":"MUTATION_CREATED","object":{"Payment":{"id":)";
|
||
|
|
p += id;
|
||
|
|
p += R"(,"created":"2026-08-15 09:31:02.000000","monetary_account_id":)";
|
||
|
|
p += account;
|
||
|
|
p += R"(,"amount":{"currency":"EUR","value":")";
|
||
|
|
p += value;
|
||
|
|
p += R"("},"description":")";
|
||
|
|
p += description;
|
||
|
|
p += R"(","counterparty_alias":{"iban":")";
|
||
|
|
p += iban;
|
||
|
|
p += R"(","display_name":"Someone"}}}}})";
|
||
|
|
return p;
|
||
|
|
}
|
||
|
|
|
||
|
|
} // namespace
|
||
|
|
|
||
|
|
int main(int argc, char** argv) {
|
||
|
|
// The secret IS the last segment of the callback URL, and setting it is
|
||
|
|
// what brings the endpoint into existence — unset, the path is an
|
||
|
|
// ordinary 404. Note what is NOT here: a bunq API key. One could initiate
|
||
|
|
// payments, so no such key ever reaches the server; it only receives.
|
||
|
|
constexpr std::string_view kSecret = "e2e-callback-secret-not-a-real-one";
|
||
|
|
ServerOptions options;
|
||
|
|
options.env.emplace_back("BUNQ_CALLBACK_SECRET", std::string(kSecret));
|
||
|
|
TestServer srv(argv[1], 8215, options);
|
||
|
|
|
||
|
|
// ── the financials page ───────────────────────────────────────────
|
||
|
|
// Aggregate-only by construction: totals and counts, machine-readable via
|
||
|
|
// the data-fin-* attributes. Live is the page's promise, so it must never
|
||
|
|
// sit in a shared cache.
|
||
|
|
srv.HeaderHas("/financials", "cache-control", "no-store", "financials are never cached");
|
||
|
|
srv.BodyHas("/financials", "data-fin-sales-count=\"0\"", "financials start at zero sales");
|
||
|
|
// Before the bank-aggregates file exists the page says so, and publishes
|
||
|
|
// no donation figures at all — an unknowable €0 would be a lie.
|
||
|
|
srv.BodyHas("/financials", "not been published yet", "unpublished bank figures say so");
|
||
|
|
srv.BodyLacks("/financials", "data-fin-donations-count",
|
||
|
|
"no donation figures before the file exists");
|
||
|
|
|
||
|
|
// The aggregates file appears, exactly as the owner's tooling will write
|
||
|
|
// it, and the very next request reflects it — this is the liveness the
|
||
|
|
// donation counter depends on.
|
||
|
|
WriteFile(std::filesystem::path(srv.Orders().string() + ".financials.json"),
|
||
|
|
R"({"as_of":"2026-08-14",)"
|
||
|
|
"\n"
|
||
|
|
R"( "donations":{"count":3,"total_minor":4500},)"
|
||
|
|
"\n"
|
||
|
|
R"( "expenses":[{"label":"Hosting","total_minor":1200},)"
|
||
|
|
"\n"
|
||
|
|
R"( {"label":"Inventory","total_minor":230000}]})"
|
||
|
|
"\n");
|
||
|
|
srv.BodyHas("/financials", "data-fin-donations-count=\"3\"", "donation count picked up live");
|
||
|
|
srv.BodyHas("/financials", "data-fin-expenses-minor=\"231200\"",
|
||
|
|
"expense total picked up live");
|
||
|
|
// Net = (donations 4500 + sales 0) - expenses 231200. Negative on
|
||
|
|
// purpose: a shop that has bought stock but not sold it is exactly this
|
||
|
|
// shape, and the figure has to survive going below zero.
|
||
|
|
srv.BodyHas("/financials", "data-fin-net-minor=\"-226700\"",
|
||
|
|
"net is published and may be negative");
|
||
|
|
srv.BodyHas("/financials", "€-2267", "a negative net renders with its sign");
|
||
|
|
srv.BodyHas("/financials", "Hosting", "an expense category renders");
|
||
|
|
srv.BodyHas("/financials", "Inventory", "a second expense category renders");
|
||
|
|
srv.BodyHas("/financials", "2026-08-14", "bank figures carry their as-of date");
|
||
|
|
|
||
|
|
// ── the bunq mutation callback ────────────────────────────────────
|
||
|
|
// The rules are written here rather than at startup on purpose — they are
|
||
|
|
// re-read per callback, so a new rule takes effect without a restart.
|
||
|
|
WriteFile(std::filesystem::path(srv.Orders().string() + ".financial-rules.json"),
|
||
|
|
R"({"donation_accounts":[9911],)"
|
||
|
|
"\n"
|
||
|
|
R"( "rules":[{"description_contains":"hetzner","group":"expense","label":"Hosting"},)"
|
||
|
|
"\n"
|
||
|
|
R"( {"iban":"NL01OWNSELF0000000","group":"ignore"}]})"
|
||
|
|
"\n");
|
||
|
|
|
||
|
|
const std::string cb = std::format("/api/bunq/{}", kSecret);
|
||
|
|
auto bunqPost = [&](std::string_view id, std::string_view account,
|
||
|
|
std::string_view value, std::string_view iban,
|
||
|
|
std::string_view description) {
|
||
|
|
return srv.Post(cb, BunqPayload(id, account, value, iban, description),
|
||
|
|
"application/json").status;
|
||
|
|
};
|
||
|
|
|
||
|
|
// An endpoint guarded by a secret must not confirm its own existence:
|
||
|
|
// every unauthorised shape is the same 404 an unknown order token gets.
|
||
|
|
{
|
||
|
|
const auto wrong = srv.Post("/api/bunq/wrong-secret", "{}", "application/json");
|
||
|
|
Check(wrong.status == "404", "POST /api/bunq/wrong-secret -> 404", wrong.status);
|
||
|
|
}
|
||
|
|
srv.CheckStatus(cb, "404"); // GET on the right URL is still not a callback
|
||
|
|
srv.CheckStatus(cb, "404", "HEAD");
|
||
|
|
|
||
|
|
// A donation arrives on the donation account. No rule names the sender —
|
||
|
|
// donors are strangers, which is exactly why the account is what
|
||
|
|
// classifies.
|
||
|
|
Check(bunqPost("4823", "9911", "25.00", "NL55BUNQ2025123456", "Thanks for imsd") == "200",
|
||
|
|
"the callback accepts a mutation");
|
||
|
|
Check(FinAttr(srv, "data-fin-donations-count") == "4"
|
||
|
|
&& FinAttr(srv, "data-fin-donations-minor") == "7000",
|
||
|
|
"a donation ticks the public counter immediately");
|
||
|
|
|
||
|
|
// bunq redelivers a callback it did not see a 2xx for, and can redeliver
|
||
|
|
// one it did. Counting that twice would publish money that never arrived.
|
||
|
|
bunqPost("4823", "9911", "25.00", "NL55BUNQ2025123456", "Thanks for imsd");
|
||
|
|
Check(FinAttr(srv, "data-fin-donations-count") == "4"
|
||
|
|
&& FinAttr(srv, "data-fin-donations-minor") == "7000",
|
||
|
|
"a redelivered mutation is not counted twice");
|
||
|
|
|
||
|
|
// Default-deny: money no rule claims is WITHHELD from the page. It is
|
||
|
|
// logged for classification, never published as a guess.
|
||
|
|
Check(bunqPost("4824", "1234", "90.00", "NL99UNKNOWN00000000", "unlabelled transfer") == "200",
|
||
|
|
"an unclassifiable mutation is still accepted (no redelivery loop)");
|
||
|
|
Check(FinAttr(srv, "data-fin-donations-count") == "4"
|
||
|
|
&& FinAttr(srv, "data-fin-expenses-minor") == "231200",
|
||
|
|
"an unclassified mutation is withheld from every total");
|
||
|
|
|
||
|
|
// An outgoing bill matched by description becomes a positive expense.
|
||
|
|
bunqPost("4825", "9911", "-12.00", "DE00HETZNER00000000", "HETZNER ONLINE GMBH");
|
||
|
|
Check(FinAttr(srv, "data-fin-expenses-minor") == "232400",
|
||
|
|
"an outgoing bill lands in its expense category");
|
||
|
|
srv.BodyHas("/financials", "2026-08-15", "the as-of date advances with the mutations");
|
||
|
|
|
||
|
|
// The page still publishes nothing but aggregates: no counterparty, no
|
||
|
|
// description, no id, no timestamp. This is the assertion that would
|
||
|
|
// catch a well-meant future edit adding a "recent activity" list.
|
||
|
|
for (std::string_view leak : { "NL55BUNQ2025123456", "Someone", "Thanks for imsd",
|
||
|
|
"4823", "09:31" }) {
|
||
|
|
srv.BodyLacks("/financials", std::string(leak),
|
||
|
|
std::format("financials leak no transaction detail ({})", leak));
|
||
|
|
}
|
||
|
|
|
||
|
|
// And nothing identifying was written to disk either — the ingest ledger
|
||
|
|
// holds opaque ids and counters, and no other file learned the donor
|
||
|
|
// exists.
|
||
|
|
{
|
||
|
|
bool persisted = false;
|
||
|
|
for (const auto& entry :
|
||
|
|
std::filesystem::recursive_directory_iterator(srv.Work())) {
|
||
|
|
if (!entry.is_regular_file()) continue;
|
||
|
|
if (ReadFile(entry.path()).find("NL55BUNQ2025123456") != std::string::npos) {
|
||
|
|
persisted = true;
|
||
|
|
std::println(std::cerr, " IBAN found in {}", entry.path().string());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
Check(!persisted, "no counterparty IBAN is persisted anywhere");
|
||
|
|
}
|
||
|
|
|
||
|
|
return Finish();
|
||
|
|
}
|