release/v0.4.21 - #100
Merged
Merged
Conversation
Replace CatalogAndProductsSeeder and CheckoutOrdersSeeder with two declarative seeders built on a shared fixtures concern: - StoreSeeder seeds one complete store: order config, location with weekly hours, sandbox Stripe gateway, categories, products with variants and addons, published catalog, customers, an open cart, a pending checkout, a month of cash and Stripe orders across statuses, and reviews. - NetworkSeeder seeds a marketplace: network gateway, network categories, five member stores (one uncategorised) and network-tagged orders across them. Fixes carried over from the old seeders: core product categories are now purged between runs, addon categories carry their store owner so they show in the console, order statuses survive the FleetOps tracking reset, orders are spread over the last month, and schema column lookups are cached per table. Each seeder tags and purges only its own fixtures while still cleaning up legacy storefront-testing data. Also fix Network::setOptionsAttribute, which stored a raw array and made any network save with options fail; it now encodes JSON like Store.
…etwork Network::categories() filtered on 'network_category', a value nothing writes, so the relation was always empty; it now matches the 'storefront_network' categories the console and v1 API use. Network::createCategory set the owner type from 'network:storefront', which resolves to a nonexistent class; it now resolves to the Network model. Covered by the network category behaviour test.
QPay returns `expires_in` on /v2/auth/token as an ABSOLUTE UNIX TIMESTAMP, not a lifetime in seconds — a live response carries 1788603222, which is 2026-09-05T10:13:42Z, roughly a day out. setAuthToken() read it as a duration and cached the token for `expires_in - 60` SECONDS: 1,788,603,162s, about 56.7 years. The first token minted after deploy was therefore pinned in the cache permanently, and once QPay expired it server-side (~24h later) every storefront call kept sending that dead bearer token. QPay answered NO_CREDENTIALS / "Хандах эрхгүй байна. Нэвтрэнэ үү." for correct credentials, which broke checkout invoice creation, the capture-qpay callback, checkout status polling, and the ebarimt receipt path. Mint a fresh token per authentication, as before the caching was added. That costs one round trip per QPay call, which is what the caching was saving — not a trade worth making on a payment path. Reintroducing reuse requires deriving the TTL from the epoch and keying on the credentials so rotation invalidates it. The test added with the caching mocked expires_in as 3600 — a duration, the same wrong assumption as the code — so it agreed with the bug and passed. It is replaced with regression coverage that uses a real epoch-shaped response and asserts each authentication re-mints.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #100 +/- ##
===========================================
Coverage 100.00% 100.00%
+ Complexity 1775 1772 -3
===========================================
Files 135 135
Lines 7785 7778 -7
===========================================
- Hits 7785 7778 -7
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Cuts the patch release carrying the QPay authentication fix (#99) and the network model repairs and testing seeder split (#98). The release/v* workflow gate is deliberately NOT changed here — #97 owns that, with fleetbase/fleetbase#641 behind it. Both must land before this branch is merged, or the tag job either skips (old gate) or is refused by the reusable workflow (gate updated, reusable workflow not yet).
roncodes
force-pushed
the
release/v0.4.21
branch
from
September 4, 2026 10:44
54965e0 to
9bbc7b5
Compare
refactor: split testing seeders into complete store and network fixtures
fix: stop caching the QPay access token past its real expiry
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release branch for v0.4.21, the patch release that restores QPay checkout.
First release cut with the new
release/v0.0.0convention.What this branch carries
0.4.21inpackage.json,composer.json,extension.json.RELEASE.mdwritten for v0.4.21.That's all — the workflow change for the new convention is owned by #97, not duplicated here.
Merge order (all four, in this order)
mainstill rejects anything that isn'tdev-v*. Until this lands, arelease/v*merge is refused withHead branch 'release/v0.4.21' is not a dev-v* release branch.dev-vonly. Without it the tag job is skipped silently — no tag, no publish, and a green check.mainfires the tag job, which pushesv0.4.21and chains intocreate-release.ymland the publish jobs.Steps 1 and 2 are independent of each other in content but both are required before step 4. Merging #97 before #641 is harmless; merging this PR before either is not.
If the tag job is skipped or fails anyway
The recovery path is unchanged — land the fix on
main, then:workflow_dispatchbypasses the branch-name gate entirely, so it works regardless of the convention state.