elpaypg 0.0.0-stage → 2.0.0

package/src/vendor/db/migrate.js

@@ -0,0 +1,210 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import crypto from 'node:crypto';
+import { getCoinStoreWebhookSecret, LEGACY_DEFAULT_WEBHOOK_SECRET } from '../common/index.js';
+import { getDatabase } from './database.js';
+import { MerchantRepository } from './repositories/merchant.repository.js';
+import { ReceivingAccountRepository } from './repositories/receiving-account.repository.js';
+import { CustomerRepository } from './repositories/customer.repository.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+/**
+ * Runs database migrations and applies base seeds.
+ * @param {import('./database.js').Database} [targetDb]
+ */
+export function runMigrations(targetDb) {
+  const db = targetDb || getDatabase();
+  const schemaPath = path.join(__dirname, 'sqlite-schema.sql');
+  const schemaSql = fs.readFileSync(schemaPath, 'utf8');
+
+  // Detect if customers table has an obsolete schema (phone_number/merchant_id instead of email/mobile_number, or password_hash NOT NULL).
+  // The old table is only rebuilt when it holds no customers: a schema mismatch must never destroy customer data.
+  try {
+    const tableInfo = db.query ? db.query("PRAGMA table_info(customers)") : [];
+    const colNames = (tableInfo || []).map(c => c.name);
+    const hasOldColumns = colNames.length > 0 && (
+      !colNames.includes('email') ||
+      colNames.includes('phone_number') ||
+      colNames.includes('merchant_id') ||
+      !colNames.includes('otp_code') ||
+      tableInfo.some(c => c.name === 'password_hash' && c.notnull === 1)
+    );
+    if (hasOldColumns) {
+      const customerCount = Number(db.queryOne('SELECT COUNT(*) AS n FROM customers')?.n || 0);
+      if (customerCount === 0) {
+        try { db.exec("PRAGMA foreign_keys = OFF;"); } catch {}
+        try { db.exec("DROP TABLE IF EXISTS customer_sessions;"); } catch {}
+        try { db.exec("DROP TABLE IF EXISTS customers;"); } catch {}
+        try { db.exec("PRAGMA foreign_keys = ON;"); } catch {}
+      } else {
+        console.error(`[migrate] customers table has an obsolete schema but holds ${customerCount} row(s); leaving it untouched. Back up and migrate it manually.`);
+      }
+    }
+  } catch (err) {
+    console.error('[migrate] Could not inspect customers table schema; skipping rebuild:', err.message);
+  }
+
+  // Fallback alter columns if customers/sessions table exists without new columns
+  try { db.exec("ALTER TABLE customers ADD COLUMN email TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN mobile_number TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN otp_code TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN otp_expires_at TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN otp_attempts INTEGER NOT NULL DEFAULT 0;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN is_phone_verified INTEGER DEFAULT 0;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN ban_reason TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN banned_at TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN unbanned_at TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN last_device TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN device_id TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN verification_level INTEGER DEFAULT 0;"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN verification_sources TEXT DEFAULT '[]';"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN verification_tag TEXT DEFAULT 'UNVERIFIED';"); } catch {}
+
+  // Execute schema DDL
+  db.exec(schemaSql);
+
+  // Alter table columns if migrating existing databases
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN verification_level INTEGER DEFAULT 0;"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN verification_sources TEXT DEFAULT '[]';"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN verification_tag TEXT DEFAULT 'UNVERIFIED';"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN attempt_id TEXT;"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_single_active_session_per_order ON payment_sessions (merchant_id, order_id) WHERE status NOT IN ('FAILED', 'EXPIRED', 'CANCELLED');"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_one_slot_per_receiving_account ON payment_sessions (receiving_account_id) WHERE status IN ('ACTIVE', 'PROCESSING') AND receiving_account_id IS NOT NULL;"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_payment_sessions_order ON payment_sessions (merchant_id, order_id, created_at);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_retry ON webhook_deliveries (is_successful, next_retry_at);"); } catch {}
+  try { db.exec("ALTER TABLE payment_receiving_accounts ADD COLUMN is_merchant_enabled INTEGER NOT NULL DEFAULT 1;"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_single_active_vpa_per_merchant ON payment_receiving_accounts (merchant_id) WHERE is_active = 1;"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_email ON customers (email);"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_mobile ON customers (mobile_number);"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN ban_reason TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN banned_at TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN unbanned_at TEXT;"); } catch {}
+  try { db.exec("ALTER TABLE customers ADD COLUMN last_device TEXT;"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_customer_sessions_token ON customer_sessions (token, is_active);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_customer_sessions_customer ON customer_sessions (customer_id);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_security_events_customer ON security_events (customer_id);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_security_events_session ON security_events (payment_session_id);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_security_events_type ON security_events (event_type);"); } catch {}
+  try { db.exec("ALTER TABLE payment_sessions ADD COLUMN device_id TEXT REFERENCES devices(id);"); } catch {}
+  try { db.exec(`
+    CREATE TABLE IF NOT EXISTS devices (
+      id TEXT PRIMARY KEY,
+      customer_id TEXT REFERENCES customers(id) ON DELETE SET NULL,
+      public_key TEXT NOT NULL,
+      fingerprint_hash TEXT NOT NULL,
+      user_agent TEXT,
+      platform TEXT,
+      browser TEXT,
+      timezone TEXT,
+      language TEXT,
+      screen_signature TEXT,
+      device_token TEXT UNIQUE,
+      status TEXT NOT NULL DEFAULT 'ACTIVE',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      last_seen_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_devices_customer ON devices (customer_id);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_devices_fingerprint ON devices (fingerprint_hash);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_payment_sessions_device ON payment_sessions (device_id);"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_payment_sessions_attributed_obs ON payment_sessions (attributed_observation_id) WHERE attributed_observation_id IS NOT NULL;"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_observations_bank_ref ON payment_observations (bank_reference_number);"); } catch {}
+  try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_observations_unique_attributed_bank_ref ON payment_observations (bank_reference_number) WHERE bank_reference_number IS NOT NULL AND attributed_payment_id IS NOT NULL;"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_observations_fingerprint ON payment_observations (fingerprint_hash);"); } catch {}
+  try { db.exec("CREATE INDEX IF NOT EXISTS idx_observations_attributed_payment ON payment_observations (attributed_payment_id);"); } catch {}
+
+  // Seed default merchant if empty
+  const merchantRepo = new MerchantRepository(db);
+  const existing = merchantRepo.findAll();
+
+  let defaultMerchant;
+  if (existing.length === 0) {
+    defaultMerchant = merchantRepo.create({
+      id: '00000000-0000-0000-0000-000000000001',
+      businessName: 'ELPAY Demo Store',
+      slug: 'demo-store',
+      contactEmail: 'merchant@elpay.local',
+      contactPhone: '9876543210',
+      webhookUrl: process.env.COIN_STORE_WEBHOOK_URL || 'http://localhost:5000/api/webhook',
+      webhookSecret: getCoinStoreWebhookSecret(),
+      branding: {
+        appName: 'ELPAY PG',
+        primaryColor: '#2563eb',
+        logoUrl: null
+      }
+    });
+  } else {
+    defaultMerchant = existing[0];
+    if (!defaultMerchant.webhookSecret) {
+      merchantRepo.update(defaultMerchant.id, {
+        webhookUrl: 'http://localhost:5000/api/webhook',
+        webhookSecret: getCoinStoreWebhookSecret()
+      });
+    } else if (defaultMerchant.webhookSecret === LEGACY_DEFAULT_WEBHOOK_SECRET) {
+      // Older installs were seeded with a publicly known secret: rotate it.
+      merchantRepo.update(defaultMerchant.id, { webhookSecret: getCoinStoreWebhookSecret() });
+      console.warn('[migrate] Rotated the default merchant webhook secret away from the legacy public value. Update your merchant webhook verifier.');
+    }
+  }
+
+  // Seed default UPI receiving account if none
+  const accountRepo = new ReceivingAccountRepository(db);
+  const accounts = accountRepo.findByMerchantId(defaultMerchant.id);
+  if (accounts.length === 0) {
+    accountRepo.create({
+      id: '00000000-0000-0000-0000-000000000002',
+      merchantId: defaultMerchant.id,
+      upiId: 'merchant@upi',
+      payeeName: defaultMerchant.businessName,
+      isActive: true
+    });
+  }
+
+  // Demo customer seeding is opt-in and never carries real personal data.
+  // Previously this unconditionally created a customer with a real name, phone number and
+  // email, and flagged the phone as verified — shipping someone's PII (and a pre-authorised
+  // OTP login identity) into every merchant deployment.
+  if (process.env.ELPAY_SEED_DEMO_CUSTOMER === 'true') {
+    const customerRepo = new CustomerRepository(db);
+    const demoMobile = '9000000000';
+    if (!customerRepo.findByMobile(demoMobile)) {
+      customerRepo.create({
+        id: '00000000-0000-0000-0000-000000000002',
+        name: 'Demo Customer',
+        email: 'demo-customer@elpay.local',
+        mobileNumber: demoMobile,
+        isPhoneVerified: false
+      });
+    }
+  }
+
+  return {
+    db,
+    defaultMerchant
+  };
+}
+
+/**
+ * Completely wipes all customer identity records and active sessions,
+ * reinitializing the customer identity store to a pristine state.
+ * @param {import('./database.js').Database} [targetDb]
+ */
+export function reinitializeCustomerIdentity(targetDb) {
+  const db = targetDb || getDatabase();
+  try { db.exec("PRAGMA foreign_keys = OFF;"); } catch {}
+  try { db.exec("UPDATE payment_sessions SET customer_id = NULL WHERE customer_id IS NOT NULL;"); } catch {}
+  try { db.exec("DELETE FROM customer_sessions;"); } catch {}
+  try { db.exec("DELETE FROM customers;"); } catch {}
+  try { db.exec("PRAGMA foreign_keys = ON;"); } catch {}
+  return { success: true, message: 'All old customer identity records wiped and reinitialized.' };
+}
+
+// Auto-run if executed directly as script
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  console.log('Running ELPAY PG database migrations...');
+  const result = runMigrations();
+  console.log(`Migration completed successfully. Default merchant: ${result.defaultMerchant.businessName} (${result.defaultMerchant.id})`);
+}

package/src/vendor/db/repositories/audit-log.repository.js

@@ -0,0 +1,68 @@
+import crypto from 'node:crypto';
+import { AuditActorType } from '../../common/index.js';
+
+export class AuditLogRepository {
+  /**
+   * @param {import('../database.js').Database} db
+   */
+  constructor(db) {
+    this.db = db;
+  }
+
+  log(data) {
+    const id = data.id || crypto.randomUUID();
+    const now = new Date().toISOString();
+    const details = typeof data.details === 'object' ? JSON.stringify(data.details) : (data.details || '{}');
+
+    const sql = `
+      INSERT INTO audit_logs (id, merchant_id, entity_type, entity_id, action, actor_type, actor_id, details, ip_address, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `;
+
+    this.db.execute(sql, [
+      id,
+      data.merchantId || null,
+      data.entityType,
+      data.entityId,
+      data.action,
+      data.actorType || AuditActorType.SYSTEM,
+      data.actorId || null,
+      details,
+      data.ipAddress || null,
+      now
+    ]);
+
+    return id;
+  }
+
+  findByEntity(entityType, entityId) {
+    const rows = this.db.query(
+      'SELECT * FROM audit_logs WHERE entity_type = ? AND entity_id = ? ORDER BY created_at ASC',
+      [entityType, entityId]
+    );
+    return rows.map(r => this.mapRow(r));
+  }
+
+  findByMerchant(merchantId, limit = 100) {
+    const rows = this.db.query(
+      'SELECT * FROM audit_logs WHERE merchant_id = ? ORDER BY created_at DESC LIMIT ?',
+      [merchantId, limit]
+    );
+    return rows.map(r => this.mapRow(r));
+  }
+
+  mapRow(row) {
+    return {
+      id: row.id,
+      merchantId: row.merchant_id,
+      entityType: row.entity_type,
+      entityId: row.entity_id,
+      action: row.action,
+      actorType: row.actor_type,
+      actorId: row.actor_id,
+      details: JSON.parse(row.details || '{}'),
+      ipAddress: row.ip_address,
+      createdAt: new Date(row.created_at)
+    };
+  }
+}

package/src/vendor/db/repositories/customer-session.repository.js

@@ -0,0 +1,181 @@
+import crypto from 'node:crypto';
+import { blindIndex } from '../../common/index.js';
+
+/** Namespace so session-token and device-token digests can never collide. */
+const INDEX_NS = 'csess';
+
+export class CustomerSessionRepository {
+  /**
+   * @param {import('../database.js').Database} db
+   * @param {import('./customer.repository.js').CustomerRepository} [customerRepo]
+   */
+  constructor(db, customerRepo = null) {
+    this.db = db;
+    this.customerRepo = customerRepo;
+  }
+
+  /**
+   * Creates an active server-authoritative session for an authenticated customer.
+   * @param {{
+   *   customerId: string,
+   *   ipAddress?: string,
+   *   userAgent?: string,
+   *   ttlHours?: number
+   * }} data
+   */
+  create(data) {
+    const id = crypto.randomUUID();
+    const token = `csess_${crypto.randomBytes(32).toString('hex')}`;
+    const ttlHours = data.ttlHours || 720; // 30 days default
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + ttlHours * 3600 * 1000);
+
+    const sql = `
+      INSERT INTO customer_sessions (id, customer_id, token, expires_at, is_active, ip_address, user_agent, created_at, updated_at)
+      VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?)
+    `;
+
+    // The bearer token is returned to the client once and never read back from the database,
+    // so only a keyed blind index is stored. A database dump therefore cannot be replayed
+    // as valid sessions, which a plaintext (or plain-hashed) column would allow.
+    this.db.execute(sql, [
+      id,
+      data.customerId,
+      blindIndex(token, INDEX_NS),
+      expiresAt.toISOString(),
+      data.ipAddress || null,
+      data.userAgent || null,
+      now.toISOString(),
+      now.toISOString()
+    ]);
+
+    return {
+      id,
+      customerId: data.customerId,
+      token,
+      expiresAt,
+      isActive: true,
+      createdAt: now
+    };
+  }
+
+  /**
+   * Validates a session token and retrieves associated customer profile.
+   * @param {string} token
+   * @returns {{ session: any, customer: any } | null}
+   */
+  findByToken(token) {
+    if (!token || typeof token !== 'string') return null;
+
+    const row = this.db.queryOne(
+      'SELECT * FROM customer_sessions WHERE token = ? AND is_active = 1',
+      [blindIndex(token, INDEX_NS)]
+    );
+
+    // Rows written before index-only storage held the raw token.
+    if (!row && typeof token === 'string' && token.startsWith('csess_') && token.length < 100) {
+      const legacy = this.db.queryOne(
+        'SELECT * FROM customer_sessions WHERE token = ? AND is_active = 1',
+        [token]
+      );
+      if (legacy) {
+        // Re-index on first successful use so the plaintext row does not linger.
+        try {
+          this.db.execute('UPDATE customer_sessions SET token = ? WHERE id = ?', [blindIndex(token, INDEX_NS), legacy.id]);
+        } catch {}
+        return this.findByToken(token);
+      }
+    }
+
+    if (!row) return null;
+
+    const expiresAt = new Date(row.expires_at);
+    if (expiresAt.getTime() <= Date.now()) {
+      // Mark expired
+      try {
+        this.db.execute('UPDATE customer_sessions SET is_active = 0, updated_at = ? WHERE id = ?', [
+          new Date().toISOString(),
+          row.id
+        ]);
+      } catch {}
+      return null;
+    }
+
+    const session = {
+      id: row.id,
+      customerId: row.customer_id,
+      expiresAt,
+      isActive: Boolean(row.is_active),
+      createdAt: new Date(row.created_at)
+    };
+
+    let customer = null;
+    if (this.customerRepo) {
+      customer = this.customerRepo.findById(row.customer_id);
+    } else {
+      const custRow = this.db.queryOne('SELECT * FROM customers WHERE id = ?', [row.customer_id]);
+      if (custRow) {
+        customer = {
+          id: custRow.id,
+          name: custRow.name,
+          email: custRow.email,
+          mobileNumber: custRow.mobile_number,
+          status: custRow.status,
+          createdAt: new Date(custRow.created_at),
+          updatedAt: new Date(custRow.updated_at)
+        };
+      }
+    }
+
+    if (!customer || customer.status !== 'ACTIVE') {
+      return null;
+    }
+
+    return { session, customer };
+  }
+
+  /**
+   * Revokes a session token (logout).
+   * @param {string} token
+   * @returns {boolean}
+   */
+  revokeToken(token) {
+    if (!token) return false;
+    const now = new Date().toISOString();
+    this.db.execute(
+      'UPDATE customer_sessions SET is_active = 0, updated_at = ? WHERE token = ?',
+      [now, blindIndex(token, INDEX_NS)]
+    );
+    // Also clear any legacy plaintext row so logout always revokes.
+    this.db.execute(
+      'UPDATE customer_sessions SET is_active = 0, updated_at = ? WHERE token = ?',
+      [now, token]
+    );
+    return true;
+  }
+
+  /**
+   * Revokes all active sessions for a customer.
+   * @param {string} customerId
+   */
+  revokeAllForCustomer(customerId) {
+    if (!customerId) return;
+    const now = new Date().toISOString();
+    this.db.execute(
+      'UPDATE customer_sessions SET is_active = 0, updated_at = ? WHERE customer_id = ?',
+      [now, customerId]
+    );
+  }
+
+  /**
+   * Returns count of currently active sessions.
+   * @returns {number}
+   */
+  countActive() {
+    const row = this.db.queryOne(
+      'SELECT COUNT(*) as c FROM customer_sessions WHERE is_active = 1 AND expires_at > ?',
+      [new Date().toISOString()]
+    );
+    return row?.c || 0;
+  }
+}