bank tranfer fix

server/implementations/main.cpp

@@ -406,12 +406,28 @@ int main(int argc, char** argv) {
                 // warning is loud, the listening line below reports
                 // crypto=off, and tools/enable-eurc.sh refuses to call an
                 // enable successful without the rail's own load line.
-                std::println(std::cerr,
-                             "catcrafts-server: WARNING: the '{}' rail could not load "
-                             "its chains file ({}) or address pool ({}) — see above. "
-                             "CONTINUING WITHOUT IT: that payment choice is off and "
-                             "the rest of the site is unaffected.",
-                             mode, eurcChainsPath.string(), eurcPoolPath.string());
+                // Name the right files. This message used to describe EURC's
+                // chains file and address pool whichever rail had failed,
+                // which is actively misleading for the transfer rail: the
+                // likeliest way IT fails is a bad BUNQ_API_KEY, and being
+                // told to look at a chains file sends the reader away from
+                // the actual cause.
+                if (mode == "transfer") {
+                    std::println(std::cerr,
+                                 "catcrafts-server: WARNING: the 'transfer' rail could "
+                                 "not load — see above. Usual causes: TRANSFER_IBAN or "
+                                 "TRANSFER_BENEFICIARY unset, or a BUNQ_API_KEY that "
+                                 "bunq refused. CONTINUING WITHOUT IT: bank transfer is "
+                                 "off, so checkout offers only the other rail, and the "
+                                 "rest of the site is unaffected.");
+                } else {
+                    std::println(std::cerr,
+                                 "catcrafts-server: WARNING: the '{}' rail could not load "
+                                 "its chains file ({}) or address pool ({}) — see above. "
+                                 "CONTINUING WITHOUT IT: that payment choice is off and "
+                                 "the rest of the site is unaffected.",
+                                 mode, eurcChainsPath.string(), eurcPoolPath.string());
+                }
                 out.reset();
                 return true;
             }
@@ -425,6 +441,12 @@ int main(int argc, char** argv) {
         if (!build(cryptoMode, rails.crypto)) return 2;
 
         Server::ConfigurePayments(std::move(rails), redirectBase);
+        // The bunq callback, which exists because the API key's IP allowlist
+        // forbids this host from asking bunq anything. Off unless a secret path
+        // is configured.
+        if (const char* v = std::getenv("BUNQ_WEBHOOK_PATH"); v && *v) {
+            Server::ConfigureBunqCallback(transferCreditsPath, v);
+        }
 
         // Invoice signing: the GPG key uid/fingerprint; GNUPGHOME decides the
         // keyring. Unset means unsigned dev invoices with a visible marker.
@@ -496,7 +518,14 @@ int main(int argc, char** argv) {
             if (const char* v = std::getenv("BUNQ_STATE"); v && *v) {
                 statePath = v;
             } else {
-                statePath = ordersPath;
+                // Hung off the CREDITS file, not the orders file, because that
+                // is what MakeRail does — and the two MUST agree. They did not
+                // at first, and the cost is not cosmetic: a machine that ran
+                // both this command and the server would onboard twice against
+                // bunq, and bunq allows as few as TEN setup calls per DAY. Two
+                // conventions for one file is a way to spend that budget on
+                // nothing.
+                statePath = creditsPath;
                 statePath += ".bunq-context.json";
             }
         }
@@ -562,7 +591,18 @@ int main(int argc, char** argv) {
                 std::println(std::cerr, "could not append to {}", file.string());
                 return 1;
             }
-            if (status == "paid") Server::AssignInvoiceNumber(token, now);
+            // Never for a donation, exactly as the automatic paid transition
+            // refuses: nothing was supplied, so there is no invoice, and a
+            // number burned on one leaves a gap-shaped question in a
+            // customer's series. This manual path was missing the guard and
+            // minted a number for the donation CC-16083E on 2026-08-20 while
+            // settling a stuck test payment by hand. That number is spent and
+            // an append-only ledger cannot recall it, which is exactly why
+            // the check belongs on every path that can transition to paid,
+            // not only the one the reconciler takes.
+            if (status == "paid" && !order->donation) {
+                Server::AssignInvoiceNumber(token, now);
+            }
             std::println("{}: {} -> {}", order->reference, order->status, status);
             return 0;
         };