@open-mercato/core 0.8.1-develop.7441.1.b42958b98c → 0.8.1-develop.7447.1.ac22e0f0bc

package/dist/modules/payment_gateways/api/webhook/[provider]/route.js

@@ -1,22 +1,33 @@
 import { NextResponse } from "next/server";
+import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from "@open-mercato/shared/lib/ratelimit/helpers";
-import { getWebhookHandler } from "@open-mercato/shared/modules/payment_gateways/types";
+import {
+  getWebhookHandler,
+  WebhookVerificationUnavailableError
+} from "@open-mercato/shared/modules/payment_gateways/types";
 import { markQueueJobOrigin } from "@open-mercato/shared/lib/queue/dispatchOrigin";
 import { GatewayTransaction } from "../../../data/entities.js";
 import { getPaymentGatewayQueue } from "../../../lib/queue.js";
 import { processPaymentGatewayWebhookJob } from "../../../lib/webhook-processor.js";
 import { paymentGatewaysTag } from "../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
-import { readBoundedRequestBody, WebhookBodyTooLargeError } from "@open-mercato/shared/lib/webhooks";
+import { readBoundedRequestBody, readBoundedRequestBytes, WebhookBodyTooLargeError } from "@open-mercato/shared/lib/webhooks";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
 const logger = createLogger("payment_gateways").child({ component: "webhook" });
 const metadata = {
   path: "/payment_gateways/webhook/[provider]",
   POST: { requireAuth: false }
 };
 const WEBHOOK_VERIFICATION_FAILED = "Webhook verification failed";
+const WEBHOOK_PAYLOAD_TOO_LARGE = "Webhook payload too large";
+const INTERNAL_SERVER_ERROR = "Internal server error";
+const DEFAULT_TEXT_CONTENT_TYPE = "text/plain; charset=utf-8";
+const CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/;
+const JSON_CONTENT_TYPE = /^application\/([\w.+-]+\+)?json(\s*;|$)/;
+const paymentIdHintSchema = z.guid();
 const paymentGatewayWebhookRateLimitConfig = {
   points: 60,
   duration: 60,
@@ -31,14 +42,27 @@ async function POST(req, { params }) {
     return NextResponse.json({ error: `No webhook handler for provider: ${providerKey}` }, { status: 404 });
   }
   const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey);
-  if (rateLimitResponse) return rateLimitResponse;
+  const outcome = rateLimitResponse ? "rate_limited" : await receiveWebhook(req, providerKey, registration, container);
+  const response = respond(registration, outcome, rateLimitResponse);
+  const logFields = { providerKey, outcome, status: response.status };
+  if (outcome === "accepted") logger.info("Webhook handled", logFields);
+  else logger.warn("Webhook handled", logFields);
+  return response;
+}
+async function receiveWebhook(req, providerKey, registration, container) {
   let rawBody;
+  let bodyText;
   try {
-    rawBody = registration.maxBodyBytes === void 0 ? await req.text() : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes });
-  } catch (error) {
-    if (error instanceof WebhookBodyTooLargeError) {
-      return NextResponse.json({ error: "Webhook payload too large" }, { status: 413 });
+    if (registration.rawBody === "bytes") {
+      const bytes = registration.maxBodyBytes === void 0 ? new Uint8Array(await req.arrayBuffer()) : await readBoundedRequestBytes(req, { maxBytes: registration.maxBodyBytes });
+      rawBody = Buffer.from(bytes);
+      bodyText = new TextDecoder().decode(rawBody);
+    } else {
+      bodyText = registration.maxBodyBytes === void 0 ? await req.text() : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes });
+      rawBody = bodyText;
     }
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) return "payload_too_large";
     throw error;
   }
   const headers = {};
@@ -49,62 +73,181 @@ async function POST(req, { params }) {
   const em = container.resolve("em");
   const integrationCredentialsService = container.resolve("integrationCredentialsService");
   const queue = getPaymentGatewayQueue(registration.queue ?? "payment-gateways-webhook");
-  const payload = await readJsonSafe(rawBody);
-  const sessionIdHint = registration.readSessionIdHint?.(payload) ?? null;
+  const payload = await readJsonSafe(bodyText);
+  const locatorContext = { rawBody, headers };
+  let sessionIdHint;
+  let paymentIdHint;
   try {
-    const candidates = sessionIdHint ? await findWithDecryption(
-      em,
-      GatewayTransaction,
-      {
-        providerKey,
-        providerSessionId: sessionIdHint,
-        deletedAt: null
-      },
-      { limit: 10, orderBy: { createdAt: "desc" } }
-    ) : [];
-    let transaction = null;
-    let matchedScope = null;
-    let event = null;
-    let lastVerificationError = null;
+    sessionIdHint = normalizeSessionIdHint(registration.readSessionIdHint?.(payload, locatorContext));
+    paymentIdHint = normalizePaymentIdHint(registration.readPaymentIdHint?.(payload, locatorContext));
+  } catch (error) {
+    reportWebhookError(error, "payment_gateways.webhook_locator_failed");
+    return "no_candidate";
+  }
+  try {
+    let candidates;
+    try {
+      candidates = sessionIdHint || paymentIdHint ? await findWithDecryption(
+        em,
+        GatewayTransaction,
+        {
+          providerKey,
+          ...sessionIdHint ? { providerSessionId: sessionIdHint } : {},
+          ...paymentIdHint ? { paymentId: paymentIdHint } : {},
+          deletedAt: null
+        },
+        { limit: 10, orderBy: { createdAt: "desc" } }
+      ) : [];
+    } catch (error) {
+      reportWebhookError(error, "payment_gateways.webhook_lookup_failed");
+      return "processing_failed";
+    }
+    if (candidates.length === 0) return "no_candidate";
+    const verifiedMatches = [];
+    let verificationUnavailable = false;
     for (const candidate of candidates) {
       const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId };
-      const credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {};
+      let credentials;
       try {
-        event = await registration.handler({ rawBody, headers, credentials });
-        transaction = candidate;
-        matchedScope = candidateScope;
-        break;
+        credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {};
       } catch (error) {
-        lastVerificationError = error;
+        reportWebhookError(error, "payment_gateways.webhook_credentials_failed");
+        verificationUnavailable = true;
+        continue;
       }
+      try {
+        const candidateEvent = await registration.handler({
+          rawBody,
+          headers,
+          credentials,
+          candidate: {
+            transactionId: candidate.id,
+            paymentId: candidate.paymentId,
+            providerSessionId: candidate.providerSessionId ?? null,
+            amount: candidate.amount,
+            currencyCode: candidate.currencyCode
+          }
+        });
+        verifiedMatches.push({ transaction: candidate, scope: candidateScope, event: candidateEvent });
+      } catch (error) {
+        if (error instanceof WebhookVerificationUnavailableError) verificationUnavailable = true;
+      }
+    }
+    if (verifiedMatches.length > 1) {
+      logger.error("Webhook matched multiple verified candidates", {
+        providerKey,
+        candidateCount: verifiedMatches.length
+      });
+      getTelemetryRuntime()?.reportError(
+        new Error("[internal] Webhook matched multiple verified candidates"),
+        { module: "payment_gateways", code: "payment_gateways.webhook_ambiguous_candidates" }
+      );
+      return "verification_failed";
     }
-    if (!event || !transaction || !matchedScope) {
-      throw lastVerificationError ?? new Error("Webhook verification failed: no matching transaction");
+    if (verificationUnavailable && verifiedMatches.length === 1) {
+      logger.warn("Webhook candidate left unverified; ambiguity cannot be ruled out", {
+        providerKey,
+        candidateCount: candidates.length
+      });
+      return "verification_unavailable";
     }
-    const scope = matchedScope;
+    const [match] = verifiedMatches;
+    if (!match) return verificationUnavailable ? "verification_unavailable" : "verification_failed";
     const jobPayload = markQueueJobOrigin({
       providerKey,
-      event,
-      transactionId: transaction.id,
-      scope
+      event: match.event,
+      transactionId: match.transaction.id,
+      scope: match.scope
     }, "inbound-webhook");
-    if (process.env.QUEUE_STRATEGY === "async") {
-      await queue.enqueue(jobPayload);
-    } else {
-      await processPaymentGatewayWebhookJob(
-        {
-          em: container.resolve("em"),
-          paymentGatewayService: service,
-          integrationLogService: container.resolve("integrationLogService")
-        },
-        jobPayload
-      );
+    try {
+      if (process.env.QUEUE_STRATEGY === "async") {
+        await queue.enqueue(jobPayload);
+      } else {
+        await processPaymentGatewayWebhookJob(
+          {
+            em: container.resolve("em"),
+            paymentGatewayService: service,
+            integrationLogService: container.resolve("integrationLogService")
+          },
+          jobPayload
+        );
+      }
+    } catch (error) {
+      getTelemetryRuntime()?.reportError(error, {
+        module: "payment_gateways",
+        code: "payment_gateways.webhook_processing_failed"
+      });
+      return "processing_failed";
+    }
+    return "accepted";
+  } catch (error) {
+    reportWebhookError(error, "payment_gateways.webhook_unexpected_failure");
+    return "verification_failed";
+  }
+}
+function respond(registration, outcome, rateLimitResponse) {
+  if (!registration.formatResponse) return legacyResponse(outcome, rateLimitResponse);
+  try {
+    const response = toValidatedResponse(registration.formatResponse(outcome));
+    if (outcome === "rate_limited" && rateLimitResponse) {
+      rateLimitResponse.headers.forEach((value, key) => {
+        if (key !== "content-type" && key !== "content-length") response.headers.set(key, value);
+      });
+    }
+    return response;
+  } catch (error) {
+    getTelemetryRuntime()?.reportError(error, {
+      module: "payment_gateways",
+      code: "payment_gateways.webhook_formatter_invalid"
+    });
+    return NextResponse.json({ error: INTERNAL_SERVER_ERROR }, { status: 500 });
+  }
+}
+function legacyResponse(outcome, rateLimitResponse) {
+  if (outcome === "rate_limited" && rateLimitResponse) return rateLimitResponse;
+  if (outcome === "accepted") return NextResponse.json({ received: true, queued: true }, { status: 202 });
+  if (outcome === "payload_too_large") return NextResponse.json({ error: WEBHOOK_PAYLOAD_TOO_LARGE }, { status: 413 });
+  return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 });
+}
+function toValidatedResponse(formatted) {
+  const { status, body, contentType } = formatted;
+  if (!Number.isInteger(status) || status < 200 || status > 599) {
+    throw new Error("[internal] Webhook formatter returned an invalid status");
+  }
+  if (contentType !== void 0 && (typeof contentType !== "string" || CONTROL_CHARACTERS.test(contentType))) {
+    throw new Error("[internal] Webhook formatter returned an invalid content type");
+  }
+  const normalizedContentType = contentType?.toLowerCase();
+  if (typeof body === "string") {
+    if (normalizedContentType !== void 0 && !normalizedContentType.startsWith("text/")) {
+      throw new Error("[internal] Webhook formatter returned a non-text content type for a text body");
     }
-    return NextResponse.json({ received: true, queued: true }, { status: 202 });
-  } catch (err) {
-    logger.warn("Webhook verification failed", { providerKey, err });
-    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 });
+    return new NextResponse(body, { status, headers: { "content-type": contentType ?? DEFAULT_TEXT_CONTENT_TYPE } });
+  }
+  if (!isPlainObject(body)) {
+    throw new Error("[internal] Webhook formatter returned an invalid body");
   }
+  if (normalizedContentType !== void 0 && !JSON_CONTENT_TYPE.test(normalizedContentType)) {
+    throw new Error("[internal] Webhook formatter returned a non-JSON content type for an object body");
+  }
+  const response = NextResponse.json(body, { status });
+  if (contentType !== void 0) response.headers.set("content-type", contentType);
+  return response;
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function reportWebhookError(error, code) {
+  getTelemetryRuntime()?.reportError(error, { module: "payment_gateways", code });
+}
+function normalizeSessionIdHint(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function normalizePaymentIdHint(value) {
+  const parsed = paymentIdHintSchema.safeParse(value);
+  return parsed.success ? parsed.data : null;
 }
 async function checkProviderWebhookRateLimit(container, req, providerKey) {
   const rateLimiterService = tryResolve(container, "rateLimiterService");
@@ -131,10 +274,15 @@ const openApi = {
       summary: "Process inbound webhook from payment provider",
       tags: [paymentGatewaysTag],
       responses: [
-        { status: 202, description: "Webhook accepted for async processing" },
-        { status: 401, description: "Signature verification failed" },
+        { status: 200, description: "Webhook accepted (provider-defined acknowledgement may apply)" },
+        { status: 202, description: "Webhook accepted for processing (default acknowledgement)" },
+        { status: 400, description: "Webhook rejected (provider-defined response may apply)" },
+        { status: 401, description: "Webhook could not be verified or processed (default failure response)" },
+        { status: 404, description: "Unknown provider" },
         { status: 413, description: "Webhook payload too large" },
-        { status: 404, description: "Unknown provider" }
+        { status: 429, description: "Too many webhook requests" },
+        { status: 500, description: "Internal server error (provider-defined response may apply)" },
+        { status: 503, description: "Webhook temporarily unavailable (provider-defined response may apply)" }
       ]
     }
   }

package/dist/modules/payment_gateways/api/webhook/[provider]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/payment_gateways/api/webhook/%5Bprovider%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getWebhookHandler } from '@open-mercato/shared/modules/payment_gateways/types'\nimport { markQueueJobOrigin } from '@open-mercato/shared/lib/queue/dispatchOrigin'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { PaymentGatewayService } from '../../../lib/gateway-service'\nimport type { CredentialsService } from '../../../../integrations/lib/credentials-service'\nimport { GatewayTransaction } from '../../../data/entities'\nimport { getPaymentGatewayQueue } from '../../../lib/queue'\nimport { processPaymentGatewayWebhookJob } from '../../../lib/webhook-processor'\nimport { paymentGatewaysTag } from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('payment_gateways').child({ component: 'webhook' })\n\nexport const metadata = {\n  path: '/payment_gateways/webhook/[provider]',\n  POST: { requireAuth: false },\n}\n\nconst WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'\n\nconst paymentGatewayWebhookRateLimitConfig = {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'payment_gateways:webhook',\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n  const container = await createRequestContainer()\n  const registration = getWebhookHandler(providerKey)\n  if (!registration) {\n    return NextResponse.json({ error: `No webhook handler for provider: ${providerKey}` }, { status: 404 })\n  }\n\n  const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)\n  if (rateLimitResponse) return rateLimitResponse\n\n  let rawBody: string\n  try {\n    rawBody = registration.maxBodyBytes === undefined\n      ? await req.text()\n      : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })\n    }\n    throw error\n  }\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n  const em = container.resolve('em') as EntityManager\n  const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const queue = getPaymentGatewayQueue(registration.queue ?? 'payment-gateways-webhook')\n  const payload = await readJsonSafe<Record<string, unknown>>(rawBody)\n  const sessionIdHint = registration.readSessionIdHint?.(payload) ?? null\n\n  try {\n    // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a\n    // GatewayTransaction whose per-tenant credentials successfully verify the inbound\n    // signature \u2014 NEVER from attacker-controlled payload metadata. If no candidate\n    // transaction can be located by the provider-reported session id, or no candidate's\n    // credentials can verify the signature, we fail closed with 401. This prevents\n    // forged webhooks (e.g. mock gateway PoC) from mutating another tenant's payment\n    // state via `event.data.metadata.{organizationId,tenantId}`.\n    const candidates = sessionIdHint\n      ? await findWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerKey,\n          providerSessionId: sessionIdHint,\n          deletedAt: null,\n        },\n        { limit: 10, orderBy: { createdAt: 'desc' } },\n      )\n      : []\n\n    let transaction: GatewayTransaction | null = null\n    let matchedScope: { organizationId: string; tenantId: string } | null = null\n    let event: Awaited<ReturnType<typeof registration.handler>> | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates) {\n      const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }\n      const credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {}\n      try {\n        event = await registration.handler({ rawBody, headers, credentials })\n        transaction = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !transaction || !matchedScope) {\n      throw lastVerificationError ?? new Error('Webhook verification failed: no matching transaction')\n    }\n\n    const scope = matchedScope\n\n    const jobPayload = markQueueJobOrigin({\n      providerKey,\n      event,\n      transactionId: transaction.id,\n      scope,\n    }, 'inbound-webhook')\n\n    if (process.env.QUEUE_STRATEGY === 'async') {\n      await queue.enqueue(jobPayload)\n    } else {\n      await processPaymentGatewayWebhookJob(\n        {\n          em: container.resolve('em') as EntityManager,\n          paymentGatewayService: service,\n          integrationLogService: container.resolve('integrationLogService') as IntegrationLogService,\n        },\n        jobPayload,\n      )\n    }\n\n    return NextResponse.json({ received: true, queued: true }, { status: 202 })\n  } catch (err: unknown) {\n    logger.warn('Webhook verification failed', { providerKey, err })\n    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })\n  }\n}\n\nasync function checkProviderWebhookRateLimit(\n  container: { resolve: (name: string) => unknown },\n  req: Request,\n  providerKey: string,\n): Promise<NextResponse | null> {\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n  if (!rateLimiterService) return null\n\n  return checkRateLimit(\n    rateLimiterService,\n    paymentGatewayWebhookRateLimitConfig,\n    `${providerKey}:${getClientIp(req, rateLimiterService.trustProxyDepth) ?? 'unknown'}`,\n    RATE_LIMIT_ERROR_FALLBACK,\n  )\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Receive payment gateway webhook',\n  methods: {\n    POST: {\n      summary: 'Process inbound webhook from payment provider',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB,aAAa,iCAAiC;AAGvE,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AAInC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,gCAAgC;AAEjE,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,8BAA8B;AAEpC,MAAM,uCAAuC;AAAA,EAC3C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAqE;AACrH,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,kBAAkB,WAAW;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,WAAW,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,QAAM,oBAAoB,MAAM,8BAA8B,WAAW,KAAK,WAAW;AACzF,MAAI,kBAAmB,QAAO;AAE9B,MAAI;AACJ,MAAI;AACF,cAAU,aAAa,iBAAiB,SACpC,MAAM,IAAI,KAAK,IACf,MAAM,uBAAuB,KAAK,EAAE,UAAU,aAAa,aAAa,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AACzD,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,gCAAgC,UAAU,QAAQ,+BAA+B;AACvF,QAAM,QAAQ,uBAAuB,aAAa,SAAS,0BAA0B;AACrF,QAAM,UAAU,MAAM,aAAsC,OAAO;AACnE,QAAM,gBAAgB,aAAa,oBAAoB,OAAO,KAAK;AAEnE,MAAI;AAQF,UAAM,aAAa,gBACf,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,mBAAmB;AAAA,QACnB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,OAAO,IAAI,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC9C,IACE,CAAC;AAEL,QAAI,cAAyC;AAC7C,QAAI,eAAoE;AACxE,QAAI,QAAiE;AACrE,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAY;AAClC,YAAM,iBAAiB,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AAChG,YAAM,cAAc,MAAM,8BAA8B,QAAQ,WAAW,WAAW,IAAI,cAAc,KAAK,CAAC;AAC9G,UAAI;AACF,gBAAQ,MAAM,aAAa,QAAQ,EAAE,SAAS,SAAS,YAAY,CAAC;AACpE,sBAAc;AACd,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc;AAC3C,YAAM,yBAAyB,IAAI,MAAM,sDAAsD;AAAA,IACjG;AAEA,UAAM,QAAQ;AAEd,UAAM,aAAa,mBAAmB;AAAA,MACpC;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,iBAAiB;AAEpB,QAAI,QAAQ,IAAI,mBAAmB,SAAS;AAC1C,YAAM,MAAM,QAAQ,UAAU;AAAA,IAChC,OAAO;AACL,YAAM;AAAA,QACJ;AAAA,UACE,IAAI,UAAU,QAAQ,IAAI;AAAA,UAC1B,uBAAuB;AAAA,UACvB,uBAAuB,UAAU,QAAQ,uBAAuB;AAAA,QAClE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E,SAAS,KAAc;AACrB,WAAO,KAAK,+BAA+B,EAAE,aAAa,IAAI,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,8BACb,WACA,KACA,aAC8B;AAC9B,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AACzF,MAAI,CAAC,mBAAoB,QAAO;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,WAAW,IAAI,YAAY,KAAK,mBAAmB,eAAe,KAAK,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  getWebhookHandler,\n  WebhookVerificationUnavailableError,\n  type WebhookHandlerRegistration,\n  type WebhookHttpResponse,\n  type WebhookResponseOutcome,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport { markQueueJobOrigin } from '@open-mercato/shared/lib/queue/dispatchOrigin'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { PaymentGatewayService } from '../../../lib/gateway-service'\nimport type { CredentialsService } from '../../../../integrations/lib/credentials-service'\nimport { GatewayTransaction } from '../../../data/entities'\nimport { getPaymentGatewayQueue } from '../../../lib/queue'\nimport { processPaymentGatewayWebhookJob } from '../../../lib/webhook-processor'\nimport { paymentGatewaysTag } from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, readBoundedRequestBytes, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\n\nconst logger = createLogger('payment_gateways').child({ component: 'webhook' })\n\nexport const metadata = {\n  path: '/payment_gateways/webhook/[provider]',\n  POST: { requireAuth: false },\n}\n\nconst WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'\nconst WEBHOOK_PAYLOAD_TOO_LARGE = 'Webhook payload too large'\nconst INTERNAL_SERVER_ERROR = 'Internal server error'\nconst DEFAULT_TEXT_CONTENT_TYPE = 'text/plain; charset=utf-8'\nconst CONTROL_CHARACTERS = /[\\u0000-\\u001F\\u007F]/\nconst JSON_CONTENT_TYPE = /^application\\/([\\w.+-]+\\+)?json(\\s*;|$)/\n\nconst paymentIdHintSchema = z.guid()\n\nconst paymentGatewayWebhookRateLimitConfig = {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'payment_gateways:webhook',\n}\n\ntype RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>\n\nexport async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n  const container = await createRequestContainer()\n  const registration = getWebhookHandler(providerKey)\n  if (!registration) {\n    return NextResponse.json({ error: `No webhook handler for provider: ${providerKey}` }, { status: 404 })\n  }\n\n  const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)\n  const outcome: WebhookResponseOutcome = rateLimitResponse\n    ? 'rate_limited'\n    : await receiveWebhook(req, providerKey, registration, container)\n  const response = respond(registration, outcome, rateLimitResponse)\n  const logFields = { providerKey, outcome, status: response.status }\n  if (outcome === 'accepted') logger.info('Webhook handled', logFields)\n  else logger.warn('Webhook handled', logFields)\n  return response\n}\n\nasync function receiveWebhook(\n  req: Request,\n  providerKey: string,\n  registration: WebhookHandlerRegistration,\n  container: RequestContainer,\n): Promise<WebhookResponseOutcome> {\n  let rawBody: string | Buffer\n  let bodyText: string\n  try {\n    if (registration.rawBody === 'bytes') {\n      const bytes = registration.maxBodyBytes === undefined\n        ? new Uint8Array(await req.arrayBuffer())\n        : await readBoundedRequestBytes(req, { maxBytes: registration.maxBodyBytes })\n      rawBody = Buffer.from(bytes)\n      bodyText = new TextDecoder().decode(rawBody)\n    } else {\n      bodyText = registration.maxBodyBytes === undefined\n        ? await req.text()\n        : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })\n      rawBody = bodyText\n    }\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) return 'payload_too_large'\n    throw error\n  }\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n  const em = container.resolve('em') as EntityManager\n  const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const queue = getPaymentGatewayQueue(registration.queue ?? 'payment-gateways-webhook')\n  const payload = await readJsonSafe<Record<string, unknown>>(bodyText)\n  const locatorContext = { rawBody, headers }\n  let sessionIdHint: string | null\n  let paymentIdHint: string | null\n  try {\n    sessionIdHint = normalizeSessionIdHint(registration.readSessionIdHint?.(payload, locatorContext))\n    paymentIdHint = normalizePaymentIdHint(registration.readPaymentIdHint?.(payload, locatorContext))\n  } catch (error: unknown) {\n    reportWebhookError(error, 'payment_gateways.webhook_locator_failed')\n    return 'no_candidate'\n  }\n\n  try {\n    // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a\n    // GatewayTransaction whose per-tenant credentials successfully verify the inbound\n    // signature \u2014 NEVER from attacker-controlled payload metadata. If no candidate\n    // transaction can be located by the provider-reported session or payment id, or no\n    // candidate's credentials can verify the signature, we fail closed. This\n    // prevents forged webhooks (e.g. mock gateway PoC) from mutating another tenant's\n    // payment state via `event.data.metadata.{organizationId,tenantId}`. When more than one\n    // candidate verifies, the scope is ambiguous and we also fail closed.\n    let candidates: GatewayTransaction[]\n    try {\n      candidates = sessionIdHint || paymentIdHint\n        ? await findWithDecryption(\n          em,\n          GatewayTransaction,\n          {\n            providerKey,\n            ...(sessionIdHint ? { providerSessionId: sessionIdHint } : {}),\n            ...(paymentIdHint ? { paymentId: paymentIdHint } : {}),\n            deletedAt: null,\n          },\n          { limit: 10, orderBy: { createdAt: 'desc' } },\n        )\n        : []\n    } catch (error: unknown) {\n      reportWebhookError(error, 'payment_gateways.webhook_lookup_failed')\n      return 'processing_failed'\n    }\n\n    if (candidates.length === 0) return 'no_candidate'\n\n    const verifiedMatches: Array<{\n      transaction: GatewayTransaction\n      scope: { organizationId: string; tenantId: string }\n      event: Awaited<ReturnType<typeof registration.handler>>\n    }> = []\n    let verificationUnavailable = false\n\n    for (const candidate of candidates) {\n      const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }\n      let credentials: Record<string, unknown>\n      try {\n        credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {}\n      } catch (error: unknown) {\n        reportWebhookError(error, 'payment_gateways.webhook_credentials_failed')\n        verificationUnavailable = true\n        continue\n      }\n      try {\n        const candidateEvent = await registration.handler({\n          rawBody,\n          headers,\n          credentials,\n          candidate: {\n            transactionId: candidate.id,\n            paymentId: candidate.paymentId,\n            providerSessionId: candidate.providerSessionId ?? null,\n            amount: candidate.amount,\n            currencyCode: candidate.currencyCode,\n          },\n        })\n        verifiedMatches.push({ transaction: candidate, scope: candidateScope, event: candidateEvent })\n      } catch (error: unknown) {\n        if (error instanceof WebhookVerificationUnavailableError) verificationUnavailable = true\n      }\n    }\n\n    if (verifiedMatches.length > 1) {\n      logger.error('Webhook matched multiple verified candidates', {\n        providerKey,\n        candidateCount: verifiedMatches.length,\n      })\n      getTelemetryRuntime()?.reportError(\n        new Error('[internal] Webhook matched multiple verified candidates'),\n        { module: 'payment_gateways', code: 'payment_gateways.webhook_ambiguous_candidates' },\n      )\n      return 'verification_failed'\n    }\n\n    if (verificationUnavailable && verifiedMatches.length === 1) {\n      logger.warn('Webhook candidate left unverified; ambiguity cannot be ruled out', {\n        providerKey,\n        candidateCount: candidates.length,\n      })\n      return 'verification_unavailable'\n    }\n\n    const [match] = verifiedMatches\n    if (!match) return verificationUnavailable ? 'verification_unavailable' : 'verification_failed'\n\n    const jobPayload = markQueueJobOrigin({\n      providerKey,\n      event: match.event,\n      transactionId: match.transaction.id,\n      scope: match.scope,\n    }, 'inbound-webhook')\n\n    try {\n      if (process.env.QUEUE_STRATEGY === 'async') {\n        await queue.enqueue(jobPayload)\n      } else {\n        await processPaymentGatewayWebhookJob(\n          {\n            em: container.resolve('em') as EntityManager,\n            paymentGatewayService: service,\n            integrationLogService: container.resolve('integrationLogService') as IntegrationLogService,\n          },\n          jobPayload,\n        )\n      }\n    } catch (error: unknown) {\n      getTelemetryRuntime()?.reportError(error, {\n        module: 'payment_gateways',\n        code: 'payment_gateways.webhook_processing_failed',\n      })\n      return 'processing_failed'\n    }\n\n    return 'accepted'\n  } catch (error: unknown) {\n    reportWebhookError(error, 'payment_gateways.webhook_unexpected_failure')\n    return 'verification_failed'\n  }\n}\n\nfunction respond(\n  registration: WebhookHandlerRegistration,\n  outcome: WebhookResponseOutcome,\n  rateLimitResponse: NextResponse | null,\n): NextResponse {\n  if (!registration.formatResponse) return legacyResponse(outcome, rateLimitResponse)\n  try {\n    const response = toValidatedResponse(registration.formatResponse(outcome))\n    if (outcome === 'rate_limited' && rateLimitResponse) {\n      rateLimitResponse.headers.forEach((value, key) => {\n        if (key !== 'content-type' && key !== 'content-length') response.headers.set(key, value)\n      })\n    }\n    return response\n  } catch (error: unknown) {\n    getTelemetryRuntime()?.reportError(error, {\n      module: 'payment_gateways',\n      code: 'payment_gateways.webhook_formatter_invalid',\n    })\n    return NextResponse.json({ error: INTERNAL_SERVER_ERROR }, { status: 500 })\n  }\n}\n\nfunction legacyResponse(outcome: WebhookResponseOutcome, rateLimitResponse: NextResponse | null): NextResponse {\n  if (outcome === 'rate_limited' && rateLimitResponse) return rateLimitResponse\n  if (outcome === 'accepted') return NextResponse.json({ received: true, queued: true }, { status: 202 })\n  if (outcome === 'payload_too_large') return NextResponse.json({ error: WEBHOOK_PAYLOAD_TOO_LARGE }, { status: 413 })\n  return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })\n}\n\nfunction toValidatedResponse(formatted: WebhookHttpResponse): NextResponse {\n  const { status, body, contentType } = formatted\n  if (!Number.isInteger(status) || status < 200 || status > 599) {\n    throw new Error('[internal] Webhook formatter returned an invalid status')\n  }\n  if (contentType !== undefined && (typeof contentType !== 'string' || CONTROL_CHARACTERS.test(contentType))) {\n    throw new Error('[internal] Webhook formatter returned an invalid content type')\n  }\n  const normalizedContentType = contentType?.toLowerCase()\n  if (typeof body === 'string') {\n    if (normalizedContentType !== undefined && !normalizedContentType.startsWith('text/')) {\n      throw new Error('[internal] Webhook formatter returned a non-text content type for a text body')\n    }\n    return new NextResponse(body, { status, headers: { 'content-type': contentType ?? DEFAULT_TEXT_CONTENT_TYPE } })\n  }\n  if (!isPlainObject(body)) {\n    throw new Error('[internal] Webhook formatter returned an invalid body')\n  }\n  if (normalizedContentType !== undefined && !JSON_CONTENT_TYPE.test(normalizedContentType)) {\n    throw new Error('[internal] Webhook formatter returned a non-JSON content type for an object body')\n  }\n  const response = NextResponse.json(body, { status })\n  if (contentType !== undefined) response.headers.set('content-type', contentType)\n  return response\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false\n  const prototype = Object.getPrototypeOf(value)\n  return prototype === Object.prototype || prototype === null\n}\n\nfunction reportWebhookError(error: unknown, code: string): void {\n  getTelemetryRuntime()?.reportError(error, { module: 'payment_gateways', code })\n}\n\nfunction normalizeSessionIdHint(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction normalizePaymentIdHint(value: unknown): string | null {\n  const parsed = paymentIdHintSchema.safeParse(value)\n  return parsed.success ? parsed.data : null\n}\n\nasync function checkProviderWebhookRateLimit(\n  container: { resolve: (name: string) => unknown },\n  req: Request,\n  providerKey: string,\n): Promise<NextResponse | null> {\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n  if (!rateLimiterService) return null\n\n  return checkRateLimit(\n    rateLimiterService,\n    paymentGatewayWebhookRateLimitConfig,\n    `${providerKey}:${getClientIp(req, rateLimiterService.trustProxyDepth) ?? 'unknown'}`,\n    RATE_LIMIT_ERROR_FALLBACK,\n  )\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Receive payment gateway webhook',\n  methods: {\n    POST: {\n      summary: 'Process inbound webhook from payment provider',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Webhook accepted (provider-defined acknowledgement may apply)' },\n        { status: 202, description: 'Webhook accepted for processing (default acknowledgement)' },\n        { status: 400, description: 'Webhook rejected (provider-defined response may apply)' },\n        { status: 401, description: 'Webhook could not be verified or processed (default failure response)' },\n        { status: 404, description: 'Unknown provider' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 429, description: 'Too many webhook requests' },\n        { status: 500, description: 'Internal server error (provider-defined response may apply)' },\n        { status: 503, description: 'Webhook temporarily unavailable (provider-defined response may apply)' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB,aAAa,iCAAiC;AAGvE;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,0BAA0B;AAInC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,yBAAyB,gCAAgC;AAC1F,SAAS,2BAA2B;AAEpC,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,8BAA8B;AACpC,MAAM,4BAA4B;AAClC,MAAM,wBAAwB;AAC9B,MAAM,4BAA4B;AAClC,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB;AAE1B,MAAM,sBAAsB,EAAE,KAAK;AAEnC,MAAM,uCAAuC;AAAA,EAC3C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb;AAIA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAqE;AACrH,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,kBAAkB,WAAW;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,WAAW,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,QAAM,oBAAoB,MAAM,8BAA8B,WAAW,KAAK,WAAW;AACzF,QAAM,UAAkC,oBACpC,iBACA,MAAM,eAAe,KAAK,aAAa,cAAc,SAAS;AAClE,QAAM,WAAW,QAAQ,cAAc,SAAS,iBAAiB;AACjE,QAAM,YAAY,EAAE,aAAa,SAAS,QAAQ,SAAS,OAAO;AAClE,MAAI,YAAY,WAAY,QAAO,KAAK,mBAAmB,SAAS;AAAA,MAC/D,QAAO,KAAK,mBAAmB,SAAS;AAC7C,SAAO;AACT;AAEA,eAAe,eACb,KACA,aACA,cACA,WACiC;AACjC,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,QAAI,aAAa,YAAY,SAAS;AACpC,YAAM,QAAQ,aAAa,iBAAiB,SACxC,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC,IACtC,MAAM,wBAAwB,KAAK,EAAE,UAAU,aAAa,aAAa,CAAC;AAC9E,gBAAU,OAAO,KAAK,KAAK;AAC3B,iBAAW,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,IAC7C,OAAO;AACL,iBAAW,aAAa,iBAAiB,SACrC,MAAM,IAAI,KAAK,IACf,MAAM,uBAAuB,KAAK,EAAE,UAAU,aAAa,aAAa,CAAC;AAC7E,gBAAU;AAAA,IACZ;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,yBAA0B,QAAO;AACtD,UAAM;AAAA,EACR;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AACzD,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,gCAAgC,UAAU,QAAQ,+BAA+B;AACvF,QAAM,QAAQ,uBAAuB,aAAa,SAAS,0BAA0B;AACrF,QAAM,UAAU,MAAM,aAAsC,QAAQ;AACpE,QAAM,iBAAiB,EAAE,SAAS,QAAQ;AAC1C,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,oBAAgB,uBAAuB,aAAa,oBAAoB,SAAS,cAAc,CAAC;AAChG,oBAAgB,uBAAuB,aAAa,oBAAoB,SAAS,cAAc,CAAC;AAAA,EAClG,SAAS,OAAgB;AACvB,uBAAmB,OAAO,yCAAyC;AACnE,WAAO;AAAA,EACT;AAEA,MAAI;AASF,QAAI;AACJ,QAAI;AACF,mBAAa,iBAAiB,gBAC1B,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,GAAI,gBAAgB,EAAE,mBAAmB,cAAc,IAAI,CAAC;AAAA,UAC5D,GAAI,gBAAgB,EAAE,WAAW,cAAc,IAAI,CAAC;AAAA,UACpD,WAAW;AAAA,QACb;AAAA,QACA,EAAE,OAAO,IAAI,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC9C,IACE,CAAC;AAAA,IACP,SAAS,OAAgB;AACvB,yBAAmB,OAAO,wCAAwC;AAClE,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,UAAM,kBAID,CAAC;AACN,QAAI,0BAA0B;AAE9B,eAAW,aAAa,YAAY;AAClC,YAAM,iBAAiB,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AAChG,UAAI;AACJ,UAAI;AACF,sBAAc,MAAM,8BAA8B,QAAQ,WAAW,WAAW,IAAI,cAAc,KAAK,CAAC;AAAA,MAC1G,SAAS,OAAgB;AACvB,2BAAmB,OAAO,6CAA6C;AACvE,kCAA0B;AAC1B;AAAA,MACF;AACA,UAAI;AACF,cAAM,iBAAiB,MAAM,aAAa,QAAQ;AAAA,UAChD;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW;AAAA,YACT,eAAe,UAAU;AAAA,YACzB,WAAW,UAAU;AAAA,YACrB,mBAAmB,UAAU,qBAAqB;AAAA,YAClD,QAAQ,UAAU;AAAA,YAClB,cAAc,UAAU;AAAA,UAC1B;AAAA,QACF,CAAC;AACD,wBAAgB,KAAK,EAAE,aAAa,WAAW,OAAO,gBAAgB,OAAO,eAAe,CAAC;AAAA,MAC/F,SAAS,OAAgB;AACvB,YAAI,iBAAiB,oCAAqC,2BAA0B;AAAA,MACtF;AAAA,IACF;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC9B,aAAO,MAAM,gDAAgD;AAAA,QAC3D;AAAA,QACA,gBAAgB,gBAAgB;AAAA,MAClC,CAAC;AACD,0BAAoB,GAAG;AAAA,QACrB,IAAI,MAAM,yDAAyD;AAAA,QACnE,EAAE,QAAQ,oBAAoB,MAAM,gDAAgD;AAAA,MACtF;AACA,aAAO;AAAA,IACT;AAEA,QAAI,2BAA2B,gBAAgB,WAAW,GAAG;AAC3D,aAAO,KAAK,oEAAoE;AAAA,QAC9E;AAAA,QACA,gBAAgB,WAAW;AAAA,MAC7B,CAAC;AACD,aAAO;AAAA,IACT;AAEA,UAAM,CAAC,KAAK,IAAI;AAChB,QAAI,CAAC,MAAO,QAAO,0BAA0B,6BAA6B;AAE1E,UAAM,aAAa,mBAAmB;AAAA,MACpC;AAAA,MACA,OAAO,MAAM;AAAA,MACb,eAAe,MAAM,YAAY;AAAA,MACjC,OAAO,MAAM;AAAA,IACf,GAAG,iBAAiB;AAEpB,QAAI;AACF,UAAI,QAAQ,IAAI,mBAAmB,SAAS;AAC1C,cAAM,MAAM,QAAQ,UAAU;AAAA,MAChC,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,YACE,IAAI,UAAU,QAAQ,IAAI;AAAA,YAC1B,uBAAuB;AAAA,YACvB,uBAAuB,UAAU,QAAQ,uBAAuB;AAAA,UAClE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AACvB,0BAAoB,GAAG,YAAY,OAAO;AAAA,QACxC,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,SAAS,OAAgB;AACvB,uBAAmB,OAAO,6CAA6C;AACvE,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QACP,cACA,SACA,mBACc;AACd,MAAI,CAAC,aAAa,eAAgB,QAAO,eAAe,SAAS,iBAAiB;AAClF,MAAI;AACF,UAAM,WAAW,oBAAoB,aAAa,eAAe,OAAO,CAAC;AACzE,QAAI,YAAY,kBAAkB,mBAAmB;AACnD,wBAAkB,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAChD,YAAI,QAAQ,kBAAkB,QAAQ,iBAAkB,UAAS,QAAQ,IAAI,KAAK,KAAK;AAAA,MACzF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,SAAS,OAAgB;AACvB,wBAAoB,GAAG,YAAY,OAAO;AAAA,MACxC,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEA,SAAS,eAAe,SAAiC,mBAAsD;AAC7G,MAAI,YAAY,kBAAkB,kBAAmB,QAAO;AAC5D,MAAI,YAAY,WAAY,QAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtG,MAAI,YAAY,oBAAqB,QAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACnH,SAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF;AAEA,SAAS,oBAAoB,WAA8C;AACzE,QAAM,EAAE,QAAQ,MAAM,YAAY,IAAI;AACtC,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,OAAO,SAAS,KAAK;AAC7D,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI,gBAAgB,WAAc,OAAO,gBAAgB,YAAY,mBAAmB,KAAK,WAAW,IAAI;AAC1G,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,wBAAwB,aAAa,YAAY;AACvD,MAAI,OAAO,SAAS,UAAU;AAC5B,QAAI,0BAA0B,UAAa,CAAC,sBAAsB,WAAW,OAAO,GAAG;AACrF,YAAM,IAAI,MAAM,+EAA+E;AAAA,IACjG;AACA,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,SAAS,EAAE,gBAAgB,eAAe,0BAA0B,EAAE,CAAC;AAAA,EACjH;AACA,MAAI,CAAC,cAAc,IAAI,GAAG;AACxB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,MAAI,0BAA0B,UAAa,CAAC,kBAAkB,KAAK,qBAAqB,GAAG;AACzF,UAAM,IAAI,MAAM,kFAAkF;AAAA,EACpG;AACA,QAAM,WAAW,aAAa,KAAK,MAAM,EAAE,OAAO,CAAC;AACnD,MAAI,gBAAgB,OAAW,UAAS,QAAQ,IAAI,gBAAgB,WAAW;AAC/E,SAAO;AACT;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,mBAAmB,OAAgB,MAAoB;AAC9D,sBAAoB,GAAG,YAAY,OAAO,EAAE,QAAQ,oBAAoB,KAAK,CAAC;AAChF;AAEA,SAAS,uBAAuB,OAA+B;AAC7D,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,uBAAuB,OAA+B;AAC7D,QAAM,SAAS,oBAAoB,UAAU,KAAK;AAClD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAe,8BACb,WACA,KACA,aAC8B;AAC9B,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AACzF,MAAI,CAAC,mBAAoB,QAAO;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,WAAW,IAAI,YAAY,KAAK,mBAAmB,eAAe,KAAK,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,4DAA4D;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,wEAAwE;AAAA,QACpG,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,8DAA8D;AAAA,QAC1F,EAAE,QAAQ,KAAK,aAAa,wEAAwE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/payment_gateways/lib/gateway-service.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { QueryOrder } from "@mikro-orm/core";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import {
@@ -109,6 +110,13 @@ function createPaymentGatewayService(deps) {
       payload: payload ?? null
     }, scope);
   }
+  async function stampLastPolledAt(transaction, polledAt) {
+    await em.nativeUpdate(
+      GatewayTransaction,
+      { id: transaction.id, organizationId: transaction.organizationId, tenantId: transaction.tenantId },
+      { lastPolledAt: polledAt }
+    );
+  }
   async function resolveAdapterAndCredentials(providerKey, scope) {
     const integrationId = `gateway_${providerKey}`;
     const selectedVersion = deps.integrationStateService ? await deps.integrationStateService.resolveApiVersion(integrationId, scope) : void 0;
@@ -520,21 +528,37 @@ function createPaymentGatewayService(deps) {
     },
     async getPaymentStatus(transactionId, scope) {
       const transaction = await findTransactionOrThrow(transactionId, scope);
-      const { adapter, credentials } = await resolveAdapterAndCredentials(
-        transaction.providerKey,
-        { organizationId: transaction.organizationId, tenantId: transaction.tenantId }
-      );
-      const status = await adapter.getStatus({
-        sessionId: readProviderSessionId(transaction),
-        credentials
-      });
-      if (status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus, status.status)) {
+      let status;
+      try {
+        const { adapter, credentials } = await resolveAdapterAndCredentials(
+          transaction.providerKey,
+          { organizationId: transaction.organizationId, tenantId: transaction.tenantId }
+        );
+        status = await adapter.getStatus({
+          sessionId: readProviderSessionId(transaction),
+          credentials
+        });
+      } catch (error) {
+        try {
+          await stampLastPolledAt(transaction, /* @__PURE__ */ new Date());
+        } catch (stampError) {
+          logger.warn("Failed to record last poll time after a failed status read", {
+            transactionId: transaction.id,
+            providerKey: transaction.providerKey,
+            err: stampError
+          });
+        }
+        throw error;
+      }
+      const polledAt = /* @__PURE__ */ new Date();
+      const shouldApplyStatus = status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus, status.status);
+      if (shouldApplyStatus) {
         const previousStatus = transaction.unifiedStatus;
         transaction.unifiedStatus = status.status;
         alignCapturedAmountWithStatus(transaction, status.status);
         transaction.gatewayStatus = status.status;
         transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), statusResult: status.providerData ?? null };
-        transaction.lastPolledAt = /* @__PURE__ */ new Date();
+        transaction.lastPolledAt = polledAt;
         await em.flush();
         await emitStatusEvent(status.status, {
           transactionId: transaction.id,
@@ -555,6 +579,8 @@ function createPaymentGatewayService(deps) {
             nextStatus: status.status
           }
         );
+      } else {
+        await stampLastPolledAt(transaction, polledAt);
       }
       return status;
     },
@@ -654,7 +680,7 @@ function createPaymentGatewayService(deps) {
         GatewayTransaction,
         where,
         {
-          orderBy: { updatedAt: "asc" },
+          orderBy: { lastPolledAt: QueryOrder.ASC_NULLS_FIRST, createdAt: QueryOrder.ASC },
           limit: scope?.limit ?? 100
         },
         scope