McRitchie Studio
Say Hi 👋
Agents Builders
← All Tasks
Sizing

Fix ipinfo geocoder HTTPS

Archived
fix-ipinfo-geocoder-https

Created

Jun 24, 05:09

Started

Jun 24, 05:09

Completed

Jun 24, 06:40

DevOps handoff

Type

Bug

Shape

backend

Worktree Slug

fix-ipinfo-geocoder-https

Repositories

turf-monster

Release Train

—

Branch

feat/fix-ipinfo-geocoder-https

Pull Request

https://github.com/amcritchie/turf-monster/pull/162

Local URL

http://localhost:3101

QA URL

—

Production URL

—

compliance payments geo

Acceptance Criteria

  • Geocoder calls ipinfo over HTTPS not HTTP
  • US users can open CDP buy and sell
  • State blocklist enforces once geo detection restored
  • Regression test asserts ipinfo lookup uses https

Expected Test Plan

  • unit

Checks Run

  • [unit] test/initializers/geocoder_initializer_test.rb — 2 runs/3 assertions green; fails on plain http, passes on https
  • [integration] test/integration/geo_detection_test.rb — 3 runs/7 assertions green; detect_geo_state→normalize→blocklist via GET /geo/check

Agent Context

ROOT CAUSE (verified live on turf-monster-mainnet): Geocoder 1.8.6 has use_https=false, so the :ipinfo_io lookup builds http://ipinfo.io/<ip>/geo. ipinfo now 301-redirects http->https with an empty/HTML body; Geocoder does not follow it -> 'response was not valid JSON' -> no result. detect_geo_state then leaves geo_state blank and geo_country defaults to 'US', so (a) Cdp::Catalog#available? fails closed (US && subdivision.nil? => false) producing 'Buying USDC via Coinbase isn't available in your region yet' for ALL US users, and (b) GeoSetting.blocked?(nil) returns false so the WA/ID/MT/LA/AZ/HI/NV/CA legal blocklist silently stops enforcing. CDP integration itself is healthy (onramp_available?(US,CA)/(US,CO)=true, buy/config+buy/options=200 with USDC, key decodes to 64 bytes). FIX: set use_https: true in config/initializers/geocoder.rb (proven: with use_https:true the dyno lookup returns country=US region=California). No ipinfo token needed (raw API works from Heroku IP; lookups cached per session). Operator chose: one-line fix only, PR-only handoff (do NOT deploy to mainnet).

Stage Timeline

Who handled each stage, the time it took (measured), and the model / tokens / cost reported (best-effort) — plus who's on it right now. — means the agent didn't report that metric.

  1. Created → Designed
    K Kangaskhan
    Kangaskhan
    Model
    —
    Duration
    —
    Tokens
    —
    Cost
    —
    Completed Jun 24, 05:09 · 3 days ago
    api
  2. Designed → Building
    K Kangaskhan
    Kangaskhan
    Model
    claude-opus-4-8
    Duration
    under a minute
    Tokens
    —
    Cost
    —
    Started Jun 24, 05:09
    Completed Jun 24, 05:09 · 3 days ago
    cli
  3. Building → Submitted
    K Kangaskhan
    Kangaskhan
    Model
    claude-opus-4-8
    Duration
    11 minutes
    Tokens
    10,197,966
    Cost
    ~$7.41
    Started Jun 24, 05:09
    Completed Jun 24, 05:19 · 3 days ago
    cli
  4. Submitted → Reviewed
    C Carl
    Carl primary
    S Shannon
    Shannon light
    Model
    claude-opus-4-8
    Duration
    8 minutes
    Tokens
    4,515,268
    Cost
    ~$3.76
    Started Jun 24, 05:19
    Completed Jun 24, 05:28 · 3 days ago
    cli
  5. Reviewed → Assembled
    S Steffon
    Steffon
    Model
    —
    Duration
    2 minutes
    Tokens
    —
    Cost
    —
    Started Jun 24, 05:28
    Completed Jun 24, 05:29 · 3 days ago
  6. Assembled → Reviewed
    —
    Model
    claude-opus-4-8
    Duration
    under a minute
    Tokens
    —
    Cost
    —
    Started Jun 24, 05:29
    Completed Jun 24, 05:30 · 3 days ago
    cli
  7. Reviewed → Assembled
    S Steffon
    Steffon
    Model
    claude-opus-4-8
    Duration
    10 minutes
    Tokens
    6,886,335
    Cost
    ~$5.51
    Started Jun 24, 05:30
    Completed Jun 24, 05:39 · 3 days ago
    cli
  8. Assembled → Shipped
    A Avi
    Avi
    Model
    —
    Duration
    about 1 hour
    Tokens
    —
    Cost
    —
    Started Jun 24, 05:39
    Completed Jun 24, 06:40 · 3 days ago
  9. Shipped → Archived
    1
    159aaa24-5db3-4c44-aa05-25c79d2902cd
    Model
    claude-opus-4-8
    Duration
    about 11 hours
    Tokens
    121,104,526
    Cost
    ~$98.86
    Started Jun 24, 06:40
    Completed Jun 24, 17:38 · 3 days ago
    cli

Conversation

QA review feedback, agent handoffs, and follow-up notes for this task.

Comment 3 days ago

Review cascade: 2/2 senior approvals. Carl (HEAVY/backend) — verified use_https flips query_url http→https in-process, all 4 acceptance criteria met, regression test confirmed non-tautological (red on http), 5 tests green locally. Shannon (LIGHT) — scoped, clean, all CI green. Non-blocking follow-up (Carl): geo fails OPEN for the state blocklist when indeterminate + detect_geo_state warns instead of ErrorLog — separate task.

Comment avi 3 days ago

Review cascade (3 reviewers, compliance-sensitive): carl[heavy] APPROVE — verified gem source flips ipinfo query_url to https, ran both test files 5/10 green, single call site, no side effects. shannon[light] APPROVE — fix scoped, comment accurate, tests exercise real detect_geo_state->normalize->GeoSetting pipeline. jasper[compliance] APPROVE — blocklist genuinely re-enforces, CDP fails-closed, strictly an improvement. CI all green incl playwright x3, mergeable.

QA Feedback avi 3 days ago

ROLLOUT NOTES (carl+jasper, for Steffon/operator at prod ship): (1) Fix only enforces whatever is in the prod geo_settings row — find_or_create_by! won't auto-add CA; verify prod banned_states includes CA + row enabled via /admin/geo before relying on it. (2) Sessions cache geo_state 24h; /geo/check forces fresh detection so it self-heals on next contest page view — transient only. FOLLOW-UP (jasper, separate task): legal blocklist fails OPEN when US+state-undetectable (VPN/ipinfo-outage); make require_geo_allowed fail closed for US+blank-state. Not introduced by this fix (status quo was always-open); tracked separately.

Handoff steffon 3 days ago

Conductor note: task was adopted onto an already-ASSEMBLED RC (rel-20260624-a59e5f). release.add via the reopen! path set release_slug but left stage=reviewed (should be assembled); subsequent adopt! calls no-op'd because membership already existed. Manually moved reviewed->assembled to match reality (genuinely a QA-deployed member, fix verified live). Filed conductor bug as adopt-onto-assembled-stage-stuck.

Comment 3 days ago

QA PASS on qa.turfmonster.media (Steffon): use_https=true on the deployed dyno, Geocoder.search resolves country=US region=California (was nil), /geo/check returns a real state code, all 3 RC members boot. Held at operator ship gate — release rel-20260624-a59e5f stays assembled on QA; prod not shipped per operator.

Sealed-bid sizing

Edit →

Alex (PM)

—

Avi (PO)

—

Dev

—

Actual

—