fix idempotency issue for POST /private/orders (#6445)

1 files changed, 11 insertions, 2 deletions

diff --git a/src/backenddb/plugin_merchantdb_postgres.c b/src/backenddb/plugin_merchantdb_postgres.c
index ce87ecd7..b965b0e6 100644
--- a/src/backenddb/plugin_merchantdb_postgres.c
+++ b/src/backenddb/plugin_merchantdb_postgres.c
@@ -1103,6 +1103,7 @@ postgres_delete_order (void *cls,
  * @param order_id order id used to perform the lookup
  * @param[out] claim_token the claim token generated for the order,
  *             NULL to only test if the order exists
+ * @param[out] h_post_data set to the hash of the POST data that created the order
  * @param[out] contract_terms where to store the retrieved contract terms,
  *             NULL to only test if the order exists
  * @return transaction status
@@ -1112,6 +1113,7 @@ postgres_lookup_order (void *cls,
                        const char *instance_id,
                        const char *order_id,
                        struct TALER_ClaimTokenP *claim_token,
+                       struct GNUNET_HashCode *h_post_data,
                        json_t **contract_terms)
 {
   struct PostgresClosure *pg = cls;
@@ -1128,6 +1130,8 @@ postgres_lookup_order (void *cls,
                                &j),
     GNUNET_PQ_result_spec_auto_from_type ("claim_token",
                                           &ct),
+    GNUNET_PQ_result_spec_auto_from_type ("h_post_data",
+                                          h_post_data),
     GNUNET_PQ_result_spec_end
   };
 
@@ -1340,6 +1344,7 @@ postgres_lookup_orders (void *cls,
  * @param cls closure
  * @param instance_id identifies the instance responsible for the order
  * @param order_id alphanumeric string that uniquely identifies the proposal
+ * @param h_post_order hash of the POST data for idempotency checks
  * @param pay_deadline how long does the customer have to pay for the order
  * @param claim_token token to use for access control
  * @param contract_terms proposal data to store
@@ -1349,6 +1354,7 @@ static enum GNUNET_DB_QueryStatus
 postgres_insert_order (void *cls,
                        const char *instance_id,
                        const char *order_id,
+                       const struct GNUNET_HashCode *h_post_order,
                        struct GNUNET_TIME_Absolute pay_deadline,
                        const struct TALER_ClaimTokenP *claim_token,
                        const json_t *contract_terms)
@@ -1360,6 +1366,7 @@ postgres_insert_order (void *cls,
     GNUNET_PQ_query_param_string (order_id),
     GNUNET_PQ_query_param_absolute_time (&pay_deadline),
     GNUNET_PQ_query_param_auto_from_type (claim_token),
+    GNUNET_PQ_query_param_auto_from_type (h_post_order),
     GNUNET_PQ_query_param_absolute_time (&now),
     TALER_PQ_query_param_json (contract_terms),
     GNUNET_PQ_query_param_end
@@ -6285,6 +6292,7 @@ libtaler_plugin_merchantdb_postgres_init (void *cls)
                             "SELECT"
                             " contract_terms"
                             ",claim_token"
+                            ",h_post_data"
                             " FROM merchant_orders"
                             " WHERE merchant_orders.merchant_serial="
                             "     (SELECT merchant_serial "
@@ -7098,13 +7106,14 @@ libtaler_plugin_merchantdb_postgres_init (void *cls)
                             ",order_id"
                             ",pay_deadline"
                             ",claim_token"
+                            ",h_post_data"
                             ",creation_time"
                             ",contract_terms)"
                             " SELECT merchant_serial,"
-                            " $2, $3, $4, $5, $6"
+                            " $2, $3, $4, $5, $6, $7"
                             " FROM merchant_instances"
                             " WHERE merchant_id=$1",
-                            5),
+                            7),
     /* for postgres_unlock_inventory() */
     GNUNET_PQ_make_prepare ("unlock_inventory",
                             "DELETE"