elpaypg 0.0.0-stage → 2.0.1

package/public/views/partials/splash.html

@@ -0,0 +1,35 @@
+  <!-- TOAST NOTIFICATION -->
+  <div id="ypgToast" class="ypg-toast"><img src="/icons/upi.svg" alt="UPI" style="height:12px; vertical-align:middle; filter:brightness(0) invert(1); margin-right:4px;" /> Direct UPI QR is active for instant banking verification</div>
+
+  <!-- ELPAY PG CHECKOUT CARD / DRAWER WRAPPER -->
+  <div class="ypg-wrapper">
+
+    <!-- 1. INITIAL ELPAY PG LOADING SPLASH -->
+    <div id="ypgSplashScreen" class="ypg-splash-screen">
+      <div class="ypg-splash-center">
+        <div class="ypg-shield-orbit-box">
+          <img id="splashBrandLogo" alt="Logo"
+            style="display:none; max-width:82px; max-height:82px; border-radius:16px; object-fit:contain; box-shadow:0 8px 24px rgba(0,0,0,0.12);" />
+          <!-- Authentic ELPAY PG Shield with 'Y' Monogram -->
+          <svg class="ypg-shield-icon-svg" id="splashDefaultShield" viewBox="0 0 100 120" fill="none">
+            <defs>
+              <linearGradient id="ypgShieldGrad" x1="0" y1="0" x2="1" y2="1">
+                <stop offset="0%" stop-color="#0b63e5" />
+                <stop offset="100%" stop-color="#0747a6" />
+              </linearGradient>
+            </defs>
+            <path d="M50 4 L92 22 C92 72, 50 116, 50 116 C50 116, 8 72, 8 22 Z" fill="url(#ypgShieldGrad)" />
+            <!-- Sharp white & cyan 'Y' monogram -->
+            <path d="M33 32 L46 54 L46 84 L54 84 L54 54 L67 32 L56 32 L50 44 L44 32 Z" fill="#ffffff" />
+            <polygon points="50,44 56,32 61,32 54,49" fill="#38bdf8" />
+          </svg>
+          <div class="ypg-orbit-dot"></div>
+        </div>
+      </div>
+      <div class="ypg-splash-footer" id="splashFooterWrap">
+        <span>Secured By</span>
+        <strong id="splashSecuredByText" style="color:var(--ypg-blue); font-size:15px; letter-spacing:-0.2px;">ELPAY
+          PG</strong>
+      </div>
+    </div>
+

package/src/__tests__/smoke.test.js

@@ -0,0 +1,8 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createRouter } from '../router.js';
+
+test('createRouter returns an object', () => {
+  const r = createRouter({});
+  assert.ok(r);
+});

package/src/auth-guard.js

@@ -0,0 +1,95 @@
+import { getAdminToken, getObserverToken, safeEqual, hasBearer } from './vendor/common/index.js';
+function json(res, code, body) { res.status(code).json(body); }
+
+/** Admin-prefixed routes that are intentionally public (static APK download for pairing). */
+const PUBLIC_ADMIN_PATHS = new Set(['/api/v1/admin/sms-gateway/download-apk']);
+
+/** Admin-prefixed routes the local observer processes call with the observer token. */
+const OBSERVER_ADMIN_PATHS = new Set(['/api/v1/admin/gmail/credentials']);
+
+/** SSE cannot send headers from EventSource, so these accept `?token=` on GET. */
+const QUERY_TOKEN_PATHS = new Set(['/api/v1/admin/stream']);
+
+function bearerToken(req) {
+  const header = req.headers['authorization'] || '';
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match ? match[1].trim() : '';
+}
+
+function isDevTool(pathname) {
+  return pathname.startsWith('/api/v1/admin/dev/') || /^\/api\/v1\/checkout\/[^/]+\/simulate-observation$/.test(pathname);
+}
+
+/**
+ * Decides which credential a request needs.
+ * @returns {null | 'admin' | 'observer'} null = public, 'observer' = admin OR observer token
+ */
+function requiredLevel(method, pathname) {
+  if (pathname.startsWith('/api/v1/admin/')) {
+    if (PUBLIC_ADMIN_PATHS.has(pathname)) return null;
+    if (OBSERVER_ADMIN_PATHS.has(pathname)) return 'observer';
+    return 'admin';
+  }
+  if (method === 'POST' && pathname === '/api/v1/pollers/events') return 'observer';
+  // Injects a synthetic bank message into the real verification pipeline.
+  if (method === 'POST' && /^\/api\/v1\/checkout\/[^/]+\/simulate-observation$/.test(pathname)) return 'admin';
+  return null;
+}
+
+/**
+ * Guard for HttpServer.use(). Admin credential = ADMIN_API_TOKEN (or data/.secrets/admin_api_token).
+ * Observer credential = OBSERVER_API_TOKEN (or data/.secrets/observer_api_token); admin token also satisfies it.
+ */
+export function authGuard(req, res, pathname, url) {
+  const method = req.method.toUpperCase();
+
+  // Developer simulators push synthetic bank messages into the real pipeline and can settle live sessions.
+  if (method !== 'GET' && isDevTool(pathname) && process.env.NODE_ENV === 'production' && process.env.ELPAY_ALLOW_DEV_TOOLS !== 'true') {
+    json(res, 403, { error: 'Developer tools are disabled in production.', code: 'DEV_TOOLS_DISABLED' });
+    return true;
+  }
+
+  const level = requiredLevel(method, pathname);
+  if (!level) return false;
+
+  let presented = bearerToken(req);
+  if (!presented && method === 'GET' && QUERY_TOKEN_PATHS.has(pathname)) {
+    presented = url.searchParams.get('token') || '';
+  }
+
+  const ok = presented && (
+    safeEqual(presented, getAdminToken()) ||
+    (level === 'observer' && safeEqual(presented, getObserverToken()))
+  );
+  if (ok) return false;
+
+  json(res, 401, { error: 'Unauthorized', code: 'AUTH_REQUIRED' });
+  return true;
+}
+
+/** True only when the request carries the admin token (observer token is not enough). */
+export function isAdminRequest(req) {
+  const presented = bearerToken(req);
+  return Boolean(presented) && safeEqual(presented, getAdminToken());
+}
+
+/**
+ * True when the caller may read the merchant-private fields of a payment session.
+ *
+ * Requires proof of ownership: either the gateway's own admin/observer credential, or the
+ * owning merchant's webhook secret presented via `X-Merchant-Key` (which every merchant
+ * integration already holds). Without it, only the public view is returned, so a leaked or
+ * guessed payment id cannot be used to read internal status, verification internals,
+ * merchant metadata or the return URL.
+ */
+export function isPaymentOwner(req, session, ctx) {
+  if (isAdminRequest(req)) return true;
+  if (hasBearer(req, getObserverToken())) return true;
+
+  const presented = req.headers['x-merchant-key'];
+  if (!presented || typeof presented !== 'string' || !presented.trim()) return false;
+
+  const merchant = ctx.merchantRepo?.findById ? ctx.merchantRepo.findById(session.merchantId) : null;
+  if (!merchant?.webhookSecret) return false;
+  return safeEqual(presented.trim(), merchant.webhookSecret);
+}

package/src/index.js

@@ -0,0 +1,137 @@
+import { EventEmitter } from 'node:events';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PaymentStatus } from './vendor/common/index.js';
+import {
+  getDatabase,
+  ensureDatabaseInitialized,
+  runMigrations,
+  MerchantRepository,
+  ReceivingAccountRepository,
+  CustomerRepository,
+  CustomerSessionRepository,
+  PaymentSessionRepository,
+  ObservationRepository,
+  SupportTicketRepository,
+  AuditLogRepository,
+  DeviceRepository
+} from './vendor/db/index.js';
+import {
+  QueueEngine,
+  TimingEngine,
+  AttributionEngine,
+  RecoveryEngine,
+  WebhookEngine,
+  PaymentVerificationPipeline
+} from './vendor/core/index.js';
+import { createRouter } from './router.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+export async function elpay(options = {}) {
+  const db = options.db || getDatabase(options.databaseUrl);
+  ensureDatabaseInitialized(db);
+  const { defaultMerchant } = runMigrations(db);
+
+  const merchantRepo = new MerchantRepository(db);
+  const accountRepo = new ReceivingAccountRepository(db);
+  const customerRepo = new CustomerRepository(db);
+  const customerSessionRepo = new CustomerSessionRepository(db, customerRepo);
+  const sessionRepo = new PaymentSessionRepository(db);
+  const obsRepo = new ObservationRepository(db);
+  const ticketRepo = new SupportTicketRepository(db);
+  const auditRepo = new AuditLogRepository(db);
+  const deviceRepo = new DeviceRepository(db);
+
+  const eventEmitter = new EventEmitter();
+
+  const parseWindowMs = (raw, fallback) => {
+    if (raw === undefined || raw === null || String(raw).trim() === '') return fallback;
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value <= 0 || value > 24 * 60 * 60 * 1000) return fallback;
+    return Math.floor(value);
+  };
+  const activeDurationMs = parseWindowMs(process.env.PAYMENT_ACTIVE_WINDOW_MS, 300000);
+  const processingDurationMs = parseWindowMs(process.env.PAYMENT_PROCESSING_WINDOW_MS, 30000);
+
+  const queueEngine = new QueueEngine({ sessionRepo, accountRepo, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
+  const timingEngine = new TimingEngine({ sessionRepo, queueEngine, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
+  const attributionEngine = new AttributionEngine({ sessionRepo, obsRepo, ticketRepo, auditRepo, eventEmitter });
+  const recoveryEngine = new RecoveryEngine({ db, sessionRepo, accountRepo, queueEngine, timingEngine, auditRepo, eventEmitter });
+  const webhookEngine = new WebhookEngine({ db, merchantRepo, maxRetries: Number(process.env.WEBHOOK_MAX_RETRIES || 5) });
+
+  const checkoutBaseUrl = options.baseUrl || process.env.BASE_CHECKOUT_URL || 'http://localhost:3000';
+
+  const handleSlotFreedAndPromote = (receivingAccountId) => {
+    if (!receivingAccountId) return null;
+    const promoted = queueEngine.promoteNext(receivingAccountId);
+    if (promoted) {
+      if (promoted.expiresAt) timingEngine.startActiveTimer(promoted.id, promoted.expiresAt);
+    }
+    return promoted;
+  };
+
+  eventEmitter.on('PAYMENT.SUCCESS', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('SUCCESS', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+    if (options.onSuccess) options.onSuccess(data);
+  });
+  eventEmitter.on('PAYMENT.FAILED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('FAILED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+    if (options.onFailed) options.onFailed(data);
+  });
+  eventEmitter.on('PAYMENT.EXPIRED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('EXPIRED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+  });
+  eventEmitter.on('PAYMENT.CANCELLED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('CANCELLED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+  });
+
+  recoveryEngine.recover();
+
+  const pipeline = new PaymentVerificationPipeline({
+    db, sessionRepo, obsRepo, customerRepo, attributionEngine, auditRepo, merchantRepo,
+    server: null, eventEmitter
+  });
+
+  const ctx = {
+    db, merchantRepo, accountRepo, customerRepo, customerSessionRepo, sessionRepo, deviceRepo,
+    obsRepo, ticketRepo, auditRepo, queueEngine, timingEngine, attributionEngine, pipeline,
+    recoveryEngine, eventEmitter, defaultMerchant, checkoutBaseUrl, webhookEngine,
+    otpCooldownMs: options.otpCooldownMs,
+    theme: options.theme || {}
+  };
+
+  const router = createRouter(ctx);
+
+  const destroy = () => {
+    timingEngine.destroy?.();
+    attributionEngine.destroy?.();
+  };
+
+  return {
+    router,
+    on: (event, cb) => eventEmitter.on(event, cb),
+    init: async () => {},
+    destroy,
+  };
+}
+
+export { createRouter };
+export default { elpay };

package/src/router.js

@@ -0,0 +1,46 @@
+import { Router } from 'express';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import express from 'express';
+import { registerPaymentRoutes } from './routes/payments.routes.js';
+import { registerCheckoutRoutes } from './routes/checkout.routes.js';
+import { registerPollerRoutes } from './routes/pollers.routes.js';
+import { registerAdminRoutes } from './routes/admin.routes.js';
+import { registerCustomerRoutes } from './routes/customer.routes.js';
+import { registerDeviceRoutes } from './routes/device.routes.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+export function createRouter(ctx = {}) {
+  const router = Router();
+  router.use(express.static(path.join(__dirname, '..', 'public')));
+
+  router.get('/checkout/:id', (req, res) => {
+    const htmlPath = path.join(__dirname, '..', 'public', 'views', 'checkout.html');
+    const html = fs.readFileSync(htmlPath, 'utf8')
+      .replace(/\{\{API_BASE_URL\}\}/g, ctx.baseUrl || 'http://localhost:5000')
+      .replace(/\{\{PAYMENT_ID\}\}/g, req.params.id);
+    res.type('html').send(html);
+  });
+
+  router.get('/theme.css', (req, res) => {
+    const t = ctx.theme || {};
+    const vars = [
+      t.primaryColor ? `--elpay-primary: ${t.primaryColor};` : '',
+      t.borderRadius ? `--elpay-radius: ${t.borderRadius};` : '',
+      t.fontFamily ? `--elpay-font: ${t.fontFamily};` : '',
+    ].filter(Boolean).join(' ');
+    res.type('text/css').send(`:root { ${vars} }`);
+  });
+
+  registerPaymentRoutes(router, ctx);
+  registerCheckoutRoutes(router, ctx);
+  registerPollerRoutes(router, ctx);
+  registerAdminRoutes(router, ctx);
+  registerCustomerRoutes(router, ctx);
+  registerDeviceRoutes(router, ctx);
+  return router;
+}
+
+export default createRouter;