@riocrypto/common-server 1.0.2927 → 1.0.2929

package/build/helpers/get-order-from-reference.js

@@ -8,72 +8,125 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getOrderFromReference = void 0;
 const order_1 = require("../models/order");
 const common_1 = require("@riocrypto/common");
+// A reference is 8 hex characters of the order id (two from the random bytes
+// plus the last six); older orders were referenced by the last six alone. The
+// payer types it into a concepto that can carry anything else around it, so
+// matching has always been "does the text contain the token", and that is what
+// is preserved here.
+const NEW_FORMAT_LENGTH = 8;
+const OLD_FORMAT_LENGTH = 6;
+// Statuses a payment can no longer be applied to. Anything failed is included
+// by name so that a status added later is excluded without a change here.
+const excludedStatuses = Object.values(common_1.OrderStatus).filter((status) => {
+    const statusLower = status.toLowerCase();
+    return (statusLower === "complete" ||
+        statusLower === "cancelled" ||
+        statusLower === "expired" ||
+        statusLower === "refundcomplete" ||
+        statusLower.includes("failed"));
+});
+// Every window of `length` hex characters in the text, lowercase and in the
+// order they appear. A reference has to be a run of hex, so anything else in
+// the concepto is a boundary rather than a candidate.
+const hexWindows = (text, length) => {
+    var _a;
+    const windows = new Set();
+    for (const run of (_a = text.toLowerCase().match(/[0-9a-f]+/g)) !== null && _a !== void 0 ? _a : []) {
+        for (let i = 0; i + length <= run.length; i += 1) {
+            windows.add(run.slice(i, i + length));
+        }
+    }
+    return Array.from(windows);
+};
 const getOrderFromReference = (reference, mongoose) => __awaiter(void 0, void 0, void 0, function* () {
-    // Ensure reference is defined
+    var _a, e_1, _b, _c;
     if (!reference) {
         throw new Error("Invalid reference. Reference cannot be empty.");
     }
-    // Convert reference to lowercase to ensure case-insensitive comparison
-    const referenceText = reference.toLowerCase();
     const Order = (0, order_1.buildOrder)(mongoose);
-    // Define statuses to exclude (completed, cancelled, and any failed status)
-    const excludedStatuses = Object.values(common_1.OrderStatus).filter((status) => {
-        const statusLower = status.toLowerCase();
-        return (statusLower === "complete" ||
-            statusLower === "cancelled" ||
-            statusLower === "expired" ||
-            statusLower === "refundcomplete" ||
-            statusLower.includes("failed"));
-    });
-    // Process in batches to avoid memory issues
-    const batchSize = 1000;
-    let skip = 0;
-    let foundOrder = null;
-    let foundOrderOldFormat = null;
-    while (!foundOrder) {
-        // Query only active orders (exclude completed/cancelled/failed) in batches
-        const orders = yield Order.find({
-            status: { $nin: excludedStatuses },
-        })
-            .select("_id") // Only select the ID field to minimize memory usage
-            .skip(skip)
-            .limit(batchSize)
-            .lean(); // Use lean() for better performance
-        // If no more orders, break the loop
-        if (orders.length === 0) {
-            break;
+    const activeStatus = { $nin: excludedStatuses };
+    // New format, exact and indexed. The stored reference is what the customer was
+    // shown, upper case, so the windows are compared the same way.
+    const newFormatCandidates = hexWindows(reference, NEW_FORMAT_LENGTH).map((window) => window.toUpperCase());
+    const oldFormatWindows = hexWindows(reference, OLD_FORMAT_LENGTH);
+    // A reference is a run of hex, so text without one cannot contain any order's
+    // token in either format. Static references (SPR…) and free text end here
+    // instead of walking the active orders to confirm what is already known.
+    if (!newFormatCandidates.length && !oldFormatWindows.length) {
+        throw new Error("Order not found");
+    }
+    if (newFormatCandidates.length) {
+        const order = yield Order.findOne({
+            "paymentInstructions.reference": { $in: newFormatCandidates },
+            status: activeStatus,
+        }).sort({ createdAt: 1 });
+        if (order) {
+            return order;
         }
-        // Check each order ID against the reference
-        // Priority 1: New format - 2 chars from random portion (8-9) + last 6 chars
-        // Priority 2: Old format - just last 6 chars (backwards compatibility)
-        for (const order of orders) {
-            const orderId = order._id.toString().toLowerCase();
-            const randomPrefix = orderId.slice(8, 10);
-            const last6 = orderId.slice(-6);
-            const reference8Chars = randomPrefix + last6;
-            // Check new 8-char format first (takes priority)
-            if (referenceText.includes(reference8Chars)) {
-                foundOrder = yield Order.findById(order._id);
-                break;
+    }
+    // The indexed lookup missed, so the token is compared against each active buy
+    // order's id the way it always was. This still catches an order whose stored
+    // reference is not its own token, such as one paid through a bulk, and one
+    // that was never given a stored reference at all. It runs only on a miss, so a
+    // burst of valid payments never reaches it, and it is a cursor with an _id
+    // projection rather than skip pagination over the same set. Placed before the
+    // old-format lookup so a full match here still beats a six-character one
+    // anywhere, as it always has.
+    const newFormatWindowSet = new Set(newFormatCandidates.map((candidate) => candidate.toLowerCase()));
+    const oldFormatWindowSet = new Set(oldFormatWindows);
+    let scannedOldFormatMatchId = null;
+    const activeBuyOrders = Order.find({
+        status: activeStatus,
+        side: common_1.Side.Buy,
+    })
+        .select("_id")
+        .lean()
+        .cursor();
+    try {
+        for (var _d = true, activeBuyOrders_1 = __asyncValues(activeBuyOrders), activeBuyOrders_1_1; activeBuyOrders_1_1 = yield activeBuyOrders_1.next(), _a = activeBuyOrders_1_1.done, !_a;) {
+            _c = activeBuyOrders_1_1.value;
+            _d = false;
+            try {
+                const candidate = _c;
+                const orderId = candidate._id.toString().toLowerCase();
+                const reference8Chars = orderId.slice(8, 10) + orderId.slice(-6);
+                if (newFormatWindowSet.has(reference8Chars)) {
+                    return Order.findById(candidate._id);
+                }
+                if (!scannedOldFormatMatchId &&
+                    oldFormatWindowSet.has(orderId.slice(-6))) {
+                    scannedOldFormatMatchId = candidate._id;
+                }
             }
-            // Track old 6-char format match as fallback (only if no 8-char match yet)
-            if (!foundOrderOldFormat && referenceText.includes(last6)) {
-                foundOrderOldFormat = yield Order.findById(order._id);
+            finally {
+                _d = true;
             }
         }
-        skip += batchSize;
     }
-    // Use 8-char match if found, otherwise fall back to 6-char match
-    if (!foundOrder && foundOrderOldFormat) {
-        foundOrder = foundOrderOldFormat;
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (!_d && !_a && (_b = activeBuyOrders_1.return)) yield _b.call(activeBuyOrders_1);
+        }
+        finally { if (e_1) throw e_1.error; }
     }
-    if (!foundOrder) {
-        throw new Error("Order not found");
+    // Old format: the payer typed only the last six characters, and the scan above
+    // found an order ending in them. Used only once no order anywhere matched the
+    // full token.
+    if (scannedOldFormatMatchId) {
+        return Order.findById(scannedOldFormatMatchId);
     }
-    return foundOrder;
+    throw new Error("Order not found");
 });
 exports.getOrderFromReference = getOrderFromReference;

package/build/models/order.js

@@ -412,6 +412,11 @@ const buildOrder = (mongoose) => {
     orderSchema.index({ status: 1, createdAt: 1 });
     orderSchema.index({ clientReferenceId: 1 }, { sparse: true });
     orderSchema.index({ "paymentsReceived.blockchainTxId": 1 }, { sparse: true });
+    // Every inbound bank deposit is matched to its order by the reference the
+    // customer typed. Before this, that meant loading every active order and
+    // comparing ids in code on each webhook, which under a burst of payments held
+    // the fintoc pod long enough for its liveness probe to kill it mid-deposit.
+    orderSchema.index({ "paymentInstructions.reference": 1 }, { sparse: true });
     // At most one order per real quoteId. Imported orders use quoteId "" and are
     // excluded by the partial filter (which also serves the createOrder lookup).
     orderSchema.index({ quoteId: 1 }, { unique: true, partialFilterExpression: { quoteId: { $gt: "" } } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2927",
+  "version": "1.0.2929",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",