davideandClaude Opus 5
d528c5b475
The code treated a broadcast as final: money moved on-chain and the DB was updated on the assumption it would either confirm or be fee-bumped until it did. Neither is guaranteed, and every way that assumption broke was permanent (BUGS.md B-02, B-03, B-04, B-07, B-08, B-20, B-21). Persist before broadcasting. place_bet and request_withdrawal now write their rows in a "building" state and commit, then broadcast, then promote to broadcast/pending in a second commit. Before, a failure or crash between the broadcast and the commit left the coins irreversibly spent with no trace: no participant (so no entry in the draw), no pending row (so no RBF and no confirmation tracking), and the UTXOs not even marked spent, so the next bet would try to double-spend them. A refused broadcast now releases the reserved UTXOs, restores the balance, removes the participant (or marks the withdrawal failed), audit-logs it, and answers a translatable broadcast_failed — as 502, since the network refused it, not the caller, where it used to be an opaque 500. Reconcile what's in flight against the chain. New PendingTransactionReconciler (app/tx/reconcile.py, every 120s and once at startup) asks whether each non-terminal tx exists: present -> promote, gone -> mark failed with a reason, release the inputs, roll the domain row back, audit-log it. Grace periods differ by state (120s for "building", 6h for "pending", so the RBF bumper gets its attempts first). It is deliberately biased to inaction: only a server that positively doesn't know the tx counts as absent, and a transport failure never abandons anything, because releasing a UTXO whose tx is actually alive would invite a double-spend. Verified against the live server, which answers "No such mempool or blockchain transaction" for an unknown txid. Stop keying on a value that changes. An RBF bump changes the txid, and _on_bet_confirmed looked the participant up by bet_txid — so a bumped bet confirmed under a txid no participant carried, the row stayed "broadcast" forever, and the scheduler waited on it forever: the round could never close and the lottery stopped. Handlers now resolve by immutable ids (round_id/user_id, withdrawal_id), and bump_fee retargets every stored txid — bet_txid, Withdrawal.txid, Round.payout_txid and UtxoEvent.spent_txid — plus records the previous one in replaced_by_txid, which was never written at all. One bad row no longer blocks the rest. The confirmation poller's per-tx lookup is guarded: a txid the server can't resolve used to abort the whole pass, so nothing confirmed again until an operator intervened. It also selects plain columns instead of hydrating entities that outlive their session. Tests: 6 reconciler cases including "a broken connection must not release coins"; the bet-ordering test probes committed state from an independent session during the broadcast, and caught a real mistake in the first draft of this change (the _pending_transaction helper still hardcoded status="pending", so rows were born already-broadcast and would have got the 6-hour grace instead of 120s). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
65 lines
3.1 KiB
Python
65 lines
3.1 KiB
Python
from embit.transaction import Transaction
|
|
from sqlalchemy import func, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.db.models import PendingTransaction, User, UtxoEvent
|
|
from app.wallet.plm_network import PLM_MAINNET
|
|
|
|
|
|
async def recompute_balance(session: AsyncSession, user_id: int) -> int:
|
|
"""Source of truth: sum of this user's confirmed, unspent UTXOs. Updates and
|
|
returns the read-cache column (User.cached_balance_sats). Must be called
|
|
within the same transaction as whatever inserted/updated utxo_events rows."""
|
|
balance = await session.scalar(
|
|
select(func.sum(UtxoEvent.amount_sats)).where(UtxoEvent.user_id == user_id, UtxoEvent.spent_txid.is_(None))
|
|
)
|
|
user = await session.get(User, user_id)
|
|
user.cached_balance_sats = balance or 0
|
|
return user.cached_balance_sats
|
|
|
|
|
|
async def compute_pending_balance(session: AsyncSession, user: User) -> tuple[int, bool]:
|
|
"""Balance including the user's own change still in flight.
|
|
|
|
Placing a bet or a withdrawal spends whatever UTXOs cover the amount — often
|
|
much larger than the amount actually moving, since select_utxos() picks
|
|
whole UTXOs — and recompute_balance() drops that entire input total from
|
|
cached_balance_sats the moment the tx is broadcast (spent_txid is set right
|
|
away, well before the tx has any confirmations). The change output that
|
|
returns the difference only becomes a UtxoEvent (and so counts toward the
|
|
confirmed balance again) once it gets its own 1st confirmation. In between,
|
|
User.cached_balance_sats alone understates the user's real balance by the
|
|
full unconfirmed change amount, which can look like a much bigger loss than
|
|
the tx actually represents.
|
|
|
|
This walks every in-flight (status="pending") bet/withdrawal PendingTransaction
|
|
of this user, decodes its current raw tx (kept up to date across RBF bumps —
|
|
see tx/broadcast.py:bump_fee), and sums whichever outputs pay back to the
|
|
user's own address. Adding that to cached_balance_sats gives the balance the
|
|
user will end up with once everything currently in flight confirms.
|
|
|
|
Returns (pending_inclusive_balance_sats, has_pending) — has_pending tells the
|
|
caller whether this differs from the confirmed-only balance at all.
|
|
"""
|
|
pending = (
|
|
await session.scalars(
|
|
select(PendingTransaction).where(
|
|
PendingTransaction.user_id == user.id,
|
|
PendingTransaction.kind.in_(("bet", "withdrawal")),
|
|
# "building" as well as "pending": a building row's UTXOs are already
|
|
# marked spent (see place_bet's two phases), so leaving it out would
|
|
# make the displayed balance dip for the duration of the broadcast.
|
|
PendingTransaction.status.in_(("building", "pending")),
|
|
)
|
|
)
|
|
).all()
|
|
|
|
pending_change_sats = 0
|
|
for row in pending:
|
|
tx = Transaction.parse(bytes.fromhex(row.raw_tx_hex))
|
|
for out in tx.vout:
|
|
if out.script_pubkey.address(network=PLM_MAINNET) == user.address:
|
|
pending_change_sats += out.value
|
|
|
|
return user.cached_balance_sats + pending_change_sats, bool(pending)
|