| Filename | Latest commit message | Latest commit date |
|---|---|---|
af2729cbb7
All checks were successful
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Successful in 4m57s
op-server ran payment intents through the orchestrator and kept nothing a
caller could read back, and a refund named any transaction id unchecked.
- op-graph: GraphPaymentStore, one `payment` vertex per idempotency key
(UUIDv5, so a replay lands on the same record): amount, outcome, rail,
driver, metadata and the optional `mandate`. A later outcome for the same
key (a replay, a resume after a challenge) updates only the outcome.
- POST /v1/intents takes an optional `mandate` (the payer's signed
authorization, e.g. an agent's approval or standing grant, AP2-style),
stored as given; the response carries `payment_id`.
- GET /v1/payments/{id}: the record, mandate included, and `refunded_minor`
computed from the refunds filed against it (not declined or failed).
- POST /v1/refunds whose original_tx_id names a recorded payment must
refund an approved payment, in its currency, and no more than is left; a
replay of a filed refund is left to the store's idempotency. Other ids
(ledger transactions recorded elsewhere) are unchecked, as before.
Tests: the store round-trips and keeps the mandate across outcomes; over
HTTP a payment is recorded with its mandate, a replayed refund is not a
second one, an over-refund and a wrong currency are refused, a declined
payment has nothing to refund. op-server and op-graph suites pass; the
openpay workspace checks --locked; clippy and rustfmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
|
||
| .. | ||
| src | ||
| tests | ||
| Cargo.toml | ||