View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0010185 | Taler | merchant portal webui | public | 2025-07-16 05:19 | 2025-08-31 17:09 |
| Reporter | Nemael | Assigned To | Christian Grothoff | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Platform | Any (this is just curl requests) | OS | Any | OS Version | Any |
| Product Version | 1.0 | ||||
| Target Version | 1.0 stretch goals | Fixed in Version | 1.0 stretch goals | ||
| Summary | 0010185: Bad response when trying to reach /private/orders endpoint with valid token | ||||
| Description | When trying to reach for endpoint https://backend.demo.taler.net/instances/sandbox/private/orders via request, as shown in the documentation, to obtain a list of stored orders, I receive this an error response ENDPOINT: https://backend.demo.taler.net/instances/sandbox/private/orders REQUEST: curl --request GET \ --url https://backend.demo.taler.net/instances/sandbox/private/orders \ --header 'Authorization: Bearer secret-token:J40AKS13K6FX1MG1E5PYQYWB3P1F6F2CDX2142CNVEG843VP4A40' \ --header 'User-Agent: TalerOdoo/insomnia/11.3.0' RESPONSE: { "code": 2008, "hint": "The contract obtained from the merchant backend was malformed." } The supplied token is new and not expired, and I tried plenty of different ways to have the query, but none worked to this endpoint. As an example, when I use an equivalent request on another endpoint to get a specific OrderId's information, I get a valid response. ENDPOINT: https://backend.demo.taler.net/instances/sandbox/private/orders/2025.197-0203D0517RDW0 REQUEST: curl --request GET \ --url https://backend.demo.taler.net/instances/sandbox/private/orders/2025.197-0203D0517RDW0 \ --header 'Authorization: Bearer secret-token:J40AKS13K6FX1MG1E5PYQYWB3P1F6F2CDX2142CNVEG843VP4A40' \ --header 'User-Agent: TalerOdoo/insomnia/11.3.0' RESPONSE: (Warning, long text) { "order_status_url": "https://backend.demo.taler.net/instances/sandbox/orders/2025.197-0203D0517RDW0?token=BMW8594AA6WKZE4062VD7NT9PR", "contract_terms": { "version": 0, "summary": "gggga", "minimum_age": 0, "products": [], "h_wire": "M7QJMWQC542YAQMRN78Q3JFG4TZTJVGS2CTR3H1FCYZYAKMKKWRHNV29CWYZP8AEB84NSZ3CVGF6TA21C031V1BM83PJRNCGC9M6AFR", "wire_method": "iban", "order_id": "2025.197-0203D0517RDW0", "timestamp": { "t_s": 1752641412 }, "pay_deadline": { "t_s": 1752645011 }, "wire_transfer_deadline": { "t_s": 1752727811 }, "merchant_base_url": "https://backend.demo.taler.net/instances/sandbox/", "merchant": { "name": "sandbox merchant", "address": {}, "jurisdiction": {} }, "merchant_pub": "74DV5N6T2ANY1DJFMD41BN7KJYXK70S18CM22TQABEYMA2GSDRD0", "exchanges": [ { "url": "https://exchange.demo.taler.net/", "priority": 0, "max_contribution": "KUDOS:3", "master_pub": "F80MFRG8HVH6R9CQ47KRFQSJP3T6DBJ4K1D9B703RJY3Z39TBMJ0" } ], "max_fee": "KUDOS:0", "amount": "KUDOS:3", "refund_deadline": { "t_s": 1752727811 }, "nonce": "8HPKXRK4ZQZ54FYTK4RN6XP77Q4997PVRTNBP8ZE96CF15N40EGG" }, "order_status": "claimed" } | ||||
| Steps To Reproduce | Send request, with valid token, to get the list of Order to endpoint https://backend.demo.taler.net/instances/sandbox/private/orders | ||||
| Additional Information | Please reach out to panouillot.mael@gmail.com if you have any questions. | ||||
| Tags | No tags attached. | ||||
| I just did *exactly* the same request, except with a bearer token I got myself because yours had expired. I get: $ curl --request GET --url https://backend.demo.taler.net/instances/sandbox/private/orders --header 'Authorization: Bearer secret-token:JQSSEEWWWFWT68QY5XE29VAPCFQ1CRDKQFEEH9DZNANQDKJ0WGBG' --header 'User-Agent: TalerOdoo/insomnia/11.3.0' { "orders": [ { "order_id": "2025.198-00W23V9PKE87C", "row_id": 7321, "timestamp": { "t_s": 1752743941 }, "amount": "KUDOS:0.7", "summary": "Coffee", "refundable": false, "paid": true }, ... { "order_id": "2025.191-03W6G8S5FAT92", "row_id": 6182, "timestamp": { "t_s": 1752130548 }, "amount": "KUDOS:0.7", "summary": "Coffee", "refundable": false, "paid": true } ] } | |
| Ah, I have a theory: a v1-style order was in the list of orders at the time. V1 style order lacked the "amount" field, causing the error (line 397). But, since then, the v1 order went unpaid, was auto-deleted, and thus the API works again. That should explain everything! | |
| Fixed in d989aa13..8fc8be0d. Thanks for reporting!!! | |
| (Note that the fix has not yet been deployed to demo, so IF v1 contracts re-appear on demo, you may see the problem again.) | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-07-16 05:19 | Nemael | New Issue | |
| 2025-07-16 08:02 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2025-07-16 08:02 | Christian Grothoff | Status | new => assigned |
| 2025-07-17 11:57 | Christian Grothoff | Note Added: 0025511 | |
| 2025-07-17 12:00 | Christian Grothoff | Note Added: 0025512 | |
| 2025-07-17 12:27 | Christian Grothoff | Note Added: 0025513 | |
| 2025-07-17 12:28 | Christian Grothoff | Status | assigned => informing |
| 2025-07-17 12:28 | Christian Grothoff | Resolution | open => fixed |
| 2025-07-17 12:28 | Christian Grothoff | Fixed in Version | => 1.0 stretch goals |
| 2025-07-17 12:28 | Christian Grothoff | Note Added: 0025514 | |
| 2025-07-17 12:28 | Christian Grothoff | Target Version | => 1.0 stretch goals |
| 2025-08-31 17:09 | Christian Grothoff | Status | informing => closed |
| 2026-08-23 14:18 | Florian Dold | Category | merchant backoffice SPA => merchant portal webui |