fix(fraud): exclude system whodunnit from reviewer credit, allow month-scoped payout runs - #1231
Draft
NeonGamerBot-QK wants to merge 1 commit into
Draft
Conversation
…h-scoped payout runs
Shop::AutoApprovable stamps ShopOrder PaperTrail versions with a class-name
whodunnit ("Shop::AutoApprovable") for system approvals, which
FraudPayoutRun.reviewer_from_version blindly coerced via .to_i into a fake
reviewer id of 0, showing up as "User #0" on the admin fraud payouts
leaderboard. reviewer_versions now only considers numeric whodunnit values,
matching the guard ShopOrder.leaderboard already used for the same problem.
Also lets admins trigger a fraud payout run scoped to a specific calendar
month (instead of only "everything since the last run"), via a month picker
on the admin fraud payouts page.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Neon <neon@saahild.com>
NeonGamerBot-QK
marked this pull request as draft
September 4, 2026 01:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what's this do?
Two changes to the fraud squad payout system:
Shop::AutoApprovablestamps its PaperTrailwhodunnitwith a class-name string ("Shop::AutoApprovable") for unattended system approvals, not a user id.FraudPayoutRun.reviewer_from_versionwas blindly doingwhodunnit.to_ion it, and"Shop::AutoApprovable".to_i == 0in Ruby, so those auto-approved orders got silently attributed to a fake "reviewer #0" and rendered as"User #0"in the admin UI.FraudPayoutRun.reviewer_versionsnow only considers versions with a purely numericwhodunnit, matching the same guardShopOrder.leaderboardalready uses for this exact problem./admin/fraud_payouts.Fraud::CalculatePayoutsJob#performnow takes optionalperiod_start/period_end; already-paid orders stay excluded regardless (viapayout_eligible_orders), so re-running an old month can't double-pay.show it works
Added test coverage for both changes:
test/jobs/fraud/calculate_payouts_job_test.rb: a new test asserts explicit period bounds only pick up orders created inside that window and ignore everything else.test/controllers/admin/fraud_payouts_controller_test.rb: new tests asserttriggerwith a validmonthparam enqueues the job with the correct start/end, and that an unparseable month enqueues nothing and shows an alert.I wrote these against the existing test conventions in both files, but I was not able to run the suite myself — my local environment has no Docker daemon running and the gems aren't installed on the host, so
bin/rails testisn't runnable from where I am. Please run before merging:ai?
Yes — this PR (investigation, diagnosis, code, and tests) was written with Claude Code (Sonnet 5), with me directing/reviewing each step and reading the actual diffs before asking for the PR. I have not run the test suite myself (see above) and would appreciate a careful review + a CI/local test run before merge.