Post placeholder payment and refund atomically - #1822
Conversation
|
Warning Review limit reached
Next review available in: 18 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthrough
ChangesPlaceholder refund ledger flow
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/shared/refund-ledger-placeholder.test.ts`:
- Around line 52-66: Replace the presence-only leg-kind checks in the “records
the cash round-trip with no sale leg, netting to zero” test with an exact
assertion matching the expected set of leg kinds, consistent with the sibling
payment-only test. Preserve the existing amount, memo, and balance assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 678338d9-2564-4994-89ac-ccc9abdacdb6
📒 Files selected for processing (3)
src/shared/refund-ledger.tstest/shared/refund-ledger-placeholder.test.tstest/shared/refund-ledger.test.ts
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39ee1e9867
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }), | ||
| ] | ||
| : [payment]; | ||
| await postTransferGroups(groups); |
There was a problem hiding this comment.
When refunded is true and this atomic post rejects the refund group, postWithoutThrowing returns posted: false but the batch leaves no booking event leg at all. The payment flow uses the ledger as the durable replay guard (replaySessionFromLedger treats bookingLedgerDisposition(...).status === "unrecorded" as fresh), and prunePayments later deletes terminal failure_data rows, so a later webhook/redirect for the same already-refunded session can re-enter processing and create another placeholder/refund attempt instead of being acknowledged as handled. Keep some durable handled marker or surface the failure before acknowledging the terminal payment outcome.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Valid concern — recorded in TODO.md (commit 1a12dc9). The atomic rollback is this PR's core requirement: the split plan says "a conflict in the refund leg must roll back the payment leg as well", and the acceptance criterion is "a refund-reference collision proves neither transfer group is committed." Fixing the replay-marker gap without breaking that requires a durable handled marker outside the prunable processed_payments table — the staged-checkout runtime (deferred foundations item 6 in PR_SPLIT_PLAN.md) carries that machinery.
The gap also partially pre-exists on main: before this PR, if the payment post itself failed (reference conflict), no legs landed either, and the same pruning → re-entry path applied. This PR widens the failure surface from "payment-post failure only" to "payment-post or refund-post failure" (because both are now one atomic batch), which is the designed trade-off.
TODO.md has the full context: the preflight (replaySessionFromLedger in src/features/api/payment-processing/index.ts), the pruner (prunePayments in src/shared/db/prune.ts), and the classification (src/shared/session-ledger.ts) are the starting points.
…w-up Replace presence-only .some() leg-kind checks with an exact sorted kind-set assertion, matching the sibling payment-only test and resisting a mutant that adds an unexpected leg. Record the Codex replay-marker concern (no durable ledger legs when the atomic batch fails + idempotency row pruned) in TODO.md for the staged-checkout runtime, since fixing it without breaking the atomic rollback is deferred to that work.
1 participant
A stored-but-refunded placeholder booking records the cash we received and the cash we returned. Before this change, the payment and refund were posted as two separate writes: if the refund leg's reference collided, the payment had already committed and the ledger read as money we still held, even though the provider had already refunded it. The two halves could disagree.
This posts both event groups as one atomic batch through
postTransferGroups, so the payment can never land without its completed refund. The refund mapper maps a reversal of the freshly-built payment legs (viaasOrderLegs) rather than reading them back from storage, so both groups are computed before either is stored and the batch commits both or neither.Scope stays within the placeholder refund path. The attendee refund path (
recordAttendeeRefund) is untouched. Nothing from the staged-checkout work is brought in: no checkout stages, no held-cash admin guards, no staged activation, norefundingtransitions. The shared ledger matching helpers on main (legMatches,postTransferGroups,asOrderLegs) are reused, not paralleled.Acceptance:
posted: true.recordAttendeeRefundbehavior is unchanged; its tests are untouched except for splitting the placeholder suite into its own file for faster, narrower coverage.The placeholder refund tests now cover: the clean cash round-trip (nets to zero, no sale leg), payment-only when the refund did not complete, refund-reference collision rollback, payment-reference collision logging, and the payment-only conflict path.
Summary by CodeRabbit