kempo-payments 0.1.1

package/install.js

@@ -0,0 +1,48 @@
+import { sql } from 'drizzle-orm';
+import db from 'kempo/server/db/index.js';
+
+/*
+  Two things the declarative config cannot do.
+
+  **The indexes.** kempo's installer generates `CREATE TABLE` from the Drizzle schema and reads
+  columns and primary keys off it — indexes and unique constraints declared on a table are not
+  carried across. For most extensions that is a performance footnote. Here one of them is a
+  correctness guarantee: without a unique index on `(provider, providerRef)` two rows can claim the
+  same charge, and every webhook after that updates whichever one the database happens to return
+  first. So they are created here, by hand, matching what server/db/schema.js declares. A static
+  test checks the two lists agree — a schema index that this file forgets exists only in
+  development, where `drizzle-kit push` makes it.
+
+  **The warning.** Every credential this extension stores is a `secret` setting, and kempo can only
+  encrypt those when SETTINGS_ENCRYPTION_KEY is set. Without it the settings are silently not
+  created, and the first sign of trouble is a settings screen that refuses to save a key with no
+  explanation. Saying so at install time is the difference between a two-minute fix and an hour.
+*/
+
+const INDEXES = [
+  sql`CREATE UNIQUE INDEX IF NOT EXISTS "kempoPayment_providerRef_idx" ON "kempoPayment" ("provider", "providerRef")`,
+  sql`CREATE INDEX IF NOT EXISTS "kempoPayment_reference_idx" ON "kempoPayment" ("owner", "reference")`,
+  sql`CREATE INDEX IF NOT EXISTS "kempoPaymentRefund_payment_idx" ON "kempoPaymentRefund" ("paymentId")`,
+];
+
+export default async () => {
+  for(const statement of INDEXES){
+    try {
+      await db.execute(statement);
+    } catch(error) {
+      console.warn(`[kempo-payments] Could not create an index: ${error.message}`);
+    }
+  }
+
+  if(!process.env.SETTINGS_ENCRYPTION_KEY){
+    console.warn([
+      '[kempo-payments] SETTINGS_ENCRYPTION_KEY is not set, so the API credentials cannot be stored.',
+      '  Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"',
+      '  Put it in .env, restart, then reinstall this extension.',
+      '  Back it up somewhere — losing it makes every stored secret on the site unrecoverable.',
+    ].join('\n'));
+    return;
+  }
+
+  console.log('[kempo-payments] Installed. Connect a processor at /admin/extension/kempo-payments/ — nothing can be charged until you do.');
+};

package/kempo-config.json

@@ -0,0 +1,73 @@
+{
+  "docs": "https://github.com/dustinpoissant/kempo-payments#readme",
+  "git": "https://github.com/dustinpoissant/kempo-payments",
+  "public-scope": "payments",
+  "schema": "./server/db/schema.js",
+  "permissions": [
+    { "name": "payments:view", "description": "See payments, what they were for, and what happened to them" },
+    { "name": "payments:create", "description": "Take a payment — start a new charge over the API" },
+    { "name": "payments:capture", "description": "Capture or cancel a payment that was only authorised" },
+    { "name": "payments:refund", "description": "Refund a payment, in full or in part" },
+    { "name": "payments:settings", "description": "Change the payment provider and its API credentials" }
+  ],
+  "settings": [
+    {
+      "name": "provider",
+      "value": "stripe",
+      "type": "string",
+      "description": "Which payment processor money actually goes through. Only 'stripe' ships today"
+    },
+    {
+      "name": "currency",
+      "value": "usd",
+      "type": "string",
+      "description": "The currency a payment is taken in when the caller does not name one. ISO 4217, lowercase"
+    },
+    {
+      "name": "capture_method",
+      "value": "automatic",
+      "type": "string",
+      "description": "'automatic' charges the card as soon as the customer confirms. 'manual' only authorises it, and somebody has to capture it before the hold expires"
+    },
+    {
+      "name": "stripe_publishable_key",
+      "value": "",
+      "type": "string",
+      "description": "Stripe publishable key (pk_test_… or pk_live_…). This one is meant to be seen — it is what the payment form in the browser is built with"
+    },
+    {
+      "name": "stripe_secret_key",
+      "value": "",
+      "type": "secret",
+      "description": "Stripe secret key (sk_test_… or sk_live_…). Encrypted at rest and never sent to a browser"
+    },
+    {
+      "name": "stripe_webhook_secret",
+      "value": "",
+      "type": "secret",
+      "description": "Stripe webhook signing secret (whsec_…). Without it every webhook is rejected, and no payment is ever confirmed"
+    }
+  ],
+  "groups": [
+    {
+      "name": "kempo-payments:operator",
+      "description": "Handles payments day to day — looks them up, captures authorisations and issues refunds — without being able to see or change the API credentials",
+      "permissions": [
+        "payments:view",
+        "payments:capture",
+        "payments:refund"
+      ]
+    },
+    {
+      "name": "kempo-payments:administrator",
+      "description": "Everything an operator can do, plus connecting the site to a payment processor",
+      "permissions": [
+        "payments:view",
+        "payments:create",
+        "payments:capture",
+        "payments:refund",
+        "payments:settings"
+      ]
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "kempo-payments",
+  "version": "0.1.1",
+  "description": "Payment processing for kempo — provider-agnostic payment intents, capture and refunds, with Stripe built in",
+  "license": "MIT",
+  "author": "Dustin Poissant",
+  "type": "module",
+  "main": "sdk.js",
+  "scripts": {
+    "test": "kempo-test -l minimal",
+    "link:local": "npm install ../kempo ../kempo-server ../kempo-ui --no-save --no-legacy-peer-deps --force"
+  },
+  "kempo": {
+    "public-scope": "payments"
+  },
+  "exports": {
+    "./install": "./install.js",
+    "./update": "./update.js",
+    "./uninstall": "./uninstall.js",
+    "./sdk": "./sdk.js"
+  },
+  "files": [
+    "admin",
+    "public",
+    "server",
+    "install.js",
+    "update.js",
+    "uninstall.js",
+    "sdk.js",
+    "kempo-config.json"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dustinpoissant/kempo-payments.git"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.45.2",
+    "stripe": "^22.5.0"
+  },
+  "peerDependencies": {
+    "kempo": ">=4.2.40",
+    "kempo-server": ">=3.3.0",
+    "kempo-ui": ">=0.4.53"
+  },
+  "devDependencies": {
+    "drizzle-kit": "^0.31.10",
+    "kempo-testing-framework": "^1.4.11",
+    "postgres": "^3.4.9"
+  },
+  "allowScripts": {
+    "esbuild@0.18.20": true,
+    "esbuild@0.25.12": true,
+    "esbuild@0.28.2": true,
+    "puppeteer@25.7.0": true
+  }
+}

package/public/api/config/GET.js

@@ -0,0 +1,48 @@
+import { activeProvider } from '../../../server/providers/index.js';
+import { readConfig } from '../../../server/utils/config/settings.js';
+
+/*
+  What a payment form in a browser needs to exist: which processor is configured, its publishable
+  key, and the currency amounts will be in.
+
+  The one route here with no session check, deliberately. A publishable key is designed to be
+  public — it is embedded in the page for every visitor and can do nothing on its own but tokenise
+  a card the person holding it already has. Gating this would mean guests cannot check out, which
+  is most of the people checking out.
+
+  Nothing secret can reach here by accident: the provider module decides what its `clientConfig` is
+  allowed to contain, and the secret key is not part of it.
+*/
+export default async (request, response) => {
+  const config = await readConfig();
+
+  const [providerError, provider] = await activeProvider();
+  if(providerError){
+    return response.json({ configured: false, provider: config.provider, currency: config.currency });
+  }
+
+  const [statusError, status] = await provider.status();
+  if(statusError) return response.status(statusError.code).json({ error: statusError.msg });
+
+  if(!status.configured){
+    return response.json({
+      configured: false,
+      provider: provider.name,
+      label: provider.label,
+      currency: config.currency,
+    });
+  }
+
+  const [configError, clientConfig] = await provider.clientConfig();
+  if(configError) return response.status(configError.code).json({ error: configError.msg });
+
+  response.json({
+    configured: true,
+    provider: provider.name,
+    label: provider.label,
+    currency: config.currency,
+    captureMethod: config.captureMethod,
+    mode: status.mode,
+    ...clientConfig,
+  });
+};

package/public/api/payments/GET.js

@@ -0,0 +1,31 @@
+import { listPayments } from '../../../server/utils/payments/store.js';
+import { gate } from '../../../server/utils/permissions/gate.js';
+
+/*
+  The payment list behind the admin screen. Paged, because a working store's payment table is the
+  one that grows forever.
+
+  `status` accepts a comma-separated list so "needs attention" can be one filter rather than four
+  round trips.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:view');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const query = request.query || {};
+  const status = query.status ? String(query.status).split(',').map(value => value.trim()).filter(Boolean) : undefined;
+
+  const [error, result] = await listPayments({
+    status: status?.length === 1 ? status[0] : status,
+    provider: query.provider,
+    owner: query.owner,
+    reference: query.reference,
+    userId: query.userId,
+    limit: query.limit,
+    offset: query.offset,
+  });
+
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/payments/POST.js

@@ -0,0 +1,41 @@
+import { createPayment } from '../../../server/utils/payments/create.js';
+import { gate } from '../../../server/utils/permissions/gate.js';
+
+/*
+  Starts a payment over HTTP.
+
+  Gated behind `payments:create`, which no ordinary visitor holds — and that is not an oversight.
+  The amount is in the request body, so an open version of this route would let anyone decide what
+  they owe. A customer-facing checkout works the other way round: the consumer extension computes
+  the amount on its own server, calls `createPayment` from the SDK, and sends only the resulting
+  client secret to the browser.
+
+  What this route is for is the other callers — the admin's own test payment, a script, an
+  integration that already authenticates as somebody trusted.
+*/
+export default async (request, response) => {
+  const [gateError, session] = await gate(request, 'payments:create');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const body = request.body || {};
+
+  const [error, result] = await createPayment({
+    amount: typeof body.amount === 'string' ? Number(body.amount) : body.amount,
+    currency: body.currency,
+    description: body.description || null,
+    metadata: body.metadata && typeof body.metadata === 'object' ? body.metadata : null,
+    captureMethod: body.captureMethod || null,
+    owner: body.owner || null,
+    reference: body.reference || null,
+    /*
+      Whoever is signed in, unless they named somebody else. A payment created on behalf of a
+      customer by a member of staff belongs to the customer, not to the person who typed it in.
+    */
+    userId: body.userId || session.user.id,
+    customerEmail: body.customerEmail || null,
+  });
+
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/payments/[id]/GET.js

@@ -0,0 +1,30 @@
+import { getPayment, listRefunds } from '../../../../server/utils/payments/store.js';
+import { listEvents } from '../../../../server/utils/webhooks/receive.js';
+import { refundableAmount } from '../../../../server/utils/payments/statuses.js';
+import { gate } from '../../../../server/utils/permissions/gate.js';
+
+/*
+  One payment, with everything anybody looking at it needs in one response: the refunds against it
+  and the processor events that produced its current state.
+
+  The event log is included rather than being a separate screen because it is the answer to the
+  only hard question a payment screen ever gets — "the customer says they paid, why does this say
+  they did not" — and the answer is usually a webhook that never arrived.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:view');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const [error, payment] = await getPayment(request.params?.id);
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  const [, refunds] = await listRefunds(payment.id);
+  const [, events] = await listEvents(payment.id);
+
+  response.json({
+    payment,
+    refunds: refunds || [],
+    events: events || [],
+    refundable: refundableAmount(payment),
+  });
+};

package/public/api/payments/[id]/cancel/POST.js

@@ -0,0 +1,19 @@
+import { cancelPayment } from '../../../../../server/utils/payments/actions.js';
+import { gate } from '../../../../../server/utils/permissions/gate.js';
+
+/*
+  Releases a payment nothing has been taken from.
+
+  Gated on `payments:capture` rather than a permission of its own: capturing and cancelling are the
+  two halves of one decision — resolve an authorisation — and whoever is trusted to complete a sale
+  is the same person trusted to call it off.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:capture');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const [error, result] = await cancelPayment(request.params?.id);
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/payments/[id]/capture/POST.js

@@ -0,0 +1,22 @@
+import { capturePayment } from '../../../../../server/utils/payments/actions.js';
+import { gate } from '../../../../../server/utils/permissions/gate.js';
+
+/*
+  Takes the money that was authorised.
+
+  An amount may be given to capture less than was held — an order that shipped short. Leaving it
+  off captures the whole authorisation, which is what the button on the admin screen does.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:capture');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const amount = request.body?.amount;
+
+  const [error, result] = await capturePayment(request.params?.id, {
+    amount: amount === undefined || amount === null || amount === '' ? undefined : Number(amount),
+  });
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/payments/[id]/client-secret/GET.js

@@ -0,0 +1,23 @@
+import { getClientSecret } from '../../../../../server/utils/payments/actions.js';
+import { gate } from '../../../../../server/utils/permissions/gate.js';
+
+/*
+  The client secret for a payment already in flight, so a payment form can be mounted against it
+  again — a reloaded checkout, or a customer coming back to finish.
+
+  Gated on `payments:create`, the same permission that starting a payment needs. A client secret is
+  not a credential for the site, but it does let whoever holds it pay, cancel or read that one
+  payment, so it is not something to hand out on the strength of knowing an id.
+
+  A customer-facing "resume checkout" belongs in the consumer extension: it knows which order
+  belongs to which session and can answer that question from its own records. This route cannot.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:create');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const [error, result] = await getClientSecret(request.params?.id);
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/payments/[id]/refund/POST.js

@@ -0,0 +1,28 @@
+import { refundPayment } from '../../../../../server/utils/payments/actions.js';
+import { gate } from '../../../../../server/utils/permissions/gate.js';
+
+/*
+  Gives money back.
+
+  Omitting the amount refunds everything still outstanding. The reason is recorded and shown next
+  to the refund afterwards — a free-text one is kept even where the processor only accepts a short
+  list of its own, because it was written for a person to read, not for the processor.
+
+  `issuedBy` is the signed-in user rather than anything in the body. Who refunded what is exactly
+  the field nobody should be able to set on their own behalf.
+*/
+export default async (request, response) => {
+  const [gateError, session] = await gate(request, 'payments:refund');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const amount = request.body?.amount;
+
+  const [error, result] = await refundPayment(request.params?.id, {
+    amount: amount === undefined || amount === null || amount === '' ? undefined : Number(amount),
+    reason: request.body?.reason || null,
+    issuedBy: session.user.id,
+  });
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/payments/[id]/sync/POST.js

@@ -0,0 +1,23 @@
+import { syncPayment } from '../../../../../server/utils/payments/sync.js';
+import { gate } from '../../../../../server/utils/permissions/gate.js';
+
+/*
+  Asks the processor what it thinks and writes the answer down.
+
+  A repair tool, not part of the normal path — webhooks are. It exists because the normal path has
+  one failure mode that is invisible from here: an endpoint that was never registered, or was
+  registered with the wrong signing secret, means payments succeed at the processor and stay
+  `processing` on this site forever. This is the button that fixes a payment in that state, and the
+  proof of what went wrong when it fixes every one of them.
+
+  A POST rather than a GET because it writes and it can fire hooks.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:view');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const [error, result] = await syncPayment(request.params?.id);
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};

package/public/api/providers/GET.js

@@ -0,0 +1,16 @@
+import { listProviders } from '../../../server/providers/index.js';
+import { gate } from '../../../server/utils/permissions/gate.js';
+
+/*
+  The processors this installation could be pointed at, and the credential fields each one needs.
+
+  The settings screen builds its form from this rather than hard-coding Stripe's three keys, so a
+  second provider module arrives with its own form and nothing in the admin has to be edited to
+  show it.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:settings');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  response.json({ providers: listProviders() });
+};

package/public/api/settings/GET.js

@@ -0,0 +1,36 @@
+import { activeProvider, listProviders } from '../../../server/providers/index.js';
+import { readConfig } from '../../../server/utils/config/settings.js';
+import { gate } from '../../../server/utils/permissions/gate.js';
+
+/*
+  Everything the settings screen renders, and not one character of a secret.
+
+  A credential comes back as a boolean — whether it is set — rather than a masked string. Masking
+  in the response and hoping nothing logs it is a weaker promise than never putting it in the
+  response at all, and the screen has no use for the value anyway: editing a secret is replace-only
+  by design.
+
+  What it does come back with is `mode` and `mismatchedKeys`, both derived from key *prefixes*.
+  Those are the two things somebody staring at a payment form that will not load needs to be told,
+  and neither of them requires revealing a key to answer.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:settings');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const config = await readConfig();
+  const [providerError, provider] = await activeProvider();
+
+  const status = providerError ? null : (await provider.status())[1];
+
+  response.json({
+    settings: config,
+    providers: listProviders(),
+    status,
+    /*
+      Said here rather than left for the admin to discover through a save that appears to work and
+      does nothing. Without this key kempo cannot store a secret setting at all.
+    */
+    encryptionConfigured: !!process.env.SETTINGS_ENCRYPTION_KEY,
+  });
+};

package/public/api/settings/PUT.js

@@ -0,0 +1,123 @@
+import { setSetting } from 'kempo/server/sdk.js';
+import { getProvider, listProviders } from '../../../server/providers/index.js';
+import { OWNER, CAPTURE_METHODS, parseCaptureMethod, readConfig } from '../../../server/utils/config/settings.js';
+import { typeOf, descriptionOf, DECLARED_SETTINGS } from '../../../server/utils/config/declared.js';
+import { isValidCurrency, normaliseCurrency } from '../../../server/utils/money/currencies.js';
+import { gate } from '../../../server/utils/permissions/gate.js';
+
+/*
+  Saves the settings, one kempo setting per field.
+
+  These are ordinary kempo settings and also appear under /admin/settings grouped by owner —
+  nothing here is a second store. What this route adds is validation before the write, and its own
+  permission: `payments:settings` can be given to whoever connects the site to its processor
+  without also giving them `system:settings:update`, which is every setting on the installation.
+
+  **Blank means unchanged, not cleared.** A secret is never sent to the browser, so the field
+  showing it is always empty — saving the form after editing something else would otherwise wipe
+  the site's API keys and stop it taking money. Clearing one is possible, but it takes an explicit
+  `null`, which no accidental submit produces.
+*/
+
+/*
+  Exported so a static test can check every name here is declared in kempo-config.json. A setting
+  written without its declared type is the specific failure that matters most in this extension:
+  `secret` is what makes an API key encrypted at rest, and a write that loses the type stores it as
+  plain text in a row the admin settings screen will show to anyone who can open it.
+*/
+export const SAVEABLE = [
+  'provider',
+  'currency',
+  'capture_method',
+  ...listProviders().flatMap(provider => provider.credentialFields.map(field => field.name)),
+];
+
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:settings');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  if(!process.env.SETTINGS_ENCRYPTION_KEY){
+    return response.status(500).json({
+      error: 'SETTINGS_ENCRYPTION_KEY is not set on this server, so API credentials cannot be stored. Add it to the environment and restart.',
+    });
+  }
+
+  const body = request.body || {};
+  const updates = {};
+
+  if(body.provider !== undefined){
+    const [error] = getProvider(String(body.provider));
+    if(error) return response.status(400).json({ error: error.msg });
+    updates.provider = String(body.provider);
+  }
+
+  if(body.currency !== undefined){
+    const currency = normaliseCurrency(body.currency);
+    if(!isValidCurrency(currency)){
+      return response.status(400).json({ error: 'Currency must be a three-letter ISO code, such as usd or gbp' });
+    }
+    updates.currency = currency;
+  }
+
+  if(body.capture_method !== undefined){
+    const method = parseCaptureMethod(body.capture_method);
+    if(!method){
+      return response.status(400).json({ error: `Capture method must be one of: ${CAPTURE_METHODS.join(', ')}` });
+    }
+    updates.capture_method = method;
+  }
+
+  for(const provider of listProviders()){
+    for(const field of provider.credentialFields){
+      const value = body[field.name];
+      if(value === undefined) continue;
+
+      // The deliberate clear. Anything else empty is a form that simply had nothing typed in it.
+      if(value === null){
+        updates[field.name] = '';
+        continue;
+      }
+
+      const trimmed = String(value).trim();
+      if(!trimmed) continue;
+
+      /*
+        The one paste that has to be refused rather than warned about. A secret key in the
+        publishable field would be handed to every visitor's browser by the config route, and by
+        the time anybody noticed it would have to be treated as compromised and rotated.
+      */
+      if(field.type !== 'secret' && /^(sk|rk)_/.test(trimmed)){
+        return response.status(400).json({
+          error: `That looks like a secret key, not a ${field.label.toLowerCase()}. It would be sent to every visitor’s browser — check you have the right one.`,
+        });
+      }
+
+      updates[field.name] = trimmed;
+    }
+  }
+
+  if(!Object.keys(updates).length){
+    return response.status(400).json({ error: 'Nothing to save' });
+  }
+
+  for(const [name, value] of Object.entries(updates)){
+    // Belt and braces: nothing reaches setSetting that is not on the list above.
+    if(!SAVEABLE.includes(name) || !DECLARED_SETTINGS.has(name)) continue;
+
+    /*
+      The type and description come from kempo-config.json rather than being restated here.
+      setSetting stores exactly what it is handed, so passing null for the description would erase
+      the text kempo's own /admin/settings screen shows next to each of these.
+
+      isPublic stays false throughout, and setSetting forces it false for a secret regardless.
+    */
+    const [error] = await setSetting(OWNER, name, value, typeOf(name), false, descriptionOf(name));
+    if(error) return response.status(error.code).json({ error: error.msg });
+  }
+
+  const config = await readConfig();
+  const [providerError, provider] = getProvider(config.provider);
+  const status = providerError ? null : (await provider.status())[1];
+
+  response.json({ settings: config, status });
+};

package/public/api/summary/GET.js

@@ -0,0 +1,18 @@
+import { summary } from '../../../server/utils/payments/store.js';
+import { gate } from '../../../server/utils/permissions/gate.js';
+
+/*
+  The counts and totals across the top of the admin screen, grouped by status and currency.
+
+  Grouped by currency because summing across them is meaningless — 100 JPY and 100 GBP added
+  together is 200 of nothing.
+*/
+export default async (request, response) => {
+  const [gateError] = await gate(request, 'payments:view');
+  if(gateError) return response.status(gateError.code).json({ error: gateError.msg });
+
+  const [error, result] = await summary();
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  response.json(result);
+};