Catcrafts/catcrafts.net
Watch
2
0
Fork
You've already forked catcrafts.net
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retire the bunq integration
All checks were successful
Deploy / build-deploy (push) Successful in 3m32s
Details

Browse source 
The webhook is deregistered at bunq and the callback endpoint, its parser,
default-deny classifier, dedup ledger and signature check are removed; the
code is in git history if a bank feed ever comes back. /financials keeps
reading the hand-maintained aggregates file, and sales + shop donations
stay live from the order ledger.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Jorijn van der Graaf 2026-08-17 11:36:54 +02:00
commit c31797bd9a
13 changed files with 70 additions and 1694 deletions
Download patch file Download diff file Expand all files Collapse all files

137
tests/ShouldServeFinancialsLive/main.cpp
View file

@ -6,58 +6,18 @@ The source code of this website is made available for viewing purposes only.
No permission is granted to copy, modify, distribute, or create derivative works.
*/
// The financials page over real HTTP, and the bunq mutation callback that
// feeds it. Liveness is the page's promise: the aggregates file appears and
// the very next request reflects it — no restart, no cache, no delay. The
// callback is the only path by which a stranger's money reaches a public
// number, so idempotency, default-deny, and the no-leak guarantees are pinned
// against the real endpoint here.
// The financials page over real HTTP. Liveness is the page's promise: the
// aggregates file appears (written by the owner's tooling — the retired bunq
// callback used to do this; see git history) and the very next request
// reflects it — no restart, no cache, no delay.
import std;
import Catcrafts.E2eHarness;
using namespace Catcrafts::E2e;
namespace {
// fin_attr <attribute> -> its value on the live page
std::string FinAttr(TestServer& srv, std::string_view attr) {
const std::string body = srv.Body("/financials");
std::smatch m;
if (std::regex_search(body, m, std::regex(std::format(R"lit({}="([0-9]*)")lit", attr)))) {
return m[1].str();
}
return {};
}
std::string BunqPayload(std::string_view id, std::string_view account,
std::string_view value, std::string_view iban,
std::string_view description) {
std::string p = R"({"NotificationUrl":{"category":"MUTATION","event_type":"MUTATION_CREATED","object":{"Payment":{"id":)";
p += id;
p += R"(,"created":"2026-08-15 09:31:02.000000","monetary_account_id":)";
p += account;
p += R"(,"amount":{"currency":"EUR","value":")";
p += value;
p += R"("},"description":")";
p += description;
p += R"(","counterparty_alias":{"iban":")";
p += iban;
p += R"(","display_name":"Someone"}}}}})";
return p;
}
} // namespace
int main(int argc, char** argv) {
// The secret IS the last segment of the callback URL, and setting it is
// what brings the endpoint into existence — unset, the path is an
// ordinary 404. Note what is NOT here: a bunq API key. One could initiate
// payments, so no such key ever reaches the server; it only receives.
constexpr std::string_view kSecret = "e2e-callback-secret-not-a-real-one";
ServerOptions options;
options.env.emplace_back("BUNQ_CALLBACK_SECRET", std::string(kSecret));
TestServer srv(argv[1], 8215, options);
TestServer srv(argv[1], 8215);
// ── the financials page ───────────────────────────────────────────
// Aggregate-only by construction: totals and counts, machine-readable via
@ -71,8 +31,8 @@ int main(int argc, char** argv) {
srv.BodyLacks("/financials", "data-fin-donations-count",
"no donation figures before the file exists");
// The aggregates file appears, exactly as the owner's tooling will write
// it, and the very next request reflects it — this is the liveness the
// The aggregates file appears, exactly as the owner's tooling writes it,
// and the very next request reflects it — this is the liveness the
// donation counter depends on.
WriteFile(std::filesystem::path(srv.Orders().string() + ".financials.json"),
R"({"as_of":"2026-08-14",)"
@ -96,88 +56,5 @@ int main(int argc, char** argv) {
srv.BodyHas("/financials", "Inventory", "a second expense category renders");
srv.BodyHas("/financials", "2026-08-14", "bank figures carry their as-of date");
// ── the bunq mutation callback ────────────────────────────────────
// The rules are written here rather than at startup on purpose — they are
// re-read per callback, so a new rule takes effect without a restart.
WriteFile(std::filesystem::path(srv.Orders().string() + ".financial-rules.json"),
R"({"donation_accounts":[9911],)"
"\n"
R"( "rules":[{"description_contains":"hetzner","group":"expense","label":"Hosting"},)"
"\n"
R"( {"iban":"NL01OWNSELF0000000","group":"ignore"}]})"
"\n");
const std::string cb = std::format("/api/bunq/{}", kSecret);
auto bunqPost = [&](std::string_view id, std::string_view account,
std::string_view value, std::string_view iban,
std::string_view description) {
return srv.Post(cb, BunqPayload(id, account, value, iban, description),
"application/json").status;
};
// An endpoint guarded by a secret must not confirm its own existence:
// every unauthorised shape is the same 404 an unknown order token gets.
{
const auto wrong = srv.Post("/api/bunq/wrong-secret", "{}", "application/json");
Check(wrong.status == "404", "POST /api/bunq/wrong-secret -> 404", wrong.status);
}
srv.CheckStatus(cb, "404"); // GET on the right URL is still not a callback
srv.CheckStatus(cb, "404", "HEAD");
// A donation arrives on the donation account. No rule names the sender —
// donors are strangers, which is exactly why the account is what
// classifies.
Check(bunqPost("4823", "9911", "25.00", "NL55BUNQ2025123456", "Thanks for imsd") == "200",
"the callback accepts a mutation");
Check(FinAttr(srv, "data-fin-donations-count") == "4"
&& FinAttr(srv, "data-fin-donations-minor") == "7000",
"a donation ticks the public counter immediately");
// bunq redelivers a callback it did not see a 2xx for, and can redeliver
// one it did. Counting that twice would publish money that never arrived.
bunqPost("4823", "9911", "25.00", "NL55BUNQ2025123456", "Thanks for imsd");
Check(FinAttr(srv, "data-fin-donations-count") == "4"
&& FinAttr(srv, "data-fin-donations-minor") == "7000",
"a redelivered mutation is not counted twice");
// Default-deny: money no rule claims is WITHHELD from the page. It is
// logged for classification, never published as a guess.
Check(bunqPost("4824", "1234", "90.00", "NL99UNKNOWN00000000", "unlabelled transfer") == "200",
"an unclassifiable mutation is still accepted (no redelivery loop)");
Check(FinAttr(srv, "data-fin-donations-count") == "4"
&& FinAttr(srv, "data-fin-expenses-minor") == "231200",
"an unclassified mutation is withheld from every total");
// An outgoing bill matched by description becomes a positive expense.
bunqPost("4825", "9911", "-12.00", "DE00HETZNER00000000", "HETZNER ONLINE GMBH");
Check(FinAttr(srv, "data-fin-expenses-minor") == "232400",
"an outgoing bill lands in its expense category");
srv.BodyHas("/financials", "2026-08-15", "the as-of date advances with the mutations");
// The page still publishes nothing but aggregates: no counterparty, no
// description, no id, no timestamp. This is the assertion that would
// catch a well-meant future edit adding a "recent activity" list.
for (std::string_view leak : { "NL55BUNQ2025123456", "Someone", "Thanks for imsd",
"4823", "09:31" }) {
srv.BodyLacks("/financials", std::string(leak),
std::format("financials leak no transaction detail ({})", leak));
}
// And nothing identifying was written to disk either — the ingest ledger
// holds opaque ids and counters, and no other file learned the donor
// exists.
{
bool persisted = false;
for (const auto& entry :
std::filesystem::recursive_directory_iterator(srv.Work())) {
if (!entry.is_regular_file()) continue;
if (ReadFile(entry.path()).find("NL55BUNQ2025123456") != std::string::npos) {
persisted = true;
std::println(std::cerr, " IBAN found in {}", entry.path().string());
}
}
Check(!persisted, "no counterparty IBAN is persisted anywhere");
}
return Finish();
}