Payment Service

Port: 8085 | DB: db_kesles_merchant_payment | Status: ✅ ALL PHASES DONE 2026-06-16

Overview

Downstream consumer dari webhook payment.kesles.com. Menerima notifikasi transaksi, settlement, dan refund — tidak memproses transaksi secara langsung (itu urusan payment.kesles.com).

Flow

Flow A — Customer → Merchant (QRIS transaksi)

payment.kesles.com → POST /psp/v1/events
  → INSERT payment.transactions
  → UPSERT payment.transaction_daily_fees
  → async FCM ke merchant

Flow B — Merchant → Kesles (beli produk)

payment.kesles.com → POST /psp/v1/events (NMID = ID9999999999999)
  → INSERT psp.event_log
  → HTTP POST order-service /internal/sales-orders/{id}/mark-paid
  → TIDAK INSERT ke payment.transactions

Database Schema

3 schema, 13 tabel:

Schema	Tabel
psp	api_keys, event_log, outbound_requests
payment	transactions, settlements, refunds, transaction_daily_fees, transactions_daily_agg, transactions_monthly_agg, merchant_financials, qris_config
worker	job_runs, recon_findings

payment.qris_config — singleton NMID korporat Kesles (ID9999999999999, PT Inti Kesles Nusantara).

Endpoints

PSP Webhook (HMAC auth)

• POST /psp/v1/events — transaksi, refund, nmid-status-changed
• POST /psp/v1/settlements — settlement batch

Internal (X-Internal-API-Key)

• GET /internal/transactions
• GET /internal/settlements
• GET /internal/refunds + approve/reject
• GET /internal/qris-config + PATCH
• GET /internal/merchant-financials/{id}
• GET /internal/psp/event-log
• GET /internal/psp/outbound-requests
• POST /internal/psp/api-keys (mint/revoke)

Merchant (Bearer JWT)

• GET /merchant/transactions
• GET /merchant/settlements
• GET /merchant/financials
• GET /merchant/payment-destinations — QRIS korporat untuk Flow B checkout

PSP Auth

Header: X-PSP-Key-ID, X-PSP-Timestamp, X-PSP-Signature

signed_payload = METHOD + "\n" + PATH + "\n" + TIMESTAMP + "\n" + BODY
signature = hex(hmac_sha256(decrypted_secret, signed_payload))

Webhook Entry Point

payment.kesles.com harus mengirim webhook ke:

POST https://api-merchant.kesles.com/psp/v1/events
POST https://api-merchant.kesles.com/psp/v1/settlements

PSP API keys aktif di psp.api_keys:

key_id	Status
payment-kesles-com-prod	✅ Aktif (300 req/min)
banking-kesles-com-uat	✅ Aktif (60 req/min)

Deployment (VM)

• Folder: /home/enalfarid/kesles_merchant/merchant_payment/
• Systemd: payment-service.service
• Env: .env.production (APP_ENV=production line 1)
• POSTGRES_DSN_LEGACY dihapus — legacy mirror code removed 2026-06-16 (Phase 2 cutover done)