Money masking and chargeback timing
Why a money-hidden request can fail loudly instead of degrading quietly, and why old chargebacks never appear in the recent list.
Two money behaviors in Club look like bugs the first time you see them, but are both deliberate — each trades a small inconvenience for never showing a wrong number.
A money-masked response returns an error instead of hidden numbers
Symptom: a team member without money access hits an /api/admin/* endpoint and gets back
500 mask_error — or, for a CSV/export or a live event stream, 403.
Cause: the money-mask middleware that enforces Team Access's show_money=0 is fail-closed.
For a money-hidden principal:
- A JSON body is parsed and masked before it's sent. If masking throws for any reason, the
middleware does not fall back to the original body — it replaces the whole response with a
generic
mask_error(500). - A CSV or event-stream body can't be masked line-by-line at all, so it's denied outright
(
403 money_masked) rather than attempting a partial mask.
This is the intended trade-off
A masking bug degrading to "the screen doesn't load" is the safe failure mode; degrading to "the
screen shows the real numbers" is not. If a money-hidden member reports a mask_error or a
blocked CSV export, that is the fence working as designed — investigate the masking logic itself,
don't route around it.
A refund from weeks ago never shows up in "recent chargebacks"
Symptom: you know a fan was refunded a while back, but they never appear in
GET /api/admin/fans/chargebacks/recent, even with a wide days window.
Cause: the list is keyed by detection time — the moment Club's poller first saw that
payment's status flip to undo and logged a money.refunded event — not the original payment
date, and not whenever OnlyFans actually reversed it (OnlyFans reports no such timestamp). A
refund that happened before this tracking existed has no detection event to key off of, so it is
intentionally excluded rather than backfilled.
Why not backfill it
Backfilling old refunds by payment date would make the list read as "chargebacks that just happened" on the day this tracking shipped — a false spike with nothing behind it. Excluding pre-tracking refunds keeps the recent list trustworthy: every row in it really is something Club noticed within the window, not history reclassified as news.
Both of a fan's transaction list (their card's Transactions section) and the account-wide chip still show refunds correctly by their real transaction date — only the recent chargebacks list uses detection time. See Review recent chargebacks and Review a fan's payment history.
What's next
- Money & Revenue concepts — the money-mask and chargeback rules in their full context.
PPV composer money bugs
Three composer-layer mistakes that are invisible on screen — dollars not converted to cents, a dropped paywall lock, and a preview id outside the attached media.
Naming collisions to not conflate
Same-sounding names, different things — a third-party "Chatter" API that isn't your team, two unrelated PPV pricers, and two smart-link systems with near-identical filenames.