Added validation when resetting confirmation. Caused unexpected system behavior.

Author: rez1dent3

changelog.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.0.4] - 2022-02-19
+### Added
+- Added validation when resetting confirmation. Caused unexpected system behavior.
+
 ## [8.0.3] - 2022-02-19
 ### Fixed
 - Fixed "UUID Duplicate entry" bug on eager loading. #438 @DanielSpravtsev
@@ -789,7 +793,8 @@ The operation is now executed in the transaction and updates the new `refund` fi
 - Exceptions: AmountInvalid, BalanceIsEmpty.
 - Models: Transfer, Transaction.
 
-[Unreleased]: https://github.com/bavix/laravel-wallet/compare/8.0.3...develop
+[Unreleased]: https://github.com/bavix/laravel-wallet/compare/8.0.4...develop
+[8.0.4]: https://github.com/bavix/laravel-wallet/compare/8.0.3...8.0.4
 [8.0.3]: https://github.com/bavix/laravel-wallet/compare/8.0.2...8.0.3
 [8.0.2]: https://github.com/bavix/laravel-wallet/compare/8.0.1...8.0.2
 [8.0.1]: https://github.com/bavix/laravel-wallet/compare/8.0.0...8.0.1

src/Interfaces/Confirmable.php

@@ -35,6 +35,7 @@ public function safeConfirm(Transaction $transaction): bool;
 
     /**
      * @throws UnconfirmedInvalid
+     * @throws WalletOwnerInvalid
      * @throws LockProviderNotFoundException
      * @throws RecordNotFoundException
      * @throws RecordsNotFoundException

src/Traits/CanConfirm.php

@@ -63,6 +63,7 @@ public function safeConfirm(Transaction $transaction): bool
      * Removal of confirmation (forced), use at your own peril and risk.
      *
      * @throws UnconfirmedInvalid
+     * @throws WalletOwnerInvalid
      * @throws LockProviderNotFoundException
      * @throws RecordNotFoundException
      * @throws RecordsNotFoundException
@@ -80,6 +81,13 @@ public function resetConfirm(Transaction $transaction): bool
             }
 
             $wallet = app(CastServiceInterface::class)->getWallet($this);
+            if ($wallet->getKey() !== $transaction->wallet_id) {
+                throw new WalletOwnerInvalid(
+                    app(TranslatorServiceInterface::class)->get('wallet::errors.owner_invalid'),
+                    ExceptionInterface::WALLET_OWNER_INVALID
+                );
+            }
+
             app(RegulatorServiceInterface::class)->decrease($wallet, $transaction->amount);
 
             return $transaction->update(['confirmed' => false]);

tests/Units/Domain/ConfirmTest.php

@@ -8,11 +8,14 @@
 use Bavix\Wallet\Exceptions\UnconfirmedInvalid;
 use Bavix\Wallet\Exceptions\WalletOwnerInvalid;
 use Bavix\Wallet\Internal\Exceptions\ExceptionInterface;
+use Bavix\Wallet\Internal\Service\DatabaseServiceInterface;
 use Bavix\Wallet\Services\BookkeeperServiceInterface;
 use Bavix\Wallet\Services\RegulatorServiceInterface;
 use Bavix\Wallet\Test\Infra\Factories\BuyerFactory;
 use Bavix\Wallet\Test\Infra\Factories\UserConfirmFactory;
+use Bavix\Wallet\Test\Infra\Factories\UserFactory;
 use Bavix\Wallet\Test\Infra\Models\Buyer;
+use Bavix\Wallet\Test\Infra\Models\User;
 use Bavix\Wallet\Test\Infra\Models\UserConfirm;
 use Bavix\Wallet\Test\Infra\TestCase;
 
@@ -251,4 +254,45 @@ public function testUserConfirmByWallet(): void
         self::assertTrue($userConfirm->wallet->confirm($transaction));
         self::assertTrue($transaction->confirmed);
     }
+
+    public function testTransactionResetConfirmWalletOwnerInvalid(): void
+    {
+        $this->expectException(WalletOwnerInvalid::class);
+        $this->expectExceptionCode(ExceptionInterface::WALLET_OWNER_INVALID);
+        $this->expectExceptionMessageStrict(trans('wallet::errors.owner_invalid'));
+
+        /**
+         * @var User $user1
+         * @var User $user2
+         */
+        [$user1, $user2] = UserFactory::times(2)->create();
+        $user1->deposit(1000);
+
+        self::assertSame(1000, $user1->balanceInt);
+
+        $transfer = $user1->transfer($user2, 500);
+        $user1->wallet->resetConfirm($transfer->deposit);
+    }
+
+    public function testTransactionResetConfirmSuccess(): void
+    {
+        /**
+         * @var User $user1
+         * @var User $user2
+         */
+        [$user1, $user2] = UserFactory::times(2)->create();
+        $user1->deposit(1000);
+
+        self::assertSame(1000, $user1->balanceInt);
+        app(DatabaseServiceInterface::class)->transaction(static function () use ($user1, $user2) {
+            $transfer = $user1->transfer($user2, 500);
+            self::assertTrue($user2->wallet->resetConfirm($transfer->deposit)); // confirm => false
+        });
+
+        self::assertSame(500, (int) $user1->transactions()->sum('amount'));
+        self::assertSame(500, (int) $user2->transactions()->sum('amount'));
+
+        self::assertSame(500, $user1->balanceInt);
+        self::assertSame(0, $user2->balanceInt);
+    }
 }