Claude Project Tracker

ProcessTopupWebhook uses `if topup.Amount != amount` — direct float64 equality. A tiny rounding drift (e.g., 500.00 stored vs 499.99999998 derived from Razorpay's paise/100) will falsely reject the webhook as 'amount mismatch', leaving the user paying but not credited. Change to: if math.Abs(topup.Amount - amount) > 0.01 { ... } Or better: store amount as int64 paise everywhere and compare integers.

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai

Migration 0027 only inserts positive ADJUSTMENT entries when `wallets.balance > 0 AND gap.amount >= 0.01`. Users whose legacy wallets.balance is 0 (never populated) but who accumulated CHARGE entries end up with negative ledger balances and no automatic reconciliation. Concrete case: saravanan.hp@gmail.com currently shows balance = -11152.52. Ledger has CHARGE entries but no matching TOPUP history was migrated in. Options: (a) Backfill missing legacy topups from external Razorpay reports before running the reconcile. (b) Add a companion migration that reconciles from a manually-curated CSV of legacy balances. (c) Add an admin credit tool + audit trail so support can fix these case-by-case. Track down the actual topup history for affected users (query Razorpay payments API filtered by our account) and decide the right long-term reconciliation approach.

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai

Owner noticed the full exam has no back/forth between answered questions. Root cause: exam engine is forward-only by design. Backend get_next_exam_question serves the next UNSEEN question and immediately consumes it (status→ANSWERED); /answer records a single Attempt; no endpoint to re-fetch a prior question, change an answer, or list the module; ExamQuestionStatusEnum has only UNSEEN/ANSWERED/SKIPPED (no FLAGGED/REVIEW). Same limitation on WEB (frontend ExamSession.tsx) since it's the same backend — whole-product gap, not mobile-only. Real Digital SAT (Bluebook) allows free within-module navigation, changing answers, and a question navigator with mark-for-review until the module timer ends. SCOPE (multi-day, cross-cutting): backend — serve whole module, mutable per-question answers until module submit/timer, add flag/review state, add submit-module step (stop consume-on-serve); web+mobile — question navigator UI (grid + flags), Back/Next, module answer state, submit at module end. NOT an App Store blocker — sequence AFTER build 7 clears review. Refs: backend/app/services/exam_service.py (get_next_exam_question, submit_exam_answer), backend/app/models/exam_module_question.py, mobile/src/screens/ExamSessionScreen.tsx, frontend/src/app/pages/ExamSession.tsx.

Adaptive SAT · adaptive-sat · by saravanan@scrumclaw.ai

Backend constant minTopupAmount is 1 but the error message and frontend both say the minimum is 100. Change minTopupAmount to 100 so the backend actually enforces what the message claims — otherwise a bespoke client can top up ₹1 (bypasses the intended floor). - const minTopupAmount = 1 + const minTopupAmount = 100

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai

The webhook endpoint currently accepts any POST from anywhere. HMAC signature check is the only defense — cryptographically sound, but each invalid request still triggers signature compute + JSON parse + DB lookup, so it's a cheap DoS vector. Two things worth adding (nginx-level is easiest): 1. Restrict source IPs to Razorpay's published webhook IPs (they publish a list): allow only those in the nginx server block for /webhooks/*. 2. Rate-limit /webhooks/* at nginx (limit_req_zone). Even a modest 20 rps burst limit stops volumetric noise. Doesn't change functionality, just hardens.

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai

Behind WALKIN_QR_SMS_ENABLED flag. 5 templates × 4 languages (see #53).\n\nBackend changes:\n- Templates stored in Go source (map[templateKey]map[lang]string) with DLT template IDs from #53\n- Language selection: prefer user.preferred_language if set; fallback to English\n- Dispatch service reuses existing Fast2SMS integration (already in codebase for OTP)\n- Fire-and-forget from webhook handler (async goroutine); log failures but don't block webhook response\n\nBlocked on DLT approval (#53).</body>

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai

Useful for ops debugging (missing webhook, dispute lookup, reconciliation). Wraps Razorpay: GET https://api.razorpay.com/v1/payments/qr_codes/:qr_id/payments Backend endpoint: GET /admin/chargers/:charger_id/connectors/:connector_id/payments Returns array of payments captured against that gun's QR (all-time), each with vpa, contact, email, amount, timestamp, status. Enables ops to answer "who paid at this gun today" without querying our DB. Small addition to the admin endpoints in #65. Roughly 1 hour of Go + admin console UI work.</body>

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai

Razorpay deprecated the payment_capture parameter for the Orders API — capture behavior is now controlled at the account/merchant level. Not a functional bug today, but noise, and Razorpay may eventually reject unknown fields in future API versions. Drop the key from the payload in createRazorpayOrder.

Vajra Volt Mobile App · vajra-mobile-app · by saravanan@scrumclaw.ai