elpaypg 0.0.0-stage → 2.0.1

package/src/vendor/db/repositories/receiving-account.repository.js

@@ -0,0 +1,244 @@
+import crypto from 'node:crypto';
+
+export class ReceivingAccountRepository {
+  /**
+   * @param {import('../database.js').Database} db
+   */
+  constructor(db) {
+    this.db = db;
+  }
+
+  /**
+   * Creates a new receiving UPI account.
+   * If isActive is true, atomically deactivates any other active accounts for this merchant.
+   * Enforces that maximum ONE VPA may be active per merchant.
+   */
+  create(data) {
+    const id = data.id || crypto.randomUUID();
+    const now = new Date().toISOString();
+    const isActive = data.isActive !== undefined ? Boolean(data.isActive) : true;
+    const isMerchantEnabled = data.isMerchantEnabled !== undefined ? Boolean(data.isMerchantEnabled) : true;
+
+    return this.db.transaction(() => {
+      // If this new account is marked active, atomically deactivate all existing active accounts for this merchant
+      if (isActive) {
+        this.db.execute(`
+          UPDATE payment_receiving_accounts
+          SET is_active = 0, updated_at = ?
+          WHERE merchant_id = ?
+        `, [now, data.merchantId]);
+      }
+
+      const sql = `
+        INSERT INTO payment_receiving_accounts (
+          id, merchant_id, upi_id, payee_name, is_merchant_enabled,
+          is_active, is_slot_busy, current_active_session_id, created_at, updated_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `;
+
+      this.db.execute(sql, [
+        id,
+        data.merchantId,
+        data.upiId.trim(),
+        data.payeeName.trim(),
+        isMerchantEnabled ? 1 : 0,
+        isActive ? 1 : 0,
+        0,
+        null,
+        now,
+        now
+      ]);
+
+      return this.findById(id);
+    });
+  }
+
+  findById(id) {
+    const row = this.db.queryOne('SELECT * FROM payment_receiving_accounts WHERE id = ?', [id]);
+    if (!row) return null;
+    return this.mapRow(row);
+  }
+
+  findByMerchantId(merchantId) {
+    const rows = this.db.query(
+      'SELECT * FROM payment_receiving_accounts WHERE merchant_id = ? ORDER BY is_active DESC, created_at ASC',
+      [merchantId]
+    );
+    return rows.map(r => this.mapRow(r));
+  }
+
+  findActiveForMerchant(merchantId) {
+    const row = this.db.queryOne(
+      'SELECT * FROM payment_receiving_accounts WHERE merchant_id = ? AND is_active = 1 LIMIT 1',
+      [merchantId]
+    );
+    if (!row) return null;
+    return this.mapRow(row);
+  }
+
+  /**
+   * Atomically activates an account and deactivates all other accounts for this merchant.
+   * Backend invariant: At most ONE VPA active per merchant.
+   */
+  activateAccount(merchantId, accountId) {
+    return this.db.transaction(() => {
+      const now = new Date().toISOString();
+
+      // Deactivate all existing accounts for this merchant
+      this.db.execute(`
+        UPDATE payment_receiving_accounts
+        SET is_active = 0, updated_at = ?
+        WHERE merchant_id = ?
+      `, [now, merchantId]);
+
+      // Activate the targeted account
+      this.db.execute(`
+        UPDATE payment_receiving_accounts
+        SET is_active = 1, updated_at = ?
+        WHERE id = ? AND merchant_id = ?
+      `, [now, accountId, merchantId]);
+
+      return this.findById(accountId);
+    });
+  }
+
+  /**
+   * Deactivates a specific account.
+   */
+  deactivateAccount(merchantId, accountId) {
+    const now = new Date().toISOString();
+    this.db.execute(`
+      UPDATE payment_receiving_accounts
+      SET is_active = 0, updated_at = ?
+      WHERE id = ? AND merchant_id = ?
+    `, [now, accountId, merchantId]);
+
+    return this.findById(accountId);
+  }
+
+  /**
+   * Updates an existing account's details.
+   */
+  updateAccount(id, data) {
+    return this.db.transaction(() => {
+      const existing = this.findById(id);
+      if (!existing) return null;
+
+      const now = new Date().toISOString();
+      const upiId = data.upiId !== undefined ? data.upiId.trim() : existing.upiId;
+
+      if (existing.isSlotBusy && data.upiId !== undefined && upiId !== existing.upiId) {
+        throw new Error('Cannot change UPI ID while receiving account slot is currently busy with an active payment session.');
+      }
+
+      const payeeName = data.payeeName !== undefined ? data.payeeName.trim() : existing.payeeName;
+      const isMerchantEnabled = data.isMerchantEnabled !== undefined ? Boolean(data.isMerchantEnabled) : existing.isMerchantEnabled;
+
+      if (data.isActive === true) {
+        this.db.execute(`
+          UPDATE payment_receiving_accounts
+          SET is_active = 0, updated_at = ?
+          WHERE merchant_id = ?
+        `, [now, existing.merchantId]);
+
+        this.db.execute(`
+          UPDATE payment_receiving_accounts
+          SET upi_id = ?, payee_name = ?, is_merchant_enabled = ?, is_active = 1, updated_at = ?
+          WHERE id = ?
+        `, [upiId, payeeName, isMerchantEnabled ? 1 : 0, now, id]);
+      } else if (data.isActive === false) {
+        this.db.execute(`
+          UPDATE payment_receiving_accounts
+          SET upi_id = ?, payee_name = ?, is_merchant_enabled = ?, is_active = 0, updated_at = ?
+          WHERE id = ?
+        `, [upiId, payeeName, isMerchantEnabled ? 1 : 0, now, id]);
+      } else {
+        this.db.execute(`
+          UPDATE payment_receiving_accounts
+          SET upi_id = ?, payee_name = ?, is_merchant_enabled = ?, updated_at = ?
+          WHERE id = ?
+        `, [upiId, payeeName, isMerchantEnabled ? 1 : 0, now, id]);
+      }
+
+      return this.findById(id);
+    });
+  }
+
+  /**
+   * Deletes a receiving account.
+   * Throws if the slot is currently busy.
+   */
+  deleteAccount(merchantId, accountId) {
+    const account = this.findById(accountId);
+    if (!account || account.merchantId !== merchantId) {
+      throw new Error(`Account not found or does not belong to merchant: ${accountId}`);
+    }
+
+    if (account.isSlotBusy || account.currentActiveSessionId) {
+      throw new Error(`Cannot delete account ${account.upiId} because it has an active checkout session.`);
+    }
+
+    this.db.execute('DELETE FROM payment_receiving_accounts WHERE id = ? AND merchant_id = ?', [accountId, merchantId]);
+    return true;
+  }
+
+  /**
+   * Sets slot busy status and currently active session ID.
+   */
+  setSlotStatus(id, isBusy, activeSessionId = null) {
+    const now = new Date().toISOString();
+    this.db.execute(`
+      UPDATE payment_receiving_accounts
+      SET is_slot_busy = ?, current_active_session_id = ?, updated_at = ?
+      WHERE id = ?
+    `, [isBusy ? 1 : 0, activeSessionId, now, id]);
+
+    return this.findById(id);
+  }
+
+  /**
+   * Updates or creates the active receiving UPI account for a merchant.
+   * @param {string} merchantId
+   * @param {string} upiId
+   * @param {string} [payeeName]
+   * @param {boolean} [isMerchantEnabled=true]
+   */
+  upsertActiveForMerchant(merchantId, upiId, payeeName = null, isMerchantEnabled = true) {
+    const cleanUpi = upiId.trim();
+    const existing = this.findActiveForMerchant(merchantId);
+    const now = new Date().toISOString();
+
+    if (existing) {
+      this.db.execute(`
+        UPDATE payment_receiving_accounts
+        SET upi_id = ?, payee_name = COALESCE(?, payee_name), is_merchant_enabled = ?, updated_at = ?
+        WHERE id = ?
+      `, [cleanUpi, payeeName?.trim() || null, isMerchantEnabled ? 1 : 0, now, existing.id]);
+      return this.findById(existing.id);
+    } else {
+      return this.create({
+        merchantId,
+        upiId: cleanUpi,
+        payeeName: payeeName?.trim() || 'Merchant Store',
+        isMerchantEnabled,
+        isActive: true
+      });
+    }
+  }
+
+  mapRow(row) {
+    return {
+      id: row.id,
+      merchantId: row.merchant_id,
+      upiId: row.upi_id,
+      payeeName: row.payee_name,
+      isMerchantEnabled: Boolean(row.is_merchant_enabled !== undefined ? row.is_merchant_enabled : 1),
+      isActive: Boolean(row.is_active),
+      isSlotBusy: Boolean(row.is_slot_busy),
+      currentActiveSessionId: row.current_active_session_id,
+      createdAt: new Date(row.created_at),
+      updatedAt: new Date(row.updated_at)
+    };
+  }
+}

package/src/vendor/db/repositories/support-ticket.repository.js

@@ -0,0 +1,140 @@
+import crypto from 'node:crypto';
+import { TicketStatus, SenderType } from '../../common/index.js';
+
+export class SupportTicketRepository {
+  /**
+   * @param {import('../database.js').Database} db
+   */
+  constructor(db) {
+    this.db = db;
+  }
+
+  createTicket(data) {
+    const id = data.id || crypto.randomUUID();
+    const now = new Date().toISOString();
+
+    const sql = `
+      INSERT INTO support_tickets (id, merchant_id, customer_id, payment_id, subject, status, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `;
+
+    this.db.execute(sql, [
+      id,
+      data.merchantId,
+      data.customerId,
+      data.paymentId || null,
+      data.subject.trim(),
+      data.status || TicketStatus.OPEN,
+      now,
+      now
+    ]);
+
+    if (data.initialMessage) {
+      this.addMessage({
+        ticketId: id,
+        senderType: data.initialMessage.senderType || SenderType.CUSTOMER,
+        senderId: data.initialMessage.senderId || data.customerId,
+        message: data.initialMessage.message
+      });
+    }
+
+    return this.findTicketById(id);
+  }
+
+  findTicketById(id) {
+    const row = this.db.queryOne('SELECT * FROM support_tickets WHERE id = ?', [id]);
+    if (!row) return null;
+    return this.mapTicketRow(row);
+  }
+
+  findTicketsByCustomer(customerId) {
+    const rows = this.db.query(
+      'SELECT * FROM support_tickets WHERE customer_id = ? ORDER BY updated_at DESC',
+      [customerId]
+    );
+    return rows.map(r => this.mapTicketRow(r));
+  }
+
+  findTicketsByMerchant(merchantId) {
+    const rows = this.db.query(
+      'SELECT * FROM support_tickets WHERE merchant_id = ? ORDER BY updated_at DESC',
+      [merchantId]
+    );
+    return rows.map(r => this.mapTicketRow(r));
+  }
+
+  updateTicketStatus(ticketId, status) {
+    const now = new Date().toISOString();
+    this.db.execute(
+      'UPDATE support_tickets SET status = ?, updated_at = ? WHERE id = ?',
+      [status, now, ticketId]
+    );
+    return this.findTicketById(ticketId);
+  }
+
+  addMessage(data) {
+    const id = data.id || crypto.randomUUID();
+    const now = new Date().toISOString();
+    const attachments = typeof data.attachments === 'object' ? JSON.stringify(data.attachments) : (data.attachments || '[]');
+
+    this.db.execute(`
+      INSERT INTO ticket_messages (id, ticket_id, sender_type, sender_id, message, attachments, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `, [
+      id,
+      data.ticketId,
+      data.senderType,
+      data.senderId,
+      data.message.trim(),
+      attachments,
+      now
+    ]);
+
+    // Update ticket updated_at
+    this.db.execute(
+      'UPDATE support_tickets SET updated_at = ? WHERE id = ?',
+      [now, data.ticketId]
+    );
+
+    return this.findMessageById(id);
+  }
+
+  findMessageById(id) {
+    const row = this.db.queryOne('SELECT * FROM ticket_messages WHERE id = ?', [id]);
+    if (!row) return null;
+    return this.mapMessageRow(row);
+  }
+
+  findMessagesByTicket(ticketId) {
+    const rows = this.db.query(
+      'SELECT * FROM ticket_messages WHERE ticket_id = ? ORDER BY created_at ASC',
+      [ticketId]
+    );
+    return rows.map(r => this.mapMessageRow(r));
+  }
+
+  mapTicketRow(row) {
+    return {
+      id: row.id,
+      merchantId: row.merchant_id,
+      customerId: row.customer_id,
+      paymentId: row.payment_id,
+      subject: row.subject,
+      status: row.status,
+      createdAt: new Date(row.created_at),
+      updatedAt: new Date(row.updated_at)
+    };
+  }
+
+  mapMessageRow(row) {
+    return {
+      id: row.id,
+      ticketId: row.ticket_id,
+      senderType: row.sender_type,
+      senderId: row.sender_id,
+      message: row.message,
+      attachments: JSON.parse(row.attachments || '[]'),
+      createdAt: new Date(row.created_at)
+    };
+  }
+}

package/src/vendor/db/schema.sql

@@ -0,0 +1,266 @@
+-- PostgreSQL Schema for ELPAY PG
+-- Canonical Production Schema
+
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+-- 1. Merchants Table
+CREATE TABLE IF NOT EXISTS merchants (
+    id TEXT PRIMARY KEY,
+    business_name VARCHAR(255) NOT NULL,
+    slug VARCHAR(100) UNIQUE NOT NULL,
+    contact_email VARCHAR(255) NOT NULL,
+    contact_phone VARCHAR(20) NOT NULL,
+    webhook_url VARCHAR(1024),
+    webhook_secret VARCHAR(255) NOT NULL,
+    branding TEXT NOT NULL DEFAULT '{"primaryColor":"#2563eb","appName":"ELPAY PG","logoUrl":null}',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- 2. Payment Receiving Accounts
+CREATE TABLE IF NOT EXISTS payment_receiving_accounts (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT NOT NULL REFERENCES merchants(id) ON DELETE CASCADE,
+    upi_id VARCHAR(255) NOT NULL,
+    payee_name VARCHAR(255) NOT NULL,
+    is_merchant_enabled BOOLEAN NOT NULL DEFAULT true,
+    is_active BOOLEAN NOT NULL DEFAULT true,
+    is_slot_busy BOOLEAN NOT NULL DEFAULT false,
+    current_active_session_id TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_single_active_vpa_per_merchant ON payment_receiving_accounts (merchant_id) WHERE is_active = true;
+
+-- 3. Customers Table (Gateway-owned Customer Identity with WhatsApp Berry OTP)
+CREATE TABLE IF NOT EXISTS customers (
+    id TEXT PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    email VARCHAR(255) UNIQUE NOT NULL,
+    mobile_number VARCHAR(20) UNIQUE NOT NULL,
+    password_hash VARCHAR(255),
+    otp_code VARCHAR(10),
+    otp_expires_at TIMESTAMPTZ,
+    otp_attempts INT NOT NULL DEFAULT 0,
+    is_phone_verified BOOLEAN DEFAULT false,
+    status VARCHAR(50) NOT NULL DEFAULT 'ACTIVE',
+    ban_reason TEXT,
+    banned_at TIMESTAMPTZ,
+    unbanned_at TIMESTAMPTZ,
+    last_device TEXT,
+    last_login_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_email ON customers (email);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_mobile ON customers (mobile_number);
+
+-- 3b. Customer Sessions Table (Server-authoritative session engine)
+CREATE TABLE IF NOT EXISTS customer_sessions (
+    id TEXT PRIMARY KEY,
+    customer_id TEXT NOT NULL REFERENCES customers(id) ON DELETE CASCADE,
+    token VARCHAR(255) UNIQUE NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    is_active BOOLEAN NOT NULL DEFAULT true,
+    ip_address VARCHAR(45),
+    user_agent TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_customer_sessions_token ON customer_sessions (token, is_active);
+CREATE INDEX IF NOT EXISTS idx_customer_sessions_customer ON customer_sessions (customer_id);
+
+-- 3c. Devices Table (Cryptographic Device Binding & Hardware Context Fingerprinting)
+CREATE TABLE IF NOT EXISTS devices (
+    id TEXT PRIMARY KEY,
+    customer_id TEXT REFERENCES customers(id) ON DELETE SET NULL,
+    public_key TEXT NOT NULL,
+    fingerprint_hash VARCHAR(64) NOT NULL,
+    user_agent TEXT,
+    platform VARCHAR(100),
+    browser VARCHAR(100),
+    timezone VARCHAR(100),
+    language VARCHAR(50),
+    screen_signature VARCHAR(100),
+    device_token VARCHAR(255) UNIQUE,
+    status VARCHAR(50) NOT NULL DEFAULT 'ACTIVE',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_devices_customer ON devices (customer_id);
+CREATE INDEX IF NOT EXISTS idx_devices_fingerprint ON devices (fingerprint_hash);
+CREATE INDEX IF NOT EXISTS idx_devices_token ON devices (device_token);
+
+-- 4. Payment Sessions Table
+CREATE TABLE IF NOT EXISTS payment_sessions (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT NOT NULL REFERENCES merchants(id) ON DELETE CASCADE,
+    customer_id TEXT REFERENCES customers(id) ON DELETE SET NULL,
+    receiving_account_id TEXT REFERENCES payment_receiving_accounts(id),
+    order_id VARCHAR(255) NOT NULL,
+    attempt_id TEXT,
+    amount_paise BIGINT NOT NULL CHECK (amount_paise > 0),
+    currency VARCHAR(3) NOT NULL DEFAULT 'INR',
+    method VARCHAR(50) NOT NULL DEFAULT 'UPI',
+    status VARCHAR(50) NOT NULL DEFAULT 'INITIATED',
+    queue_position INT DEFAULT 0,
+    slot_acquired_at TIMESTAMPTZ,
+    expires_at TIMESTAMPTZ,
+    processing_started_at TIMESTAMPTZ,
+    processing_expires_at TIMESTAMPTZ,
+    completed_at TIMESTAMPTZ,
+    return_url VARCHAR(1024),
+    attributed_observation_id TEXT,
+    idempotency_key VARCHAR(255),
+    device_id TEXT REFERENCES devices(id),
+    verification_level INT DEFAULT 0,
+    verification_sources TEXT DEFAULT '[]',
+    verification_tag VARCHAR(100) DEFAULT 'UNVERIFIED',
+    metadata TEXT NOT NULL DEFAULT '{}',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_payment_sessions_active ON payment_sessions (receiving_account_id, status);
+CREATE INDEX IF NOT EXISTS idx_payment_sessions_order ON payment_sessions (merchant_id, order_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_payment_sessions_device ON payment_sessions (device_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_single_active_session_per_order
+  ON payment_sessions (merchant_id, order_id)
+  WHERE status NOT IN ('FAILED', 'EXPIRED', 'CANCELLED');
+CREATE UNIQUE INDEX IF NOT EXISTS idx_one_slot_per_receiving_account
+  ON payment_sessions (receiving_account_id)
+  WHERE status IN ('ACTIVE', 'PROCESSING') AND receiving_account_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_payment_sessions_attributed_obs
+  ON payment_sessions (attributed_observation_id)
+  WHERE attributed_observation_id IS NOT NULL;
+
+-- 5. Payment Observations Table
+CREATE TABLE IF NOT EXISTS payment_observations (
+    id TEXT PRIMARY KEY,
+    receiving_account_id TEXT NOT NULL REFERENCES payment_receiving_accounts(id) ON DELETE CASCADE,
+    source VARCHAR(50) NOT NULL,
+    amount_paise BIGINT NOT NULL,
+    observed_at TIMESTAMPTZ NOT NULL,
+    ingested_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    sender_vpa VARCHAR(255),
+    bank_reference_number VARCHAR(255),
+    fingerprint_hash VARCHAR(64) NOT NULL,
+    raw_payload TEXT NOT NULL DEFAULT '{}',
+    attribution_status VARCHAR(50) NOT NULL DEFAULT 'UNATTRIBUTED',
+    attributed_payment_id TEXT REFERENCES payment_sessions(id),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_observations_match ON payment_observations (receiving_account_id, amount_paise, attribution_status);
+CREATE INDEX IF NOT EXISTS idx_observations_bank_ref ON payment_observations (bank_reference_number);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_observations_unique_attributed_bank_ref
+  ON payment_observations (bank_reference_number)
+  WHERE bank_reference_number IS NOT NULL AND attributed_payment_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_observations_fingerprint ON payment_observations (fingerprint_hash);
+CREATE INDEX IF NOT EXISTS idx_observations_attributed_payment ON payment_observations (attributed_payment_id);
+
+-- 6. Android Devices Table
+CREATE TABLE IF NOT EXISTS android_devices (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT NOT NULL REFERENCES merchants(id) ON DELETE CASCADE,
+    device_name VARCHAR(255) NOT NULL,
+    device_model VARCHAR(255),
+    signing_key_hash VARCHAR(255) NOT NULL,
+    is_active BOOLEAN NOT NULL DEFAULT true,
+    last_heartbeat_at TIMESTAMPTZ,
+    last_observation_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- 7. Webhook Deliveries Table
+CREATE TABLE IF NOT EXISTS webhook_deliveries (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT NOT NULL REFERENCES merchants(id) ON DELETE CASCADE,
+    payment_id TEXT NOT NULL REFERENCES payment_sessions(id) ON DELETE CASCADE,
+    event_type VARCHAR(50) NOT NULL,
+    payload TEXT NOT NULL,
+    endpoint_url VARCHAR(1024) NOT NULL,
+    response_status INT,
+    response_body TEXT,
+    attempt_count INT NOT NULL DEFAULT 1,
+    is_successful BOOLEAN NOT NULL DEFAULT false,
+    next_retry_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_retry ON webhook_deliveries (is_successful, next_retry_at);
+
+-- 8. Support Tickets & Ticket Messages
+CREATE TABLE IF NOT EXISTS support_tickets (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT NOT NULL REFERENCES merchants(id) ON DELETE CASCADE,
+    customer_id TEXT NOT NULL REFERENCES customers(id) ON DELETE CASCADE,
+    payment_id TEXT REFERENCES payment_sessions(id) ON DELETE SET NULL,
+    subject VARCHAR(255) NOT NULL,
+    status VARCHAR(50) NOT NULL DEFAULT 'OPEN',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_support_tickets_merchant ON support_tickets (merchant_id);
+CREATE INDEX IF NOT EXISTS idx_support_tickets_customer ON support_tickets (customer_id);
+
+CREATE TABLE IF NOT EXISTS ticket_messages (
+    id TEXT PRIMARY KEY,
+    ticket_id TEXT NOT NULL REFERENCES support_tickets(id) ON DELETE CASCADE,
+    sender_type VARCHAR(20) NOT NULL,
+    sender_id TEXT NOT NULL,
+    message TEXT NOT NULL,
+    attachments TEXT DEFAULT '[]',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_ticket_messages_ticket ON ticket_messages (ticket_id);
+
+-- 9. Audit Logs Table
+CREATE TABLE IF NOT EXISTS audit_logs (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT REFERENCES merchants(id) ON DELETE CASCADE,
+    entity_type VARCHAR(50) NOT NULL,
+    entity_id TEXT NOT NULL,
+    action VARCHAR(100) NOT NULL,
+    actor_type VARCHAR(50) NOT NULL,
+    actor_id VARCHAR(255),
+    details TEXT NOT NULL DEFAULT '{}',
+    ip_address VARCHAR(45),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_logs_merchant ON audit_logs (merchant_id);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_entity ON audit_logs (entity_type, entity_id);
+
+-- 10. Security Events Table
+CREATE TABLE IF NOT EXISTS security_events (
+    id TEXT PRIMARY KEY,
+    merchant_id TEXT,
+    customer_id TEXT,
+    payment_session_id TEXT,
+    event_type VARCHAR(100) NOT NULL,
+    source VARCHAR(50),
+    sender VARCHAR(255),
+    device_info TEXT,
+    raw_message TEXT NOT NULL,
+    normalized_message TEXT,
+    extracted_amount VARCHAR(50),
+    extracted_reference VARCHAR(100),
+    parser_results TEXT DEFAULT '{}',
+    verification_results TEXT DEFAULT '{}',
+    fraud_reason VARCHAR(255) NOT NULL,
+    metadata TEXT DEFAULT '{}',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_security_events_customer ON security_events (customer_id);
+CREATE INDEX IF NOT EXISTS idx_security_events_session ON security_events (payment_session_id);
+CREATE INDEX IF NOT EXISTS idx_security_events_type ON security_events (event_type);
+
+