openpitstop 1.0.0

package/demo-repo-fintech/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "pitstop-demo-fintech",
+  "version": "0.0.0",
+  "private": true,
+  "description": "OpenPitStop's intentionally-broken fintech demo API — a payment endpoint with NO idempotency guard",
+  "scripts": {
+    "start": "node src/server.js",
+    "test": "node --test"
+  },
+  "dependencies": {
+    "express": "^4.18.2",
+    "razorpay": "^2.9.4"
+  }
+}

package/demo-repo-fintech/pitstop-repro-ledger-order-ord-conc-1-charged-2.test.mjs

@@ -0,0 +1,175 @@
+// ==============================================================================
+// OpenPitStop permanent repro test — finding ledger-18f7bcc7
+// Linked from .pitstop/scan-latest.json (issue / cluster finding id ledger-18f7bcc7).
+//
+// Scenario: concurrent-double-submit on /api/orders/:id/charge
+//   order ord_conc_1 · idempotency key idem_conc_1
+//   Gateway contract: exactly ONE charge for key "pay_idem_conc_1"
+//   (observed now: 2 charges — the bug this test exists to guard).
+//
+// Run via: npx openpitstop repro ledger-18f7bcc7
+// The app is booted under OpenPitStop's nock sandbox, so no request can ever reach
+// a real payment gateway; the "gateway" is a local mock that records every call.
+// This test MUST FAIL on the buggy code and MUST PASS only after the fix.
+// ==============================================================================
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const REPO = process.cwd();
+const PRELOAD = process.env.PITSTOP_LEDGER_PRELOAD;
+const GATEWAY_HOST = "https://api.razorpay.com";
+const ENDPOINT = "/api/orders/:id/charge";
+const SCENARIO = "concurrent-double-submit";
+const ORDER_ID = "ord_conc_1";
+const IDEM_KEY = "idem_conc_1";
+const EXPECTED_KEY = "pay_idem_conc_1";
+const AMOUNT = 1000;
+const CURRENCY = "INR";
+const NODE_BASED = new Set(["node","node.exe","nodejs","npm","npm.cmd","npx","npx.cmd","yarn","yarn.cmd","pnpm","pnpm.cmd","tsx","ts-node","babel-node","ojs","vitest","jest"]);
+
+import { spawn } from "node:child_process";
+import { readFileSync, mkdirSync, existsSync } from "node:fs";
+import net from "node:net";
+import path from "node:path";
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const s = net.createServer();
+    s.unref();
+    s.on("error", reject);
+    s.listen(0, () => {
+      const p = s.address().port;
+      s.close(() => resolve(p));
+    });
+  });
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function resolveStart() {
+  const pkg = JSON.parse(readFileSync(path.join(REPO, "package.json"), "utf8"));
+  const start = (pkg.scripts && pkg.scripts.start) || "";
+  if (!start) throw new Error("no start script in package.json");
+  const tokens = start.trim().split(/\s+/);
+  if (!NODE_BASED.has(tokens[0])) {
+    throw new Error("start script runs " + tokens[0] + ", which is not Node-based — refusing");
+  }
+  return { cmd: tokens[0], args: tokens.slice(1) };
+}
+
+function resolvePath(route, orderId) {
+  return route
+    .replace(/:([A-Za-z_][\w-]*)/g, (_, name) => (/id|order/i.test(name) ? orderId : name))
+    .replace(/\{([A-Za-z_][\w-]*)\}/g, (_, name) => (/id|order/i.test(name) ? orderId : name));
+}
+
+async function post(baseUrl, p, body, headers) {
+  try {
+    const res = await fetch(baseUrl + p, { method: "POST", headers, body: JSON.stringify(body) });
+    await res.text().catch(() => "");
+    return res.status;
+  } catch {
+    return 0;
+  }
+}
+
+function controlHas(controlPath, needle) {
+  if (!existsSync(controlPath)) return false;
+  try {
+    return readFileSync(controlPath, "utf8").split(/\r?\n/).some((l) => l.includes(needle));
+  } catch {
+    return false;
+  }
+}
+
+function countCharges(gatewayLogPath) {
+  if (!existsSync(gatewayLogPath)) return [];
+  const out = [];
+  for (const line of readFileSync(gatewayLogPath, "utf8").split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      const e = JSON.parse(t);
+      if (e.charge && e.key === EXPECTED_KEY) out.push(e);
+    } catch {}
+  }
+  return out;
+}
+
+test("pitstop repro ledger-18f7bcc7: exactly one gateway charge for key '" + EXPECTED_KEY + "'", async () => {
+  assert.ok(PRELOAD, "PITSTOP_LEDGER_PRELOAD not set — run this via `npx openpitstop repro ledger-18f7bcc7`");
+
+  const start = resolveStart();
+  const runDir = path.join(REPO, ".pitstop", "repro", new Date().toISOString().replace(/[:.]/g, "-"));
+  mkdirSync(runDir, { recursive: true });
+  const controlPath = path.join(runDir, "control.jsonl");
+  const gatewayLogPath = path.join(runDir, "gateway.log.jsonl");
+  const port = await freePort();
+  const baseUrl = "http://127.0.0.1:" + port;
+
+  const env = {
+    ...process.env,
+    NODE_OPTIONS: [process.env.NODE_OPTIONS, "--require=" + PRELOAD].filter(Boolean).join(" "),
+    PORT: String(port),
+    PITSTOP_LEDGER_CONTROL: controlPath,
+    PITSTOP_LEDGER_GATEWAY_LOG: gatewayLogPath,
+    PITSTOP_LEDGER_GATEWAY_HOSTS: GATEWAY_HOST,
+    RAZORPAY_KEY_ID: process.env.RAZORPAY_KEY_ID || "rzp_test_pitstop000000",
+    RAZORPAY_KEY_SECRET: process.env.RAZORPAY_KEY_SECRET || "pitstop_fake_secret",
+    STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY || "sk_test_pitstop_fake",
+    NODE_ENV: process.env.NODE_ENV || "test",
+  };
+  const child = spawn(start.cmd, start.args, { cwd: REPO, env, stdio: ["ignore", "ignore", "inherit"] });
+  try {
+    const deadline = Date.now() + 25000;
+    let up = false;
+    while (Date.now() < deadline) {
+      if (child.exitCode !== null) break;
+      if (controlHas(controlPath, '"event":"armed"')) {
+        try {
+          await fetch(baseUrl + "/__pitstop_ledger_probe__");
+          up = true;
+          break;
+        } catch {}
+      }
+      await sleep(150);
+    }
+    assert.ok(up, "app did not come up under the sandbox within 25s (" + start.cmd + " " + start.args.join(" ") + ")");
+    assert.ok(!controlHas(controlPath, '"event":"abort"'), "sandbox aborted during startup");
+
+    if (SCENARIO === "concurrent-double-submit" || SCENARIO === "delayed-retry") {
+      const reqBody = { amount: AMOUNT, currency: CURRENCY };
+      const headers = { "Content-Type": "application/json", ...(IDEM_KEY ? { "Idempotency-Key": IDEM_KEY } : {}) };
+      const p = resolvePath(ENDPOINT, ORDER_ID);
+      if (SCENARIO === "concurrent-double-submit") {
+        await Promise.all([post(baseUrl, p, reqBody, headers), post(baseUrl, p, reqBody, headers)]);
+      } else {
+        await post(baseUrl, p, reqBody, headers);
+        await sleep(2000);
+        await post(baseUrl, p, reqBody, headers);
+      }
+    } else {
+      const payload = {
+        event: "payment.captured",
+        id: ORDER_ID + "_evt",
+        payload: { payment: { entity: { id: EXPECTED_KEY, amount: AMOUNT, currency: CURRENCY, order_id: ORDER_ID } } },
+      };
+      const headers = { "Content-Type": "application/json" };
+      await post(baseUrl, ENDPOINT, payload, headers);
+      await sleep(300);
+      await post(baseUrl, ENDPOINT, payload, headers);
+    }
+
+    await sleep(400);
+    assert.ok(!controlHas(controlPath, '"event":"abort"'), "sandbox aborted during the attack");
+    const charges = countCharges(gatewayLogPath);
+    assert.equal(
+      charges.length,
+      1,
+      "expected exactly 1 gateway charge for key '" + EXPECTED_KEY + "', saw " + charges.length +
+      ". This repro proves the idempotency bug: it FAILS on the buggy code and must PASS only after the fix.",
+    );
+  } finally {
+    try { child.kill(); } catch {}
+  }
+});

package/demo-repo-fintech/pitstop-repro-ledger-order-ord-retry-2-charged-2.test.mjs

@@ -0,0 +1,175 @@
+// ==============================================================================
+// OpenPitStop permanent repro test — finding ledger-46f2bb8e
+// Linked from .pitstop/scan-latest.json (issue / cluster finding id ledger-46f2bb8e).
+//
+// Scenario: delayed-retry on /api/orders/:id/charge
+//   order ord_retry_2 · idempotency key idem_retry_2
+//   Gateway contract: exactly ONE charge for key "pay_idem_retry_2"
+//   (observed now: 2 charges — the bug this test exists to guard).
+//
+// Run via: npx openpitstop repro ledger-46f2bb8e
+// The app is booted under OpenPitStop's nock sandbox, so no request can ever reach
+// a real payment gateway; the "gateway" is a local mock that records every call.
+// This test MUST FAIL on the buggy code and MUST PASS only after the fix.
+// ==============================================================================
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const REPO = process.cwd();
+const PRELOAD = process.env.PITSTOP_LEDGER_PRELOAD;
+const GATEWAY_HOST = "https://api.razorpay.com";
+const ENDPOINT = "/api/orders/:id/charge";
+const SCENARIO = "delayed-retry";
+const ORDER_ID = "ord_retry_2";
+const IDEM_KEY = "idem_retry_2";
+const EXPECTED_KEY = "pay_idem_retry_2";
+const AMOUNT = 1000;
+const CURRENCY = "INR";
+const NODE_BASED = new Set(["node","node.exe","nodejs","npm","npm.cmd","npx","npx.cmd","yarn","yarn.cmd","pnpm","pnpm.cmd","tsx","ts-node","babel-node","ojs","vitest","jest"]);
+
+import { spawn } from "node:child_process";
+import { readFileSync, mkdirSync, existsSync } from "node:fs";
+import net from "node:net";
+import path from "node:path";
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const s = net.createServer();
+    s.unref();
+    s.on("error", reject);
+    s.listen(0, () => {
+      const p = s.address().port;
+      s.close(() => resolve(p));
+    });
+  });
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function resolveStart() {
+  const pkg = JSON.parse(readFileSync(path.join(REPO, "package.json"), "utf8"));
+  const start = (pkg.scripts && pkg.scripts.start) || "";
+  if (!start) throw new Error("no start script in package.json");
+  const tokens = start.trim().split(/\s+/);
+  if (!NODE_BASED.has(tokens[0])) {
+    throw new Error("start script runs " + tokens[0] + ", which is not Node-based — refusing");
+  }
+  return { cmd: tokens[0], args: tokens.slice(1) };
+}
+
+function resolvePath(route, orderId) {
+  return route
+    .replace(/:([A-Za-z_][\w-]*)/g, (_, name) => (/id|order/i.test(name) ? orderId : name))
+    .replace(/\{([A-Za-z_][\w-]*)\}/g, (_, name) => (/id|order/i.test(name) ? orderId : name));
+}
+
+async function post(baseUrl, p, body, headers) {
+  try {
+    const res = await fetch(baseUrl + p, { method: "POST", headers, body: JSON.stringify(body) });
+    await res.text().catch(() => "");
+    return res.status;
+  } catch {
+    return 0;
+  }
+}
+
+function controlHas(controlPath, needle) {
+  if (!existsSync(controlPath)) return false;
+  try {
+    return readFileSync(controlPath, "utf8").split(/\r?\n/).some((l) => l.includes(needle));
+  } catch {
+    return false;
+  }
+}
+
+function countCharges(gatewayLogPath) {
+  if (!existsSync(gatewayLogPath)) return [];
+  const out = [];
+  for (const line of readFileSync(gatewayLogPath, "utf8").split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      const e = JSON.parse(t);
+      if (e.charge && e.key === EXPECTED_KEY) out.push(e);
+    } catch {}
+  }
+  return out;
+}
+
+test("pitstop repro ledger-46f2bb8e: exactly one gateway charge for key '" + EXPECTED_KEY + "'", async () => {
+  assert.ok(PRELOAD, "PITSTOP_LEDGER_PRELOAD not set — run this via `npx openpitstop repro ledger-46f2bb8e`");
+
+  const start = resolveStart();
+  const runDir = path.join(REPO, ".pitstop", "repro", new Date().toISOString().replace(/[:.]/g, "-"));
+  mkdirSync(runDir, { recursive: true });
+  const controlPath = path.join(runDir, "control.jsonl");
+  const gatewayLogPath = path.join(runDir, "gateway.log.jsonl");
+  const port = await freePort();
+  const baseUrl = "http://127.0.0.1:" + port;
+
+  const env = {
+    ...process.env,
+    NODE_OPTIONS: [process.env.NODE_OPTIONS, "--require=" + PRELOAD].filter(Boolean).join(" "),
+    PORT: String(port),
+    PITSTOP_LEDGER_CONTROL: controlPath,
+    PITSTOP_LEDGER_GATEWAY_LOG: gatewayLogPath,
+    PITSTOP_LEDGER_GATEWAY_HOSTS: GATEWAY_HOST,
+    RAZORPAY_KEY_ID: process.env.RAZORPAY_KEY_ID || "rzp_test_pitstop000000",
+    RAZORPAY_KEY_SECRET: process.env.RAZORPAY_KEY_SECRET || "pitstop_fake_secret",
+    STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY || "sk_test_pitstop_fake",
+    NODE_ENV: process.env.NODE_ENV || "test",
+  };
+  const child = spawn(start.cmd, start.args, { cwd: REPO, env, stdio: ["ignore", "ignore", "inherit"] });
+  try {
+    const deadline = Date.now() + 25000;
+    let up = false;
+    while (Date.now() < deadline) {
+      if (child.exitCode !== null) break;
+      if (controlHas(controlPath, '"event":"armed"')) {
+        try {
+          await fetch(baseUrl + "/__pitstop_ledger_probe__");
+          up = true;
+          break;
+        } catch {}
+      }
+      await sleep(150);
+    }
+    assert.ok(up, "app did not come up under the sandbox within 25s (" + start.cmd + " " + start.args.join(" ") + ")");
+    assert.ok(!controlHas(controlPath, '"event":"abort"'), "sandbox aborted during startup");
+
+    if (SCENARIO === "concurrent-double-submit" || SCENARIO === "delayed-retry") {
+      const reqBody = { amount: AMOUNT, currency: CURRENCY };
+      const headers = { "Content-Type": "application/json", ...(IDEM_KEY ? { "Idempotency-Key": IDEM_KEY } : {}) };
+      const p = resolvePath(ENDPOINT, ORDER_ID);
+      if (SCENARIO === "concurrent-double-submit") {
+        await Promise.all([post(baseUrl, p, reqBody, headers), post(baseUrl, p, reqBody, headers)]);
+      } else {
+        await post(baseUrl, p, reqBody, headers);
+        await sleep(2000);
+        await post(baseUrl, p, reqBody, headers);
+      }
+    } else {
+      const payload = {
+        event: "payment.captured",
+        id: ORDER_ID + "_evt",
+        payload: { payment: { entity: { id: EXPECTED_KEY, amount: AMOUNT, currency: CURRENCY, order_id: ORDER_ID } } },
+      };
+      const headers = { "Content-Type": "application/json" };
+      await post(baseUrl, ENDPOINT, payload, headers);
+      await sleep(300);
+      await post(baseUrl, ENDPOINT, payload, headers);
+    }
+
+    await sleep(400);
+    assert.ok(!controlHas(controlPath, '"event":"abort"'), "sandbox aborted during the attack");
+    const charges = countCharges(gatewayLogPath);
+    assert.equal(
+      charges.length,
+      1,
+      "expected exactly 1 gateway charge for key '" + EXPECTED_KEY + "', saw " + charges.length +
+      ". This repro proves the idempotency bug: it FAILS on the buggy code and must PASS only after the fix.",
+    );
+  } finally {
+    try { child.kill(); } catch {}
+  }
+});

package/demo-repo-fintech/pitstop-repro-ledger-order-ord-webhook-3-charged-2.test.mjs

@@ -0,0 +1,175 @@
+// ==============================================================================
+// OpenPitStop permanent repro test — finding ledger-a97b7d00
+// Linked from .pitstop/scan-latest.json (issue / cluster finding id ledger-a97b7d00).
+//
+// Scenario: duplicate-webhook on /api/webhooks/razorpay
+//   order ord_webhook_3 · idempotency key idem_webhook_3
+//   Gateway contract: exactly ONE charge for key "pay_webhook_3"
+//   (observed now: 2 charges — the bug this test exists to guard).
+//
+// Run via: npx openpitstop repro ledger-a97b7d00
+// The app is booted under OpenPitStop's nock sandbox, so no request can ever reach
+// a real payment gateway; the "gateway" is a local mock that records every call.
+// This test MUST FAIL on the buggy code and MUST PASS only after the fix.
+// ==============================================================================
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const REPO = process.cwd();
+const PRELOAD = process.env.PITSTOP_LEDGER_PRELOAD;
+const GATEWAY_HOST = "https://api.razorpay.com";
+const ENDPOINT = "/api/webhooks/razorpay";
+const SCENARIO = "duplicate-webhook";
+const ORDER_ID = "ord_webhook_3";
+const IDEM_KEY = "idem_webhook_3";
+const EXPECTED_KEY = "pay_webhook_3";
+const AMOUNT = 1000;
+const CURRENCY = "INR";
+const NODE_BASED = new Set(["node","node.exe","nodejs","npm","npm.cmd","npx","npx.cmd","yarn","yarn.cmd","pnpm","pnpm.cmd","tsx","ts-node","babel-node","ojs","vitest","jest"]);
+
+import { spawn } from "node:child_process";
+import { readFileSync, mkdirSync, existsSync } from "node:fs";
+import net from "node:net";
+import path from "node:path";
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const s = net.createServer();
+    s.unref();
+    s.on("error", reject);
+    s.listen(0, () => {
+      const p = s.address().port;
+      s.close(() => resolve(p));
+    });
+  });
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function resolveStart() {
+  const pkg = JSON.parse(readFileSync(path.join(REPO, "package.json"), "utf8"));
+  const start = (pkg.scripts && pkg.scripts.start) || "";
+  if (!start) throw new Error("no start script in package.json");
+  const tokens = start.trim().split(/\s+/);
+  if (!NODE_BASED.has(tokens[0])) {
+    throw new Error("start script runs " + tokens[0] + ", which is not Node-based — refusing");
+  }
+  return { cmd: tokens[0], args: tokens.slice(1) };
+}
+
+function resolvePath(route, orderId) {
+  return route
+    .replace(/:([A-Za-z_][\w-]*)/g, (_, name) => (/id|order/i.test(name) ? orderId : name))
+    .replace(/\{([A-Za-z_][\w-]*)\}/g, (_, name) => (/id|order/i.test(name) ? orderId : name));
+}
+
+async function post(baseUrl, p, body, headers) {
+  try {
+    const res = await fetch(baseUrl + p, { method: "POST", headers, body: JSON.stringify(body) });
+    await res.text().catch(() => "");
+    return res.status;
+  } catch {
+    return 0;
+  }
+}
+
+function controlHas(controlPath, needle) {
+  if (!existsSync(controlPath)) return false;
+  try {
+    return readFileSync(controlPath, "utf8").split(/\r?\n/).some((l) => l.includes(needle));
+  } catch {
+    return false;
+  }
+}
+
+function countCharges(gatewayLogPath) {
+  if (!existsSync(gatewayLogPath)) return [];
+  const out = [];
+  for (const line of readFileSync(gatewayLogPath, "utf8").split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      const e = JSON.parse(t);
+      if (e.charge && e.key === EXPECTED_KEY) out.push(e);
+    } catch {}
+  }
+  return out;
+}
+
+test("pitstop repro ledger-a97b7d00: exactly one gateway charge for key '" + EXPECTED_KEY + "'", async () => {
+  assert.ok(PRELOAD, "PITSTOP_LEDGER_PRELOAD not set — run this via `npx openpitstop repro ledger-a97b7d00`");
+
+  const start = resolveStart();
+  const runDir = path.join(REPO, ".pitstop", "repro", new Date().toISOString().replace(/[:.]/g, "-"));
+  mkdirSync(runDir, { recursive: true });
+  const controlPath = path.join(runDir, "control.jsonl");
+  const gatewayLogPath = path.join(runDir, "gateway.log.jsonl");
+  const port = await freePort();
+  const baseUrl = "http://127.0.0.1:" + port;
+
+  const env = {
+    ...process.env,
+    NODE_OPTIONS: [process.env.NODE_OPTIONS, "--require=" + PRELOAD].filter(Boolean).join(" "),
+    PORT: String(port),
+    PITSTOP_LEDGER_CONTROL: controlPath,
+    PITSTOP_LEDGER_GATEWAY_LOG: gatewayLogPath,
+    PITSTOP_LEDGER_GATEWAY_HOSTS: GATEWAY_HOST,
+    RAZORPAY_KEY_ID: process.env.RAZORPAY_KEY_ID || "rzp_test_pitstop000000",
+    RAZORPAY_KEY_SECRET: process.env.RAZORPAY_KEY_SECRET || "pitstop_fake_secret",
+    STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY || "sk_test_pitstop_fake",
+    NODE_ENV: process.env.NODE_ENV || "test",
+  };
+  const child = spawn(start.cmd, start.args, { cwd: REPO, env, stdio: ["ignore", "ignore", "inherit"] });
+  try {
+    const deadline = Date.now() + 25000;
+    let up = false;
+    while (Date.now() < deadline) {
+      if (child.exitCode !== null) break;
+      if (controlHas(controlPath, '"event":"armed"')) {
+        try {
+          await fetch(baseUrl + "/__pitstop_ledger_probe__");
+          up = true;
+          break;
+        } catch {}
+      }
+      await sleep(150);
+    }
+    assert.ok(up, "app did not come up under the sandbox within 25s (" + start.cmd + " " + start.args.join(" ") + ")");
+    assert.ok(!controlHas(controlPath, '"event":"abort"'), "sandbox aborted during startup");
+
+    if (SCENARIO === "concurrent-double-submit" || SCENARIO === "delayed-retry") {
+      const reqBody = { amount: AMOUNT, currency: CURRENCY };
+      const headers = { "Content-Type": "application/json", ...(IDEM_KEY ? { "Idempotency-Key": IDEM_KEY } : {}) };
+      const p = resolvePath(ENDPOINT, ORDER_ID);
+      if (SCENARIO === "concurrent-double-submit") {
+        await Promise.all([post(baseUrl, p, reqBody, headers), post(baseUrl, p, reqBody, headers)]);
+      } else {
+        await post(baseUrl, p, reqBody, headers);
+        await sleep(2000);
+        await post(baseUrl, p, reqBody, headers);
+      }
+    } else {
+      const payload = {
+        event: "payment.captured",
+        id: ORDER_ID + "_evt",
+        payload: { payment: { entity: { id: EXPECTED_KEY, amount: AMOUNT, currency: CURRENCY, order_id: ORDER_ID } } },
+      };
+      const headers = { "Content-Type": "application/json" };
+      await post(baseUrl, ENDPOINT, payload, headers);
+      await sleep(300);
+      await post(baseUrl, ENDPOINT, payload, headers);
+    }
+
+    await sleep(400);
+    assert.ok(!controlHas(controlPath, '"event":"abort"'), "sandbox aborted during the attack");
+    const charges = countCharges(gatewayLogPath);
+    assert.equal(
+      charges.length,
+      1,
+      "expected exactly 1 gateway charge for key '" + EXPECTED_KEY + "', saw " + charges.length +
+      ". This repro proves the idempotency bug: it FAILS on the buggy code and must PASS only after the fix.",
+    );
+  } finally {
+    try { child.kill(); } catch {}
+  }
+});

package/demo-repo-fintech/src/gateway.js

@@ -0,0 +1,26 @@
+// Payment-gateway wrapper around the official razorpay Node SDK.
+// All outbound calls go through the SDK's HTTP client (axios -> https), so
+// OpenPitStop's ledger sandbox (nock) can intercept them before they leave the
+// process. In ledger mode the gateway is always a mock — never the real one.
+const Razorpay = require("razorpay");
+
+// Fake credentials are fine: requests are intercepted by nock in ledger mode
+// and never actually reach razorpay.
+const KEY_ID = process.env.RAZORPAY_KEY_ID || "rzp_test_pitstop000000";
+const KEY_SECRET = process.env.RAZORPAY_KEY_SECRET || "pitstop_fake_secret";
+
+const instance = new Razorpay({
+  key_id: KEY_ID,
+  key_secret: KEY_SECRET,
+});
+
+/**
+ * Charge a payment. This is THE money-moving call: it captures an authorized
+ * payment at the gateway. Every invocation produces one gateway charge.
+ */
+async function charge(paymentId, amount, currency) {
+  const res = await instance.payments.capture(paymentId, amount, currency);
+  return res;
+}
+
+module.exports = { charge, KEY_ID };

package/demo-repo-fintech/src/server.js

@@ -0,0 +1,61 @@
+const express = require("express");
+const gateway = require("./gateway");
+
+const app = express();
+app.use(express.json());
+
+// In-memory "ledger". Deliberately has NO idempotency keying: a retried or
+// replayed request results in another gateway charge. This is the bug.
+const charges = new Map(); // key -> charge log
+const chargeLog = (key) => {
+  if (!charges.has(key)) charges.set(key, []);
+  return charges.get(key);
+};
+
+/**
+ * Charge an order. NO idempotency check: send the same payload + the same
+ * Idempotency-Key twice and the gateway is charged twice.
+ */
+app.post("/api/orders/:id/charge", async (req, res) => {
+  const { id } = req.params;
+  const { amount, currency } = req.body || {};
+  const idemKey = req.get("Idempotency-Key") || req.get("X-Idempotency-Key") || null;
+
+  // The payment being charged is derived from the idempotency key (or order id).
+  // The key is received but NEVER deduped — that is the bug under test.
+  const paymentId = idemKey ? `pay_${idemKey}` : `pay_${id}`;
+  const payment = await gateway.charge(paymentId, amount, currency);
+
+  chargeLog(idemKey || id).push({
+    action: "charge",
+    paymentId,
+    idemKey,
+    at: new Date().toISOString(),
+  });
+  res.json({ ok: true, orderId: id, paymentId, charges: chargeLog(idemKey || id).length });
+});
+
+/**
+ * Razorpay webhook. Bug: every delivered event triggers a gateway capture with
+ * no dedup, so replaying the same webhook double-charges.
+ */
+app.post("/api/webhooks/razorpay", async (req, res) => {
+  const event = req.body || {};
+  const entity = event?.payload?.payment?.entity;
+  if (event.event === "payment.captured" && entity) {
+    await gateway.charge(entity.id, entity.amount, entity.currency);
+    chargeLog(entity.id).push({
+      action: "capture",
+      paymentId: entity.id,
+      at: new Date().toISOString(),
+    });
+  }
+  res.json({ received: true });
+});
+
+if (require.main === module) {
+  const port = Number(process.env.PORT) || 4000;
+  app.listen(port, () => console.log(`pitstop-demo-fintech listening on ${port}`));
+}
+
+module.exports = app;