View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0008913 | Taler | merchant backend | public | 2024-06-07 17:58 | 2024-07-25 22:11 |
| Reporter | Florian Dold | Assigned To | Florian Dold | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | no change required | ||
| Target Version | 0.12 | Fixed in Version | 0.12 | ||
| Summary | 0008913: merchant backend has empty /transfers response despite non-empty exchange /deposits response from exchange | ||||
| Description | This seems to happen when the merchant has a different host configured in the payto://x-taler-bank/ URI configured than the actual account in the bank. It looks like some components ignore the host name in the payto://x-taler-bank URI, while others don't. That leads to: * The transfer from the exchange arriving at the merchant's bank account * The exchange giving a non-empty response to /deposits * The merchant's /transfers API returning an empty response While this is a misconfiguration, it would be very difficult to detect in practice, since non of the merchant services log anything about the problem. | ||||
| Additional Information | fdold-work@sapota ~> curl 'https://exchange.regio-taler.fdold.eu/deposits/3J3708839P48NY8MTV6TK40DXYBWDEFZEVJR43SM35AGAVB1TJ6YJQTHMY45Y52KFW8EE8VH47W40SJ2SQSHECAYJBQ2T2REYSGAE48/ZSDH9R5MR98X779KEECZRFZ92NZRZJYZJRVXQ5HYXVXNS2CHY9D0/0REBC67NDXEMSYC1SSJ76Y8D4QZX7SX8NWV9T6A6Y0H4V0R6VCH61R8999GY2FJ79KTREW9SZ0C09SMA25V95S9MN7G5NYBJNCFMQEG/8KY9S7DAKQV9YKW0HNJRZA36CM8CB0FR5CQV6D73RPGWKWM66DVG?merchant_sig=T5HAGMS3CT62GDMT0QWC6FHWT4PRKCCTSA1K3QS09D95M5X4FXYN3EG6B512Q5BTHTJ9Q1AM33VJAT9TNQ3ZC50FWN2Q80VJT59XR3R' { "wtid": "FNN6RK8JRRMJ30JHMP8JTZPGDPTTRW2D9PPVDB9J09SX4RKN9JA0", "execution_time": { "t_s": 1717779129 }, "coin_contribution": "FLODOS:1", "exchange_sig": "188YZWWW1SNHT5H08VGHAPPXG6VWHXMJY1CA9G4W8F8R1KKJY0653X3NT98P9PEG69E3W2JN68B39V3RQE4WRRT6RBYM4NYTF64NA30", "exchange_pub": "WJFB76CW0BYJ89SGHPPK4R5ZZQBBM11N25VS2GPNE3S425WGHEGG" } fdold-work@sapota ~> curl -H "Authorization: Bearer secret-token:test" https://backend.regio-taler.fdold.eu/private/transfers { "transfers": [] } fdold-work@sapota ~> curl -H "Authorization: Bearer secret-token:test" https://backend.regio-taler.fdold.eu/private/accounts { "accounts": [ { "payto_uri": "payto://x-taler-bank/bank.regiotaler.fdold.eu/mymerchant?receiver-name=My+Merchant", "h_wire": "3J3708839P48NY8MTV6TK40DXYBWDEFZEVJR43SM35AGAVB1TJ6YJQTHMY45Y52KFW8EE8VH47W40SJ2SQSHECAYJBQ2T2REYSGAE48" } ] } fdold-work@sapota ~> curl -u mymerchant:test https://bank.regio-taler.fdold.eu/accounts/mymerchant | jq . { "name": "My Merchant", "balance": { "amount": "FLODOS:3", "credit_debit_indicator": "credit" }, "payto_uri": "payto://x-taler-bank/bank.regio-taler.fdold.eu/mymerchant?receiver-name=My%20Merchant", "debit_threshold": "FLODOS:0", "contact_data": { "email": null, "phone": null }, "is_public": true, "is_taler_exchange": false, "status": "active" } # Notice the mismatch: # At libeufin-bank: # payto://x-taler-bank/bank.regio-taler.fdold.eu/mymerchant?receiver-name=My%20Merchant" # vs at the merchant backend (missing dash in hostname) # payto://x-taler-bank/bank.regiotaler.fdold.eu/mymerchant?receiver-name=My+Merchant | ||||
| Tags | No tags attached. | ||||
| Are you sure? taler-merchant-wirewatch.c seems to have a warning in line 404 which SHOULD trigger if lookup_transfer failed to find the WTID after insertion returned 0, and insertion should return 0 only if the record either already existed, OR if the account doesn't yet exist. So to me (not having tried to reproduce this), the 404 line seems to log exactly the payto://-URI that would be troublesome. | |
| This was actually based on my misunderstanding of how the merchant's /transfers API works. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-06-07 17:58 | Florian Dold | New Issue | |
| 2024-06-07 17:58 | Florian Dold | Status | new => assigned |
| 2024-06-07 17:58 | Florian Dold | Assigned To | => Christian Grothoff |
| 2024-06-07 17:58 | Florian Dold | Additional Information Updated | |
| 2024-06-07 18:01 | Florian Dold | Additional Information Updated | |
| 2024-06-16 10:46 | Christian Grothoff | Note Added: 0022616 | |
| 2024-06-16 10:46 | Christian Grothoff | Assigned To | Christian Grothoff => Florian Dold |
| 2024-06-16 10:46 | Christian Grothoff | Status | assigned => feedback |
| 2024-06-16 14:33 | Florian Dold | Status | feedback => informing |
| 2024-06-16 14:33 | Florian Dold | Resolution | open => no change required |
| 2024-06-16 14:33 | Florian Dold | Note Added: 0022619 | |
| 2024-07-25 22:11 | Christian Grothoff | Fixed in Version | => 0.12 |
| 2024-07-25 22:11 | Christian Grothoff | Status | informing => closed |
| 2025-03-22 13:09 | Christian Grothoff | Category | mechant backend => merchant backend |