@riocrypto/common-server 1.0.2928 → 1.0.2930

package/build/helpers/get-order-from-reference.js

@@ -36,7 +36,6 @@ const excludedStatuses = Object.values(common_1.OrderStatus).filter((status) =>
         statusLower === "refundcomplete" ||
         statusLower.includes("failed"));
 });
-const HEX_DIGITS = "0123456789abcdef";
 // Every window of `length` hex characters in the text, lowercase and in the
 // order they appear. A reference has to be a run of hex, so anything else in
 // the concepto is a boundary rather than a candidate.
@@ -50,10 +49,6 @@ const hexWindows = (text, length) => {
     }
     return Array.from(windows);
 };
-// A concepto is short, so a bound this size is never reached by a real payment.
-// It is here so that a pathological text cannot turn the old-format fallback
-// into a query with tens of thousands of keys.
-const MAX_OLD_FORMAT_WINDOWS = 24;
 const getOrderFromReference = (reference, mongoose) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, e_1, _b, _c;
     if (!reference) {
@@ -64,6 +59,13 @@ const getOrderFromReference = (reference, mongoose) => __awaiter(void 0, void 0,
     // New format, exact and indexed. The stored reference is what the customer was
     // shown, upper case, so the windows are compared the same way.
     const newFormatCandidates = hexWindows(reference, NEW_FORMAT_LENGTH).map((window) => window.toUpperCase());
+    const oldFormatWindows = hexWindows(reference, OLD_FORMAT_LENGTH);
+    // A reference is a run of hex, so text without one cannot contain any order's
+    // token in either format. Static references (SPR…) and free text end here
+    // instead of walking the active orders to confirm what is already known.
+    if (!newFormatCandidates.length && !oldFormatWindows.length) {
+        throw new Error("Order not found");
+    }
     if (newFormatCandidates.length) {
         const order = yield Order.findOne({
             "paymentInstructions.reference": { $in: newFormatCandidates },
@@ -73,36 +75,38 @@ const getOrderFromReference = (reference, mongoose) => __awaiter(void 0, void 0,
             return order;
         }
     }
-    const oldFormatWindows = hexWindows(reference, OLD_FORMAT_LENGTH).slice(0, MAX_OLD_FORMAT_WINDOWS);
-    // Buy orders that were never given a stored reference, from before the bank
-    // payment listener wrote one. Only these are still compared against the id in
-    // code. Walked once, with a cursor over a bounded query rather than paging
-    // through every active order with skip, and before the old-format lookup so a
-    // full match here still beats a six-character one anywhere, as it always has.
+    // The indexed lookup missed, so the token is compared against each active buy
+    // order's id the way it always was. This still catches an order whose stored
+    // reference is not its own token, such as one paid through a bulk, and one
+    // that was never given a stored reference at all. It runs only on a miss, so a
+    // burst of valid payments never reaches it, and it is a cursor with an _id
+    // projection rather than skip pagination over the same set. Placed before the
+    // old-format lookup so a full match here still beats a six-character one
+    // anywhere, as it always has.
     const newFormatWindowSet = new Set(newFormatCandidates.map((candidate) => candidate.toLowerCase()));
     const oldFormatWindowSet = new Set(oldFormatWindows);
-    let legacyOldFormatMatchId = null;
-    const legacyOrders = Order.find({
+    let scannedOldFormatMatchId = null;
+    const activeBuyOrders = Order.find({
         status: activeStatus,
         side: common_1.Side.Buy,
-        "paymentInstructions.reference": { $exists: false },
     })
         .select("_id")
         .lean()
         .cursor();
     try {
-        for (var _d = true, legacyOrders_1 = __asyncValues(legacyOrders), legacyOrders_1_1; legacyOrders_1_1 = yield legacyOrders_1.next(), _a = legacyOrders_1_1.done, !_a;) {
-            _c = legacyOrders_1_1.value;
+        for (var _d = true, activeBuyOrders_1 = __asyncValues(activeBuyOrders), activeBuyOrders_1_1; activeBuyOrders_1_1 = yield activeBuyOrders_1.next(), _a = activeBuyOrders_1_1.done, !_a;) {
+            _c = activeBuyOrders_1_1.value;
             _d = false;
             try {
-                const legacy = _c;
-                const orderId = legacy._id.toString().toLowerCase();
+                const candidate = _c;
+                const orderId = candidate._id.toString().toLowerCase();
                 const reference8Chars = orderId.slice(8, 10) + orderId.slice(-6);
                 if (newFormatWindowSet.has(reference8Chars)) {
-                    return Order.findById(legacy._id);
+                    return Order.findById(candidate._id);
                 }
-                if (!legacyOldFormatMatchId && oldFormatWindowSet.has(orderId.slice(-6))) {
-                    legacyOldFormatMatchId = legacy._id;
+                if (!scannedOldFormatMatchId &&
+                    oldFormatWindowSet.has(orderId.slice(-6))) {
+                    scannedOldFormatMatchId = candidate._id;
                 }
             }
             finally {
@@ -113,34 +117,15 @@ const getOrderFromReference = (reference, mongoose) => __awaiter(void 0, void 0,
     catch (e_1_1) { e_1 = { error: e_1_1 }; }
     finally {
         try {
-            if (!_d && !_a && (_b = legacyOrders_1.return)) yield _b.call(legacyOrders_1);
+            if (!_d && !_a && (_b = activeBuyOrders_1.return)) yield _b.call(activeBuyOrders_1);
         }
         finally { if (e_1) throw e_1.error; }
     }
-    // Old format: the payer typed only the last six characters. Those are also the
-    // last six of a stored new-format reference, so each six-character window is
-    // widened to every two-character prefix it could sit behind and looked up on
-    // the same index. 256 keys per window keeps this a point lookup rather than a
-    // scan, which a regex with a leading wildcard could not be.
-    if (oldFormatWindows.length) {
-        const oldFormatCandidates = [];
-        for (const window of oldFormatWindows) {
-            for (const first of HEX_DIGITS) {
-                for (const second of HEX_DIGITS) {
-                    oldFormatCandidates.push((first + second + window).toUpperCase());
-                }
-            }
-        }
-        const order = yield Order.findOne({
-            "paymentInstructions.reference": { $in: oldFormatCandidates },
-            status: activeStatus,
-        }).sort({ createdAt: 1 });
-        if (order) {
-            return order;
-        }
-    }
-    if (legacyOldFormatMatchId) {
-        return Order.findById(legacyOldFormatMatchId);
+    // Old format: the payer typed only the last six characters, and the scan above
+    // found an order ending in them. Used only once no order anywhere matched the
+    // full token.
+    if (scannedOldFormatMatchId) {
+        return Order.findById(scannedOldFormatMatchId);
     }
     throw new Error("Order not found");
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2928",
+  "version": "1.0.2930",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",