Merge branch 'dev' into passenger/feat/iam

apps/edr-passenger-api/src/modules/payments/internal-payments.controller.ts

@@ -0,0 +1,35 @@
+import {
+  Body,
+  Controller,
+  HttpCode,
+  HttpStatus,
+  Post,
+  UseGuards,
+} from "@nestjs/common";
+import { ApiOperation, ApiTags } from "@nestjs/swagger";
+import { ServiceAuthGuard } from "../../common/guards/service-auth.guard";
+import { PaymentEventDto, MarkPaidResponseDto } from "./internal-payments.dto";
+import { PaymentsService } from "./payments.service";
+
+/**
+ * Consumer side of the payment microservice's outbox relay (docs/payment-service §7.3).
+ * Only the payment service may call this (shared service token). Idempotent by design:
+ * the relay delivers at-least-once, so duplicates must be harmless. Becomes a queue
+ * consumer when RabbitMQ lands — the handler logic is transport-agnostic.
+ */
+@ApiTags("Internal Payments")
+@UseGuards(ServiceAuthGuard)
+@Controller("internal/payments")
+export class InternalPaymentsController {
+  constructor(private readonly paymentsService: PaymentsService) {}
+
+  @Post("mark-paid")
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({
+    summary:
+      "Apply a payment.succeeded/payment.failed event from the payment service (idempotent)",
+  })
+  async markPaid(@Body() event: PaymentEventDto): Promise<MarkPaidResponseDto> {
+    return this.paymentsService.handlePaymentEvent(event);
+  }
+}

apps/edr-passenger-api/src/modules/payments/internal-payments.dto.ts

@@ -0,0 +1,57 @@
+import {
+  IsEnum,
+  IsIn,
+  IsInt,
+  IsISO8601,
+  IsOptional,
+  IsPositive,
+  IsString,
+  IsUUID,
+} from "class-validator";
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import {
+  PaymentEventType,
+  PaymentReferenceType,
+  PaymentService,
+  ProviderMethod,
+} from "@edr/types";
+
+/**
+ * Wire shape of the `PaymentEvent` envelope (@edr/types) delivered by the payment
+ * microservice's outbox relay. Delivery is at-least-once — the consumer is idempotent.
+ */
+export class PaymentEventDto {
+  @ApiProperty({ enum: [1] }) @IsIn([1]) version!: 1;
+  @ApiProperty() @IsUUID() eventId!: string;
+  @ApiProperty({ enum: ["payment.succeeded", "payment.failed"] })
+  @IsIn(["payment.succeeded", "payment.failed"])
+  eventType!: PaymentEventType;
+
+  @ApiProperty() @IsISO8601() occurredAt!: string;
+  @ApiProperty({ enum: PaymentService })
+  @IsEnum(PaymentService)
+  service!: string;
+  @ApiProperty() @IsUUID() intentId!: string;
+  @ApiProperty({ enum: PaymentReferenceType })
+  @IsEnum(PaymentReferenceType)
+  referenceType!: string;
+
+  @ApiProperty() @IsString() referenceId!: string;
+  @ApiProperty() @IsString() merchantOrderId!: string;
+  @ApiProperty({ enum: ProviderMethod })
+  @IsEnum(ProviderMethod)
+  provider!: string;
+  @ApiProperty() @IsInt() @IsPositive() amountMinor!: number;
+  @ApiProperty() @IsString() currency!: string;
+
+  @ApiPropertyOptional() @IsOptional() @IsString() providerTxnId?: string;
+  @ApiPropertyOptional() @IsOptional() @IsISO8601() paidAt?: string;
+  @ApiPropertyOptional() @IsOptional() @IsString() failureCode?: string;
+  @ApiPropertyOptional() @IsOptional() @IsString() failureMessage?: string;
+}
+
+export class MarkPaidResponseDto {
+  @ApiProperty() processed!: boolean;
+  @ApiPropertyOptional() alreadyFinalized?: boolean;
+  @ApiPropertyOptional() reason?: string;
+}

apps/edr-passenger-api/src/modules/payments/payment-client.service.ts

@@ -0,0 +1,95 @@
+import { BadGatewayException, Injectable, Logger } from "@nestjs/common";
+import { HttpService } from "@nestjs/axios";
+import { AxiosError } from "axios";
+import { firstValueFrom } from "rxjs";
+import {
+  InitiatePaymentRequest,
+  PaymentIntentSnapshot,
+  PaymentReferenceType,
+  PaymentService,
+} from "@edr/types";
+
+/**
+ * Thin HTTP client for the payment microservice (apps/edr-payment-api) — the passenger app's
+ * side of the Phase 6 cutover (docs/payment-service §10). Domain validation stays here;
+ * provider calls, intents, and webhooks live in the payment service.
+ */
+@Injectable()
+export class PaymentClientService {
+  private readonly logger = new Logger(PaymentClientService.name);
+  private readonly baseUrl = (
+    process.env.PAYMENT_API_URL ?? "http://localhost:3003"
+  ).replace(/\/$/, "");
+  private readonly serviceToken = process.env.SERVICE_AUTH_TOKEN ?? "";
+
+  constructor(private readonly http: HttpService) {}
+
+  /** POST /payments/initiate — idempotent per (service, referenceType, referenceId). */
+  async initiate(
+    request: InitiatePaymentRequest,
+  ): Promise<PaymentIntentSnapshot> {
+    return this.call("POST", "/payments/initiate", request);
+  }
+
+  /** GET /payments/intents?… — active intent by domain reference; null when none exists. */
+  async getIntentByReference(
+    referenceType: PaymentReferenceType,
+    referenceId: string,
+  ): Promise<PaymentIntentSnapshot | null> {
+    const query = new URLSearchParams({
+      service: PaymentService.PASSENGER,
+      referenceType,
+      referenceId,
+    });
+    try {
+      return await this.call("GET", `/payments/intents?${query.toString()}`);
+    } catch (err) {
+      if (err instanceof AxiosError && err.response?.status === 404)
+        return null;
+      throw err;
+    }
+  }
+
+  private async call<T>(
+    method: "GET" | "POST",
+    path: string,
+    body?: unknown,
+  ): Promise<T> {
+    const url = `${this.baseUrl}${path}`;
+    this.logger.log("=====================================================================");
+    this.logger.log(`URL ${url}`);
+    this.logger.log("=====================================================================");
+    try {
+      const response = await firstValueFrom(
+        this.http.request<T>({
+          method,
+          url,
+          data: body,
+          headers: this.serviceToken
+            ? { "x-service-token": this.serviceToken }
+            : {},
+        }),
+      );
+      return response.data;
+    } catch (err) {
+      if (err instanceof AxiosError && err.response) {
+        // 4xx/5xx from the payment service: propagate 404 to callers that handle it;
+        // everything else is a gateway-level failure from the client's perspective.
+        if (err.response.status === 404) throw err;
+        const detail =
+          (err.response.data as { message?: string | string[] })?.message ??
+          err.message;
+        this.logger.error(
+          `payment service ${method} ${path} → ${err.response.status}: ${detail}`,
+        );
+        throw new BadGatewayException(`Payment service error: ${detail}`);
+      }
+      const message =
+        err instanceof Error && err.message ? err.message : String(err);
+      this.logger.error(
+        `payment service unreachable (${method} ${path}): ${message}`,
+      );
+      throw new BadGatewayException("Payment service unreachable");
+    }
+  }
+}

apps/edr-passenger-api/src/modules/payments/payment-events.consumer.ts

@@ -0,0 +1,47 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Nack, RabbitSubscribe } from '@golevelup/nestjs-rabbitmq';
+import {
+  PAYMENT_EVENTS_DLX,
+  PAYMENT_EVENTS_EXCHANGE,
+  PAYMENT_QUEUES,
+  PaymentEvent,
+  PaymentService,
+  paymentServiceBindingPattern,
+} from '@edr/types';
+import { PaymentEventDto } from './internal-payments.dto';
+import { PaymentsService } from './payments.service';
+
+const PASSENGER_QUEUE = PAYMENT_QUEUES[PaymentService.PASSENGER];
+
+@Injectable()
+export class PaymentEventsConsumer {
+  private readonly logger = new Logger(PaymentEventsConsumer.name);
+
+  constructor(private readonly paymentsService: PaymentsService) {}
+
+  @RabbitSubscribe({
+    exchange: PAYMENT_EVENTS_EXCHANGE,
+    routingKey: paymentServiceBindingPattern(PaymentService.PASSENGER), // payment.passenger.*
+    queue: PASSENGER_QUEUE.main,
+    queueOptions: {
+      durable: true,
+      deadLetterExchange: PAYMENT_EVENTS_DLX,
+    },
+  })
+  async handle(event: PaymentEvent): Promise<Nack | void> {
+    try {
+      const result = await this.paymentsService.handlePaymentEvent(
+        event as unknown as PaymentEventDto,
+      );
+      this.logger.log(
+        `processed ${event.eventType} (${event.eventId}) ref=${event.referenceId}: ${JSON.stringify(result)}`,
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(
+        `DEAD-LETTERING ${event.eventType} (${event.eventId}) ref=${event.referenceId}: ${message}`,
+      );
+      return new Nack(false);
+    }
+  }
+}

apps/edr-passenger-api/src/modules/payments/payments.adapters.ts

@@ -1,10 +1,50 @@
-export interface GatewayResult { success: boolean; providerRef: string; clientAction?: { type: string; url?: string }; }
-
-export async function telebirrAdapter(_a: number, ref: string): Promise<GatewayResult> {
-  await new Promise((r) => setTimeout(r, 200));
-  return { success: true, providerRef: `TB-${ref}-${Date.now()}`, clientAction: { type: 'REDIRECT', url: `https://telebirr.sandbox.com/pay/${ref}` } };
+export interface GatewayResult {
+  success: boolean;
+  providerRef: string;
+  clientAction?: { type: string; url?: string };
+}
+
+export async function telebirrAdapter(
+  _a: number,
+  ref: string,
+): Promise<GatewayResult> {
+  await new Promise((r) => setTimeout(r, 200));
+  return {
+    success: true,
+    providerRef: `TB-${ref}-${Date.now()}`,
+    clientAction: {
+      type: "REDIRECT",
+      url: `https://telebirr.sandbox.com/pay/${ref}`,
+    },
+  };
+}
+export async function cbeBirrAdapter(
+  _a: number,
+  ref: string,
+): Promise<GatewayResult> {
+  await new Promise((r) => setTimeout(r, 150));
+  return { success: true, providerRef: `CBE-${ref}-${Date.now()}` };
+}
+export async function eBirrAdapter(
+  _a: number,
+  ref: string,
+): Promise<GatewayResult> {
+  await new Promise((r) => setTimeout(r, 150));
+  return { success: true, providerRef: `EB-${ref}-${Date.now()}` };
+}
+export async function cardAdapter(
+  _a: number,
+  ref: string,
+): Promise<GatewayResult> {
+  await new Promise((r) => setTimeout(r, 150));
+  return {
+    success: !ref.startsWith("FAIL"),
+    providerRef: `CARD-${ref}-${Date.now()}`,
+  };
+}
+export async function walletAdapter(
+  amount: number,
+  balance: number,
+): Promise<GatewayResult> {
+  return { success: balance >= amount, providerRef: `WALLET-${Date.now()}` };
 }
-export async function cbeBirrAdapter(_a: number, ref: string): Promise<GatewayResult> { await new Promise((r) => setTimeout(r, 150)); return { success: true, providerRef: `CBE-${ref}-${Date.now()}` }; }
-export async function eBirrAdapter(_a: number, ref: string): Promise<GatewayResult>   { await new Promise((r) => setTimeout(r, 150)); return { success: true, providerRef: `EB-${ref}-${Date.now()}` }; }
-export async function cardAdapter(_a: number, ref: string): Promise<GatewayResult>    { await new Promise((r) => setTimeout(r, 150)); return { success: !ref.startsWith('FAIL'), providerRef: `CARD-${ref}-${Date.now()}` }; }
-export async function walletAdapter(amount: number, balance: number): Promise<GatewayResult> { return { success: balance >= amount, providerRef: `WALLET-${Date.now()}` }; }

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -1,108 +1,205 @@
-import { Body, Controller, Get, HttpStatus, Param, Post, Query, Res, UseGuards } from '@nestjs/common';
-import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery, ApiOkResponse, ApiProduces } from '@nestjs/swagger';
-import { Response } from 'express';
-import { PaymentsService } from './payments.service';
-import { InitiatePaymentDto, RefundDto, AddPaymentMethodDto, PaymentRegionEnum, SupportedPaymentMethodDto, PaymentMethodTypeEnum, PaymentPlatformDto } from './payments.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { RolesGuard } from '../../common/roles.guard';
-import { Roles } from '../../common/roles.decorator';
-import { UserRole } from '@prisma/client';
+import {
+  Body,
+  Controller,
+  Get,
+  HttpStatus,
+  Param,
+  Post,
+  Query,
+  Res,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiTags,
+  ApiOperation,
+  ApiBearerAuth,
+  ApiQuery,
+  ApiOkResponse,
+  ApiProduces,
+} from "@nestjs/swagger";
+import { Response } from "express";
+import { PaymentsService } from "./payments.service";
+import {
+  InitiatePaymentDto,
+  RefundDto,
+  AddPaymentMethodDto,
+  PaymentRegionEnum,
+  SupportedPaymentMethodDto,
+  PaymentMethodTypeEnum,
+  PaymentPlatformDto,
+} from "./payments.dto";
+import { JwtGuard } from "../../common/jwt.guard";
+import { RolesGuard } from "../../common/roles.guard";
+import { Roles } from "../../common/roles.decorator";
+import { UserRole } from "@prisma/client";
 
-@ApiTags('Payment')
-@Controller('payments')
+@ApiTags("Payment")
+@Controller("payments")
 export class PaymentsController {
   constructor(private service: PaymentsService) {}
-  
-  @Post('initiate')
-  @ApiOperation({ 
-    summary: 'Initiate payment with nationality-based payment methods',
-    description: `Initiates payment for a booking with support for multiple payment providers:
 
-**Ethiopian Payment Methods:**
-- TELEBIRR - Ethiopia's leading mobile money
-- CBE_BIRR - Commercial Bank of Ethiopia
-- EBIRR - Electronic payment gateway
+  @Get("all")
+  @UseGuards(JwtGuard, RolesGuard)
+  @Roles(UserRole.ADMIN, UserRole.SUPERVISOR, UserRole.STAFF)
+  @ApiBearerAuth("JWT-auth")
+  @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" })
+  @ApiQuery({ name: "search", required: false })
+  @ApiQuery({ name: "status", required: false })
+  @ApiQuery({ name: "method", required: false })
+  @ApiQuery({ name: "page", required: false })
+  @ApiQuery({ name: "pageSize", required: false })
+  async getAll(
+    @Query("search") search?: string,
+    @Query("status") status?: string,
+    @Query("method") method?: string,
+    @Query("page") page?: string,
+    @Query("pageSize") pageSize?: string,
+  ) {
+    return this.service.getAll({
+      search,
+      status,
+      method,
+      page: page ? parseInt(page) : 1,
+      pageSize: pageSize ? parseInt(pageSize) : 10,
+    });
+  }
 
-**Djiboutian Payment Methods:**
-- WAAFI - Djibouti's mobile money service
-
-**International Payment Methods:**
-- CARD - Visa, Mastercard
-- WALLET - Internal wallet balance
-
-**Multi-Currency:**
-- All transactions processed in ETB
-- Display amounts in ETB, DJF, or USD
-- Real-time exchange rate conversion`
+  @Post("initiate")
+  @ApiOperation({
+    summary: "Initiate payment with nationality-based payment methods",
+    description: `Initiates payment for a booking with support for multiple payment providers:\n\n**Ethiopian Payment Methods:**\n- TELEBIRR - Ethiopia's leading mobile money\n- CBE_BIRR - Commercial Bank of Ethiopia\n- EBIRR - Electronic payment gateway\n\n**Djiboutian Payment Methods:**\n- WAAFI - Djibouti's mobile money service\n\n**International Payment Methods:**\n- CARD - Visa, Mastercard\n- WALLET - Internal wallet balance\n\n**Multi-Currency:**\n- All transactions processed in ETB\n- Display amounts in ETB, DJF, or USD\n- Real-time exchange rate conversion`,
   })
-  initiatePayment(@Body() dto: InitiatePaymentDto) { return this.service.initiatePayment(dto); }
-  
-  @Get('intents/:bookingId')
-  @ApiOperation({ summary: 'Get payment intent status for a booking' })
-  getIntent(@Param('bookingId') bookingId: string) { return this.service.getIntentByBookingId(bookingId); }
-  
-  @Post('refund')
+  initiatePayment(@Body() dto: InitiatePaymentDto) {
+    return this.service.initiatePayment(dto);
+  }
+
+  @Get("intents/:bookingId")
+  @ApiOperation({ summary: "Get payment intent status for a booking" })
+  getIntent(@Param("bookingId") bookingId: string) {
+    return this.service.getIntentByBookingId(bookingId);
+  }
+
+  @Get("waafi/return")
+  @ApiOperation({
+    summary:
+      "DEMO ONLY — confirm a Waafi payment from the browser-return params and return JSON for the " +
+      "UI to display. The frontend success page forwards the Waafi query params here. Gated by " +
+      "WAAFI_DEMO_TRUST_RETURN (INSECURE; real confirmation is the webhook/HPP_GETTRANINFO).",
+  })
+  @ApiQuery({ name: "referenceId", required: true })
+  @ApiQuery({ name: "state", required: true })
+  @ApiQuery({ name: "transactionId", required: false })
+  waafiReturn(
+    @Query("referenceId") referenceId: string,
+    @Query("state") state: string,
+    @Query("transactionId") transactionId: string,
+  ) {
+    return this.service.confirmWaafiReturnDemo({
+      referenceId,
+      state,
+      transactionId,
+    });
+  }
+
+  @Post("refund")
   @UseGuards(JwtGuard, RolesGuard)
   @Roles(UserRole.ADMIN, UserRole.STAFF, UserRole.AGENT)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Refund a confirmed booking (staff/agent only)' })
-  refund(@Body() dto: RefundDto) { return this.service.refund(dto); }
+  @ApiBearerAuth("JWT-auth")
+  @ApiOperation({ summary: "Refund a confirmed booking (staff/agent only)" })
+  refund(@Body() dto: RefundDto) {
+    return this.service.refund(dto);
+  }
 
-  @Post('methods')
+  @Post("methods")
   @UseGuards(JwtGuard, RolesGuard)
   @Roles(UserRole.ADMIN, UserRole.STAFF)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Add a payment system to the platform catalog (admin only)' })
-  addMethod(@Body() dto: AddPaymentMethodDto) { return this.service.addPaymentMethod(dto); }
-  
-  @Get('methods')
+  @ApiBearerAuth("JWT-auth")
   @ApiOperation({
-    summary: 'List payment systems supported by the platform',
-    description: 'Returns the global catalog of accepted payment systems. Not user-specific. Optionally filter by region to match a passenger\'s nationality.',
+    summary: "Add a payment system to the platform catalog (admin only)",
   })
-  @ApiQuery({ name: 'region', enum: PaymentRegionEnum, required: false })
-  @ApiOkResponse({ type: [SupportedPaymentMethodDto] })
-  getMethods(@Query('region') region?: PaymentRegionEnum) { return this.service.getSupportedPaymentMethods(region); }
+  addMethod(@Body() dto: AddPaymentMethodDto) {
+    return this.service.addPaymentMethod(dto);
+  }
 
-  @Get('checkout')
+  @Get("methods")
   @ApiOperation({
-    summary: 'Browser checkout redirect',
-    description: 'Initiates payment and returns an HTML page that auto-redirects the browser to the provider checkout URL. Designed to be opened directly in a browser tab.',
+    summary: "List payment systems supported by the platform",
+    description:
+      "Returns the global catalog of accepted payment systems. Not user-specific. Optionally filter by region to match a passenger's nationality.",
   })
-  @ApiQuery({ name: 'bookingId', required: true })
-  @ApiQuery({ name: 'method', enum: PaymentMethodTypeEnum, required: true })
-  @ApiQuery({ name: 'platform', enum: ['web', 'mobile'], required: false })
-  @ApiProduces('text/html')
+  @ApiQuery({ name: "region", enum: PaymentRegionEnum, required: false })
+  @ApiOkResponse({ type: [SupportedPaymentMethodDto] })
+  getMethods(@Query("region") region?: PaymentRegionEnum) {
+    return this.service.getSupportedPaymentMethods(region);
+  }
+
+  @Get("checkout")
+  @ApiOperation({
+    summary: "Browser checkout redirect",
+    description:
+      "Initiates payment and returns an HTML page that auto-redirects the browser to the provider checkout URL. Designed to be opened directly in a browser tab.",
+  })
+  @ApiQuery({ name: "bookingId", required: true })
+  @ApiQuery({ name: "method", enum: PaymentMethodTypeEnum, required: true })
+  @ApiQuery({ name: "platform", enum: ["web", "mobile"], required: false })
+  @ApiProduces("text/html")
   async checkout(
-    @Query('bookingId') bookingId: string,
-    @Query('method') method: PaymentMethodTypeEnum,
-    @Query('platform') platform: PaymentPlatformDto = 'web',
+    @Query("bookingId") bookingId: string,
+    @Query("method") method: PaymentMethodTypeEnum,
+    @Query("platform") platform: PaymentPlatformDto = "web",
     @Res() res: Response,
   ) {
     if (!bookingId) {
-      return res.status(HttpStatus.BAD_REQUEST).type('html').send(this.buildErrorHtml('Missing required query parameter: bookingId'));
+      return res
+        .status(HttpStatus.BAD_REQUEST)
+        .type("html")
+        .send(
+          this.buildErrorHtml("Missing required query parameter: bookingId"),
+        );
     }
     if (!method || !Object.values(PaymentMethodTypeEnum).includes(method)) {
-      return res.status(HttpStatus.BAD_REQUEST).type('html').send(this.buildErrorHtml('Missing or invalid query parameter: method'));
+      return res
+        .status(HttpStatus.BAD_REQUEST)
+        .type("html")
+        .send(
+          this.buildErrorHtml("Missing or invalid query parameter: method"),
+        );
     }
 
     try {
-      const result = await this.service.initiatePayment({ bookingId, method, platform });
-      const url = result.clientAction?.type === 'REDIRECT' ? result.clientAction.url : undefined;
+      const result = await this.service.initiatePayment({
+        bookingId,
+        method,
+        platform,
+      });
+      const url =
+        result.clientAction?.type === "REDIRECT"
+          ? result.clientAction.url
+          : undefined;
 
       if (url) {
-        return res.status(HttpStatus.OK).type('html').send(this.buildRedirectHtml(url));
+        return res
+          .status(HttpStatus.OK)
+          .type("html")
+          .send(this.buildRedirectHtml(url));
       }
 
-      return res.status(HttpStatus.OK).type('html').send(this.buildStatusHtml(result.status, result.intentId));
+      return res
+        .status(HttpStatus.OK)
+        .type("html")
+        .send(this.buildStatusHtml(result.status, result.intentId));
     } catch (err: unknown) {
-      const message = err instanceof Error ? err.message : 'An unexpected error occurred';
-      return res.status(HttpStatus.OK).type('html').send(this.buildErrorHtml(message));
+      const message =
+        err instanceof Error ? err.message : "An unexpected error occurred";
+      return res
+        .status(HttpStatus.OK)
+        .type("html")
+        .send(this.buildErrorHtml(message));
     }
   }
 
   private buildRedirectHtml(url: string): string {
-    const escaped = url.replace(/"/g, '"');
+    const escaped = url.replace(/\"/g, """);
     return `<!DOCTYPE html>
 <html lang="en">
 <head>

apps/edr-passenger-api/src/modules/payments/payments.dto.ts

@@ -1,36 +1,54 @@
-import { IsString, IsEnum, IsOptional, IsIn, IsBoolean, IsInt } from 'class-validator';
-import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
-import { PaymentIntentStatus } from '@prisma/client';
+import {
+  IsString,
+  IsEnum,
+  IsOptional,
+  IsIn,
+  IsBoolean,
+  IsInt,
+} from "class-validator";
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { PaymentIntentStatus } from "@prisma/client";
 
 export enum PaymentRegionEnum {
-  ETHIOPIA = 'ETHIOPIA',
-  DJIBOUTI = 'DJIBOUTI',
-  INTERNATIONAL = 'INTERNATIONAL',
-  GLOBAL = 'GLOBAL',
+  ETHIOPIA = "ETHIOPIA",
+  DJIBOUTI = "DJIBOUTI",
+  INTERNATIONAL = "INTERNATIONAL",
+  GLOBAL = "GLOBAL",
 }
 
-export enum PaymentMethodTypeEnum { 
-  TELEBIRR = 'TELEBIRR',  // Ethiopia
-  CBE_BIRR = 'CBE_BIRR',  // Ethiopia
-  EBIRR = 'EBIRR',        // Ethiopia
-  WAAFI = 'WAAFI',        // Djibouti
-  CARD = 'CARD',          // International
-  WALLET = 'WALLET'       // Internal
+export enum PaymentMethodTypeEnum {
+  TELEBIRR = "TELEBIRR", // Ethiopia
+  CBE_BIRR = "CBE_BIRR", // Ethiopia
+  EBIRR = "EBIRR", // Ethiopia
+  WAAFI = "WAAFI",
+  DMONEY= "DMONEY",// Djibouti
+  CARD = "CARD", // International
+  WALLET = "WALLET", // Internal
 }
 
-export type PaymentPlatformDto = 'web' | 'mobile';
+export type PaymentPlatformDto = "web" | "mobile";
 
 export class InitiatePaymentDto {
-  @ApiProperty({ example: 'booking-uuid' }) @IsString() bookingId: string;
+  @ApiProperty({ example: "booking-uuid" }) @IsString() bookingId: string;
   @ApiProperty({
     enum: PaymentMethodTypeEnum,
-    description: 'Payment method: TELEBIRR/CBE_BIRR/EBIRR (Ethiopia), WAAFI (Djibouti), CARD (International), WALLET (Internal)',
-    example: 'TELEBIRR'
-  }) @IsEnum(PaymentMethodTypeEnum) method: PaymentMethodTypeEnum;
-  @ApiPropertyOptional({ description: 'Saved payment method ID (optional)' }) @IsOptional() @IsString() paymentMethodId?: string;
-  @ApiPropertyOptional({ enum: ['web', 'mobile'], default: 'web', description: 'Payment platform (web or mobile)' })
+    description:
+      "Payment method: TELEBIRR/CBE_BIRR/EBIRR (Ethiopia), WAAFI (Djibouti), CARD (International), WALLET (Internal)",
+    example: "TELEBIRR",
+  })
+  @IsEnum(PaymentMethodTypeEnum)
+  method: PaymentMethodTypeEnum;
+  @ApiPropertyOptional({ description: "Saved payment method ID (optional)" })
   @IsOptional()
-  @IsIn(['web', 'mobile'])
+  @IsString()
+  paymentMethodId?: string;
+  @ApiPropertyOptional({
+    enum: ["web", "mobile"],
+    default: "web",
+    description: "Payment platform (web or mobile)",
+  })
+  @IsOptional()
+  @IsIn(["web", "mobile"])
   platform?: PaymentPlatformDto;
 }
 
@@ -40,42 +58,79 @@ export class RefundDto {
 }
 
 export class AddPaymentMethodDto {
-  @ApiProperty({ enum: PaymentMethodTypeEnum }) @IsEnum(PaymentMethodTypeEnum) type: PaymentMethodTypeEnum;
+  @ApiProperty({ enum: PaymentMethodTypeEnum })
+  @IsEnum(PaymentMethodTypeEnum)
+  type: PaymentMethodTypeEnum;
   @ApiProperty() @IsString() displayName: string;
-  @ApiProperty({ enum: PaymentRegionEnum }) @IsEnum(PaymentRegionEnum) region: PaymentRegionEnum;
-  @ApiPropertyOptional({ example: 'ETB' }) @IsOptional() @IsString() currency?: string;
+  @ApiProperty({ enum: PaymentRegionEnum })
+  @IsEnum(PaymentRegionEnum)
+  region: PaymentRegionEnum;
+  @ApiPropertyOptional({ example: "ETB" })
+  @IsOptional()
+  @IsString()
+  currency?: string;
   @ApiPropertyOptional() @IsOptional() @IsString() providerId?: string;
-  @ApiPropertyOptional({ default: true }) @IsOptional() @IsBoolean() enabled?: boolean;
-  @ApiPropertyOptional({ default: 0 }) @IsOptional() @IsInt() sortOrder?: number;
+  @ApiPropertyOptional({ default: true })
+  @IsOptional()
+  @IsBoolean()
+  enabled?: boolean;
+  @ApiPropertyOptional({ default: 0 })
+  @IsOptional()
+  @IsInt()
+  sortOrder?: number;
 }
 
 export class SupportedPaymentMethodDto {
   @ApiProperty({ enum: PaymentMethodTypeEnum }) type: PaymentMethodTypeEnum;
-  @ApiProperty({ example: 'Telebirr' }) displayName: string;
+  @ApiProperty({ example: "Telebirr" }) displayName: string;
   @ApiProperty({ enum: PaymentRegionEnum }) region: PaymentRegionEnum;
-  @ApiProperty({ example: 'ETB', description: 'Settlement currency for this method' }) currency: string;
-  @ApiProperty({ description: 'Whether the platform currently accepts this method' }) enabled: boolean;
+  @ApiProperty({
+    example: "ETB",
+    description: "Settlement currency for this method",
+  })
+  currency: string;
+  @ApiProperty({
+    description: "Whether the platform currently accepts this method",
+  })
+  enabled: boolean;
 }
 
 export class ClientActionDto {
-  @ApiProperty({ enum: ['REDIRECT', 'LAUNCH_APP'] }) type: 'REDIRECT' | 'LAUNCH_APP';
-  @ApiPropertyOptional({ description: 'Set when type=REDIRECT (web flow)' }) url?: string;
-  @ApiPropertyOptional({ description: 'Set when type=LAUNCH_APP (mobile flow)' }) prepayId?: string;
-  @ApiPropertyOptional({ description: 'Set when type=LAUNCH_APP (mobile flow)' }) receiveCode?: string;
-  @ApiPropertyOptional({ description: 'Set when type=LAUNCH_APP (mobile flow)' }) shortCode?: string;
+  @ApiProperty({ enum: ["REDIRECT", "LAUNCH_APP", "COLLECT_OTP"] })
+  type: "REDIRECT" | "LAUNCH_APP" | "COLLECT_OTP";
+  @ApiPropertyOptional({ description: "Set when type=REDIRECT (web flow)" })
+  url?: string;
+  @ApiPropertyOptional({
+    description: "Set when type=LAUNCH_APP (mobile flow)",
+  })
+  prepayId?: string;
+  @ApiPropertyOptional({
+    description: "Set when type=LAUNCH_APP (mobile flow)",
+  })
+  receiveCode?: string;
+  @ApiPropertyOptional({
+    description: "Set when type=LAUNCH_APP (mobile flow)",
+  })
+  shortCode?: string;
+  @ApiPropertyOptional({ description: "Set when type=COLLECT_OTP (e.g. CAC Bank)" })
+  providerOrderId?: string;
+  @ApiPropertyOptional({ description: "Set when type=COLLECT_OTP" })
+  message?: string;
 }
 
 export class InitiateResponseDto {
   @ApiProperty() intentId: string;
   @ApiProperty({ enum: PaymentIntentStatus }) status: PaymentIntentStatus;
-  @ApiPropertyOptional({ type: ClientActionDto }) clientAction?: ClientActionDto;
+  @ApiPropertyOptional({ type: ClientActionDto })
+  clientAction?: ClientActionDto;
   @ApiPropertyOptional() merchantOrderId?: string;
 }
 
 export class IntentStatusDto {
   @ApiProperty() intentId: string;
   @ApiProperty({ enum: PaymentIntentStatus }) status: PaymentIntentStatus;
-  @ApiPropertyOptional({ type: ClientActionDto }) clientAction?: ClientActionDto;
+  @ApiPropertyOptional({ type: ClientActionDto })
+  clientAction?: ClientActionDto;
   @ApiPropertyOptional() merchantOrderId?: string;
   @ApiPropertyOptional() paidAt?: string;
   @ApiPropertyOptional() failureCode?: string;

apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts

@@ -1,10 +1,10 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { INestApplication, ValidationPipe } from '@nestjs/common';
-import request from 'supertest';
-import { AppModule } from '../../app.module';
-import { PrismaService } from '../../common/prisma.service';
+import { Test, TestingModule } from "@nestjs/testing";
+import { INestApplication, ValidationPipe } from "@nestjs/common";
+import request from "supertest";
+import { AppModule } from "../../app.module";
+import { PrismaService } from "../../common/prisma.service";
 
-describe('Payments E2E', () => {
+describe("Payments E2E", () => {
   let app: INestApplication;
   let prisma: PrismaService;
   let authToken: string;
@@ -16,45 +16,111 @@ describe('Payments E2E', () => {
     }).compile();
 
     app = moduleFixture.createNestApplication();
-    app.useGlobalPipes(new ValidationPipe({ transform: true, whitelist: true }));
+    app.useGlobalPipes(
+      new ValidationPipe({ transform: true, whitelist: true }),
+    );
     await app.init();
 
     prisma = app.get<PrismaService>(PrismaService);
 
     const passenger = await prisma.passenger.create({ data: { iamUserId: 'test-iam-payments-user' } });
 
-    await prisma.walletAccount.create({ data: { passengerId: passenger.id, balanceMinor: 100000, currency: 'ETB' } });
-
-    authToken = 'mock-jwt-token';
-
-    const station1 = await prisma.station.create({ data: { code: 'TST1', name: 'Test Station 1', city: 'Test City', lat: 9.0, lng: 38.0 } });
-    const station2 = await prisma.station.create({ data: { code: 'TST2', name: 'Test Station 2', city: 'Test City 2', lat: 9.5, lng: 38.5 } });
-
-    const train = await prisma.train.create({ data: { number: 'TEST-001', name: 'Test Train' } });
-
-    const schedule = await prisma.trainSchedule.create({
-      data: { trainId: train.id, originStationId: station1.id, destinationStationId: station2.id, departureAt: new Date(Date.now() + 86400000), arrivalAt: new Date(Date.now() + 90000000), durationMinutes: 60 },
+    await prisma.walletAccount.create({
+      data: {
+        passengerId: passenger.id,
+        balanceMinor: 100000,
+        currency: "ETB",
+      },
     });
 
-    const seatClass = await prisma.seatClass.upsert({
-      where: { name: 'Economy Regular' },
-      update: {},
-      create: { name: 'Economy Regular', description: 'Standard economy seating', basePrice: 45000, isActive: true },
+    authToken = "mock-jwt-token";
+
+    const station1 = await prisma.station.create({
+      data: {
+        code: "TST1",
+        name: "Test Station 1",
+        city: "Test City",
+        lat: 9.0,
+        lng: 38.0,
+      },
+    });
+    const station2 = await prisma.station.create({
+      data: {
+        code: "TST2",
+        name: "Test Station 2",
+        city: "Test City 2",
+        lat: 9.5,
+        lng: 38.5,
+      },
+    });
+
+    const train = await prisma.train.create({
+      data: { number: "TEST-001", name: "Test Train" },
+    });
+
+    const schedule = await prisma.trainSchedule.create({
+      data: {
+        trainId: train.id,
+        originStationId: station1.id,
+        destinationStationId: station2.id,
+        departureAt: new Date(Date.now() + 86400000),
+        arrivalAt: new Date(Date.now() + 90000000),
+        durationMinutes: 60,
+      },
+    });
+
+    const coachType = await prisma.coachType.create({
+      data: { name: "Standard", code: "STD" },
+    });
+
+    const seatClass = await prisma.seatClass.create({
+      data: {
+        name: "Economy Regular",
+        description: "Standard economy seating",
+        baseFareMinor: 45000,
+        isActive: true,
+        coachTypeId: coachType.id,
+      },
     });
 
     const coach = await prisma.coach.create({
-      data: { coachNumber: 'TEST-C1', label: 'A', seatClassId: seatClass.id, mode: 'seat', totalUnits: 10 },
+      data: {
+        coachTypeId: coachType.id,
+        number: "TEST-C1",
+        arrangement: "2+2",
+        capacity: 10,
+        status: "ACTIVE",
+      },
     });
 
-    await prisma.coachAssignment.create({ data: { scheduleId: schedule.id, coachId: coach.id, positionNumber: 1 } });
-
-    const seat = await prisma.seat.create({ data: { coachId: coach.id, row: 1, col: 'A', label: '1A', status: 'AVAILABLE' } });
+    const seat = await prisma.seat.create({
+      data: {
+        coachId: coach.id,
+        row: 1,
+        col: "A",
+        seatNumber: "1A",
+        status: "AVAILABLE",
+      },
+    });
 
     const booking = await prisma.booking.create({
-      data: { bookingRef: 'TEST-BOOK-001', passengerId: passenger.id, scheduleId: schedule.id, status: 'PENDING_PAYMENT', totalMinor: 50000, currency: 'ETB' },
+      data: {
+        bookingRef: "TEST-BOOK-001",
+        passengerId: passenger.id,
+        scheduleId: schedule.id,
+        status: "PENDING_PAYMENT",
+        totalMinor: 50000,
+        currency: "ETB",
+      },
     });
 
-    await prisma.bookingSeat.create({ data: { bookingId: booking.id, seatId: seat.id, passengerName: 'Test Passenger' } });
+    await prisma.bookingSeat.create({
+      data: {
+        bookingId: booking.id,
+        seatId: seat.id,
+        passengerName: "Test Passenger",
+      },
+    });
 
     bookingId = booking.id;
   });
@@ -69,7 +135,7 @@ describe('Payments E2E', () => {
       prisma.coach.deleteMany(),
       prisma.trainSchedule.deleteMany(),
       prisma.train.deleteMany(),
-      prisma.station.deleteMany({ where: { code: { in: ['TST1', 'TST2'] } } }),
+      prisma.station.deleteMany({ where: { code: { in: ["TST1", "TST2"] } } }),
       prisma.walletLedgerEntry.deleteMany(),
       prisma.walletAccount.deleteMany(),
       prisma.passenger.deleteMany(),
@@ -77,80 +143,51 @@ describe('Payments E2E', () => {
     await app.close();
   });
 
-  describe('POST /payments/initiate', () => {
-    it('should initiate wallet payment successfully', async () => {
+  describe("POST /payments/initiate", () => {
+    it("should initiate wallet payment successfully", async () => {
       const response = await request(app.getHttpServer())
-        .post('/payments/initiate')
-        .set('Authorization', `Bearer ${authToken}`)
-        .send({ bookingId, method: 'WALLET' })
+        .post("/payments/initiate")
+        .set("Authorization", `Bearer ${authToken}`)
+        .send({ bookingId, method: "WALLET" })
         .expect(201);
       expect(response.body.intentId).toBeDefined();
-      expect(response.body.status).toBe('SUCCEEDED');
+      expect(response.body.status).toBe("SUCCEEDED");
     });
 
-    it('should return 400 for invalid payment method', async () => {
+    it("should return 400 for invalid payment method", async () => {
       await request(app.getHttpServer())
-        .post('/payments/initiate')
-        .set('Authorization', `Bearer ${authToken}`)
-        .send({ bookingId, method: 'INVALID_METHOD' })
+        .post("/payments/initiate")
+        .set("Authorization", `Bearer ${authToken}`)
+        .send({ bookingId, method: "INVALID_METHOD" })
         .expect(400);
     });
 
-    it('should return 404 for non-existent booking', async () => {
+    it("should return 404 for non-existent booking", async () => {
       await request(app.getHttpServer())
-        .post('/payments/initiate')
-        .set('Authorization', `Bearer ${authToken}`)
-        .send({ bookingId: 'non-existent-id', method: 'WALLET' })
+        .post("/payments/initiate")
+        .set("Authorization", `Bearer ${authToken}`)
+        .send({ bookingId: "non-existent-id", method: "WALLET" })
         .expect(404);
     });
   });
 
-  describe('GET /payments/intents/:bookingId', () => {
-    it('should get payment intent status', async () => {
+  describe("GET /payments/intents/:bookingId", () => {
+    it("should get payment intent status", async () => {
       const response = await request(app.getHttpServer())
         .get(`/payments/intents/${bookingId}`)
-        .set('Authorization', `Bearer ${authToken}`)
+        .set("Authorization", `Bearer ${authToken}`)
         .expect(200);
       expect(response.body.intentId).toBeDefined();
       expect(response.body.status).toBeDefined();
     });
 
-    it('should return 404 for non-existent intent', async () => {
+    it("should return 404 for non-existent intent", async () => {
       await request(app.getHttpServer())
-        .get('/payments/intents/non-existent-booking')
-        .set('Authorization', `Bearer ${authToken}`)
+        .get("/payments/intents/non-existent-booking")
+        .set("Authorization", `Bearer ${authToken}`)
         .expect(404);
     });
   });
 
-  describe('Webhook endpoints', () => {
-    it('should handle Telebirr webhook', async () => {
-      await request(app.getHttpServer())
-        .post('/payments/webhooks/telebirr')
-        .send({ merch_order_id: 'TEST-ORDER-123', payment_order_id: 'PAY-123', trade_status: 'Completed', sign: 'mock-signature' })
-        .expect(200);
-    });
-
-    it('should handle CBE Birr webhook', async () => {
-      await request(app.getHttpServer())
-        .post('/payments/webhooks/cbe-birr')
-        .send({ merchantId: 'TEST-MERCHANT', merchantOrderId: 'TEST-ORDER-123', orderId: 'CBE-ORDER-123', status: 'SUCCESS', signature: 'mock-signature' })
-        .expect(200);
-    });
-
-    it('should handle eBirr webhook', async () => {
-      await request(app.getHttpServer())
-        .post('/payments/webhooks/ebirr')
-        .send({ merchantCode: 'TEST-MERCHANT', orderNo: 'TEST-ORDER-123', tradeStatus: 'TRADE_SUCCESS', timestamp: Date.now(), sign: 'mock-signature' })
-        .expect(200);
-    });
-
-    it('should handle Card webhook', async () => {
-      await request(app.getHttpServer())
-        .post('/payments/webhooks/card')
-        .set('stripe-signature', 'mock-signature')
-        .send({ id: 'evt_123', type: 'payment_intent.succeeded', data: { object: { id: 'pi_123', status: 'succeeded', amount: 50000, currency: 'ETB', metadata: { merchantOrderId: 'TEST-ORDER-123', bookingRef: 'TEST-BOOK-001' } } }, created: Math.floor(Date.now() / 1000) })
-        .expect(200);
-    });
-  });
+  // Provider webhooks moved to the payment microservice (apps/edr-payment-api /webhooks/*).
 });

apps/edr-passenger-api/src/modules/payments/payments.module.ts

@@ -1,36 +1,65 @@
-import { Module } from '@nestjs/common';
-import { HttpModule } from '@nestjs/axios';
-import { PaymentsController } from './payments.controller';
-import { PaymentsService } from './payments.service';
-import { SeatsModule } from '../seats/seats.module';
-import { TicketsModule } from '../tickets/tickets.module';
-import { TelebirrProvider } from './providers/telebirr.provider';
-import { CbeBirrProvider } from './providers/cbe-birr.provider';
-import { EBirrProvider } from './providers/ebirr.provider';
-import { CardProvider } from './providers/card.provider';
-import { WaafiProvider } from './providers/waafi.provider';
-import { WebhooksController } from './webhooks/webhooks.controller';
-import { TelebirrWebhookService } from './webhooks/telebirr-webhook.service';
-import { CbeBirrWebhookService } from './webhooks/cbe-birr-webhook.service';
-import { EBirrWebhookService } from './webhooks/ebirr-webhook.service';
-import { CardWebhookService } from './webhooks/card-webhook.service';
-import { WaafiWebhookService } from './webhooks/waafi-webhook.service';
+import { Module } from "@nestjs/common";
+import { HttpModule } from "@nestjs/axios";
+import { ConfigService } from "@nestjs/config";
+import { RabbitMQModule } from "@golevelup/nestjs-rabbitmq";
+import { DynamicModule } from "@nestjs/common";
+import {
+  PAYMENT_EVENTS_DLX,
+  PAYMENT_EVENTS_EXCHANGE,
+  PAYMENT_QUEUES,
+  PaymentService,
+  paymentServiceBindingPattern,
+} from "@edr/types";
+import { PaymentsController } from "./payments.controller";
+import { PaymentsService } from "./payments.service";
+import { InternalPaymentsController } from "./internal-payments.controller";
+import { PaymentClientService } from "./payment-client.service";
+import { PaymentEventsConsumer } from "./payment-events.consumer";
+import { ServiceAuthGuard } from "../../common/guards/service-auth.guard";
+import { SeatsModule } from "../seats/seats.module";
+import { TicketsModule } from "../tickets/tickets.module";
+
+const PASSENGER_QUEUE = PAYMENT_QUEUES[PaymentService.PASSENGER];
+
+function rabbitMQImport(): DynamicModule[] {
+  if (!process.env.PAYMENT_RABBITMQ_URL) return [];
+  return [
+    RabbitMQModule.forRootAsync({
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => ({
+        uri: config.get<string>("rabbitmq.url") as string,
+        exchanges: [
+          { name: PAYMENT_EVENTS_EXCHANGE, type: "topic", options: { durable: true } },
+          { name: PAYMENT_EVENTS_DLX, type: "topic", options: { durable: true } },
+        ],
+        queues: [
+          {
+            name: PASSENGER_QUEUE.dlq,
+            exchange: PAYMENT_EVENTS_DLX,
+            routingKey: paymentServiceBindingPattern(PaymentService.PASSENGER),
+            options: { durable: true },
+          },
+        ],
+        prefetchCount: config.get<number>("rabbitmq.prefetch") ?? 10,
+        connectionInitOptions: { wait: false },
+      }),
+    }),
+  ];
+}
 
 @Module({
-  imports: [SeatsModule, TicketsModule, HttpModule.register({ timeout: 10_000 })],
-  controllers: [PaymentsController, WebhooksController],
+  imports: [
+    SeatsModule,
+    TicketsModule,
+    HttpModule.register({ timeout: 10_000 }),
+    ...rabbitMQImport(),
+  ],
+  controllers: [PaymentsController, InternalPaymentsController],
   providers: [
     PaymentsService,
-    TelebirrProvider,
-    CbeBirrProvider,
-    EBirrProvider,
-    CardProvider,
-    WaafiProvider,
-    TelebirrWebhookService,
-    CbeBirrWebhookService,
-    EBirrWebhookService,
-    CardWebhookService,
-    WaafiWebhookService,
+    PaymentClientService,
+    PaymentEventsConsumer,
+    ServiceAuthGuard,
   ],
 })
 export class PaymentsModule {}

apps/edr-passenger-api/src/modules/payments/payments.service.spec.ts

@@ -1,17 +1,21 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { PaymentsService } from './payments.service';
-import { PrismaService } from '../../common/prisma.service';
-import { SeatsService } from '../seats/seats.service';
-import { TicketsService } from '../tickets/tickets.service';
-import { EventEmitter2 } from '@nestjs/event-emitter';
-import { TelebirrProvider } from './providers/telebirr.provider';
-import { CbeBirrProvider } from './providers/cbe-birr.provider';
-import { EBirrProvider } from './providers/ebirr.provider';
-import { CardProvider } from './providers/card.provider';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { BadRequestException, NotFoundException } from '@nestjs/common';
+import { Test, TestingModule } from "@nestjs/testing";
+import { PaymentsService } from "./payments.service";
+import { PaymentClientService } from "./payment-client.service";
+import { PrismaService } from "../../common/prisma.service";
+import { SeatsService } from "../seats/seats.service";
+import { TicketsService } from "../tickets/tickets.service";
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import { PaymentIntentStatus, PaymentMethodType } from "@prisma/client";
+import { BadRequestException, NotFoundException } from "@nestjs/common";
+import {
+  PaymentIntentSnapshot,
+  PaymentReferenceType,
+  PaymentService as PaymentServiceEnum,
+  ProviderMethod,
+  ProviderPaymentStatus,
+} from "@edr/types";
 
-describe('PaymentsService', () => {
+describe("PaymentsService", () => {
   let service: PaymentsService;
   let prisma: PrismaService;
   let seatsService: SeatsService;
@@ -60,29 +64,25 @@ describe('PaymentsService', () => {
     emit: jest.fn(),
   };
 
-  const mockTelebirrProvider = {
-    method: PaymentMethodType.TELEBIRR,
+  const mockPaymentClient = {
     initiate: jest.fn(),
-    queryStatus: jest.fn(),
+    getIntentByReference: jest.fn(),
   };
 
-  const mockCbeBirrProvider = {
-    method: PaymentMethodType.CBE_BIRR,
-    initiate: jest.fn(),
-    queryStatus: jest.fn(),
-  };
-
-  const mockEBirrProvider = {
-    method: PaymentMethodType.EBIRR,
-    initiate: jest.fn(),
-    queryStatus: jest.fn(),
-  };
-
-  const mockCardProvider = {
-    method: PaymentMethodType.CARD,
-    initiate: jest.fn(),
-    queryStatus: jest.fn(),
-  };
+  const requiresActionSnapshot = (
+    provider: ProviderMethod,
+  ): PaymentIntentSnapshot => ({
+    intentId: "remote-intent-1",
+    service: PaymentServiceEnum.PASSENGER,
+    referenceType: PaymentReferenceType.BOOKING,
+    referenceId: "booking-1",
+    merchantOrderId: "PSG-MERCH-123",
+    provider,
+    status: ProviderPaymentStatus.REQUIRES_ACTION,
+    amountMinor: 50000,
+    currency: "ETB",
+    clientAction: { type: "REDIRECT", url: "https://provider.example/pay" },
+  });
 
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
@@ -92,10 +92,7 @@ describe('PaymentsService', () => {
         { provide: SeatsService, useValue: mockSeatsService },
         { provide: TicketsService, useValue: mockTicketsService },
         { provide: EventEmitter2, useValue: mockEventEmitter },
-        { provide: TelebirrProvider, useValue: mockTelebirrProvider },
-        { provide: CbeBirrProvider, useValue: mockCbeBirrProvider },
-        { provide: EBirrProvider, useValue: mockEBirrProvider },
-        { provide: CardProvider, useValue: mockCardProvider },
+        { provide: PaymentClientService, useValue: mockPaymentClient },
       ],
     }).compile();
 
@@ -106,221 +103,276 @@ describe('PaymentsService', () => {
     eventEmitter = module.get<EventEmitter2>(EventEmitter2);
 
     jest.clearAllMocks();
+    mockPaymentClient.getIntentByReference.mockResolvedValue(null);
   });
 
-  describe('initiatePayment', () => {
+  describe("initiatePayment", () => {
     const mockBooking = {
-      id: 'booking-1',
-      bookingRef: 'EDR123456',
-      passengerId: 'passenger-1',
+      id: "booking-1",
+      bookingRef: "EDR123456",
+      passengerId: "passenger-1",
       totalMinor: 50000,
-      currency: 'ETB',
-      status: 'PENDING_PAYMENT',
-      seats: [{ id: 'seat-1', seatId: 'seat-id-1' }],
+      currency: "ETB",
+      status: "PENDING_PAYMENT",
+      seats: [{ id: "seat-1", seatId: "seat-id-1" }],
     };
 
-    it('should throw NotFoundException if booking not found', async () => {
+    it("should throw NotFoundException if booking not found", async () => {
       mockPrisma.booking.findUnique.mockResolvedValue(null);
 
       await expect(
         service.initiatePayment({
-          bookingId: 'invalid',
-          method: 'TELEBIRR' as any,
+          bookingId: "invalid",
+          method: "TELEBIRR" as any,
         }),
       ).rejects.toThrow(NotFoundException);
     });
 
-    it('should throw BadRequestException if booking not payable', async () => {
+    it("should throw BadRequestException if booking not payable", async () => {
       mockPrisma.booking.findUnique.mockResolvedValue({
         ...mockBooking,
-        status: 'CONFIRMED',
+        status: "CONFIRMED",
       });
 
       await expect(
         service.initiatePayment({
-          bookingId: 'booking-1',
-          method: 'TELEBIRR' as any,
+          bookingId: "booking-1",
+          method: "TELEBIRR" as any,
         }),
       ).rejects.toThrow(BadRequestException);
     });
 
-    it('should initiate Telebirr payment successfully', async () => {
+    it("should initiate a provider payment through the payment microservice", async () => {
       mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
-      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
-      mockTelebirrProvider.initiate.mockResolvedValue({
-        providerOrderId: 'TB-ORDER-123',
-        clientAction: { type: 'REDIRECT', url: 'https://telebirr.com/pay' },
-        expiresAt: new Date(),
-        rawInitiation: {},
-      });
+      mockPaymentClient.initiate.mockResolvedValue(
+        requiresActionSnapshot(ProviderMethod.TELEBIRR),
+      );
       mockPrisma.paymentIntent.upsert.mockResolvedValue({
-        id: 'intent-1',
+        id: "intent-1",
         status: PaymentIntentStatus.REQUIRES_ACTION,
-        merchantOrderId: 'MERCH-123',
-        clientAction: { type: 'REDIRECT', url: 'https://telebirr.com/pay' },
+        merchantOrderId: "PSG-MERCH-123",
+        clientAction: { type: "REDIRECT", url: "https://provider.example/pay" },
       });
 
       const result = await service.initiatePayment({
-        bookingId: 'booking-1',
-        method: 'TELEBIRR' as any,
+        bookingId: "booking-1",
+        method: "TELEBIRR" as any,
       });
 
       expect(result.status).toBe(PaymentIntentStatus.REQUIRES_ACTION);
-      expect(mockTelebirrProvider.initiate).toHaveBeenCalled();
+      expect(result.clientAction?.url).toBe("https://provider.example/pay");
+      expect(mockPaymentClient.initiate).toHaveBeenCalledWith(
+        expect.objectContaining({
+          service: PaymentServiceEnum.PASSENGER,
+          referenceType: PaymentReferenceType.BOOKING,
+          referenceId: "booking-1",
+          orderRef: "EDR123456",
+          amountMinor: 50000,
+          currency: "ETB",
+          provider: "TELEBIRR",
+        }),
+      );
+      // Snapshot mirrored into the local projection.
+      expect(mockPrisma.paymentIntent.upsert).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { bookingId: "booking-1" } }),
+      );
     });
 
-    it('should initiate CBE Birr payment successfully', async () => {
+    it("should finalize the booking when the service reports an already-paid intent", async () => {
       mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
-      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
-      mockCbeBirrProvider.initiate.mockResolvedValue({
-        providerOrderId: 'CBE-ORDER-123',
-        clientAction: { type: 'REDIRECT', url: 'https://cbe.com/pay' },
-        expiresAt: new Date(),
-        rawInitiation: {},
+      mockPaymentClient.initiate.mockResolvedValue({
+        ...requiresActionSnapshot(ProviderMethod.WAAFI),
+        status: ProviderPaymentStatus.SUCCEEDED,
+        providerTxnId: "TXN-1",
+        paidAt: new Date().toISOString(),
       });
+      // Projection clamps SUCCEEDED to PROCESSING; finalizePaymentSuccess flips it.
       mockPrisma.paymentIntent.upsert.mockResolvedValue({
-        id: 'intent-1',
-        status: PaymentIntentStatus.REQUIRES_ACTION,
-        merchantOrderId: 'MERCH-123',
-        clientAction: { type: 'REDIRECT', url: 'https://cbe.com/pay' },
+        id: "intent-1",
+        bookingId: "booking-1",
+        status: PaymentIntentStatus.PROCESSING,
       });
-
-      const result = await service.initiatePayment({
-        bookingId: 'booking-1',
-        method: 'CBE_BIRR' as any,
-      });
-
-      expect(result.status).toBe(PaymentIntentStatus.REQUIRES_ACTION);
-      expect(mockCbeBirrProvider.initiate).toHaveBeenCalled();
-    });
-
-    it('should initiate wallet payment and debit successfully', async () => {
-      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
-      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
-      mockPrisma.walletAccount.findUnique.mockResolvedValue({
-        id: 'wallet-1',
-        passengerId: 'passenger-1',
-        balanceMinor: 100000,
-      });
-      mockPrisma.paymentIntent.upsert.mockResolvedValue({
-        id: 'intent-1',
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue({
+        id: "intent-1",
+        bookingId: "booking-1",
         status: PaymentIntentStatus.PROCESSING,
       });
       mockPrisma.paymentIntent.findUniqueOrThrow.mockResolvedValue({
-        id: 'intent-1',
+        id: "intent-1",
         status: PaymentIntentStatus.SUCCEEDED,
-        bookingId: 'booking-1',
+        merchantOrderId: "PSG-MERCH-123",
+      });
+      mockPrisma.loyaltyAccount.findUnique.mockResolvedValue(null);
+
+      const result = await service.initiatePayment({
+        bookingId: "booking-1",
+        method: "WAAFI" as any,
+      });
+
+      expect(result.status).toBe(PaymentIntentStatus.SUCCEEDED);
+      expect(mockTicketsService.generate).toHaveBeenCalledWith("booking-1");
+    });
+
+    it("should initiate wallet payment and debit successfully", async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
+      // First call: existing-intent check (none); second call: finalize loads the new intent.
+      mockPrisma.paymentIntent.findUnique
+        .mockResolvedValueOnce(null)
+        .mockResolvedValue({
+          id: "intent-1",
+          bookingId: "booking-1",
+          status: PaymentIntentStatus.PROCESSING,
+        });
+      mockPrisma.walletAccount.findUnique.mockResolvedValue({
+        id: "wallet-1",
+        passengerId: "passenger-1",
+        balanceMinor: 100000,
+      });
+      mockPrisma.paymentIntent.upsert.mockResolvedValue({
+        id: "intent-1",
+        status: PaymentIntentStatus.PROCESSING,
+      });
+      mockPrisma.paymentIntent.findUniqueOrThrow.mockResolvedValue({
+        id: "intent-1",
+        status: PaymentIntentStatus.SUCCEEDED,
+        bookingId: "booking-1",
       });
       mockPrisma.loyaltyAccount.findUnique.mockResolvedValue({
-        id: 'loyalty-1',
+        id: "loyalty-1",
         pointsBalance: 100,
       });
 
       const result = await service.initiatePayment({
-        bookingId: 'booking-1',
-        method: 'WALLET' as any,
+        bookingId: "booking-1",
+        method: "WALLET" as any,
       });
 
       expect(result.status).toBe(PaymentIntentStatus.SUCCEEDED);
       expect(mockSeatsService.confirmSeats).toHaveBeenCalled();
       expect(mockTicketsService.generate).toHaveBeenCalled();
+      expect(mockPaymentClient.initiate).not.toHaveBeenCalled();
     });
 
-    it('should fail wallet payment with insufficient balance', async () => {
+    it("should fail wallet payment with insufficient balance", async () => {
       mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
       mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
       mockPrisma.walletAccount.findUnique.mockResolvedValue({
-        id: 'wallet-1',
-        passengerId: 'passenger-1',
+        id: "wallet-1",
+        passengerId: "passenger-1",
         balanceMinor: 10000, // Less than booking total
       });
       mockPrisma.paymentIntent.upsert.mockResolvedValue({
-        id: 'intent-1',
+        id: "intent-1",
         status: PaymentIntentStatus.FAILED,
-        failureCode: 'INSUFFICIENT_BALANCE',
+        failureCode: "INSUFFICIENT_BALANCE",
       });
 
       const result = await service.initiatePayment({
-        bookingId: 'booking-1',
-        method: 'WALLET' as any,
+        bookingId: "booking-1",
+        method: "WALLET" as any,
       });
 
       expect(result.status).toBe(PaymentIntentStatus.FAILED);
     });
   });
 
-  describe('finalizePaymentSuccess', () => {
-    it('should finalize payment and issue ticket', async () => {
+  describe("finalizePaymentSuccess", () => {
+    it("should finalize payment and issue ticket", async () => {
       const mockIntent = {
-        id: 'intent-1',
-        bookingId: 'booking-1',
+        id: "intent-1",
+        bookingId: "booking-1",
         status: PaymentIntentStatus.PROCESSING,
       };
       const mockBooking = {
-        id: 'booking-1',
-        passengerId: 'passenger-1',
+        id: "booking-1",
+        passengerId: "passenger-1",
         totalMinor: 50000,
-        seats: [{ seatId: 'seat-1' }],
+        seats: [{ seatId: "seat-1" }],
       };
 
       mockPrisma.paymentIntent.findUnique.mockResolvedValue(mockIntent);
       mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
       mockPrisma.loyaltyAccount.findUnique.mockResolvedValue({
-        id: 'loyalty-1',
+        id: "loyalty-1",
         pointsBalance: 100,
       });
 
       const result = await service.finalizePaymentSuccess({
-        intentId: 'intent-1',
-        providerTxnId: 'TXN-123',
+        intentId: "intent-1",
+        providerTxnId: "TXN-123",
       });
 
       expect(result.alreadyFinalized).toBe(false);
-      expect(mockSeatsService.confirmSeats).toHaveBeenCalledWith(['seat-1']);
-      expect(mockTicketsService.generate).toHaveBeenCalledWith('booking-1');
-      expect(mockEventEmitter.emit).toHaveBeenCalledWith('payment.succeeded', {
+      expect(mockSeatsService.confirmSeats).toHaveBeenCalledWith(["seat-1"]);
+      expect(mockTicketsService.generate).toHaveBeenCalledWith("booking-1");
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith("payment.succeeded", {
         booking: mockBooking,
       });
     });
 
-    it('should return alreadyFinalized if payment already succeeded', async () => {
+    it("should return alreadyFinalized if payment already succeeded", async () => {
       mockPrisma.paymentIntent.findUnique.mockResolvedValue({
-        id: 'intent-1',
+        id: "intent-1",
         status: PaymentIntentStatus.SUCCEEDED,
       });
 
       const result = await service.finalizePaymentSuccess({
-        intentId: 'intent-1',
+        intentId: "intent-1",
       });
 
       expect(result.alreadyFinalized).toBe(true);
     });
   });
 
-  describe('getIntentByBookingId', () => {
-    it('should return intent status', async () => {
+  describe("getIntentByBookingId", () => {
+    it("should return the cached local intent when the payment service has none", async () => {
       const mockIntent = {
-        id: 'intent-1',
-        bookingId: 'booking-1',
+        id: "intent-1",
+        bookingId: "booking-1",
         status: PaymentIntentStatus.SUCCEEDED,
         method: PaymentMethodType.TELEBIRR,
         paidAt: new Date(),
-        merchantOrderId: 'MERCH-123',
+        merchantOrderId: "MERCH-123",
         updatedAt: new Date(),
       };
 
       mockPrisma.paymentIntent.findUnique.mockResolvedValue(mockIntent);
+      mockPaymentClient.getIntentByReference.mockResolvedValue(null);
 
-      const result = await service.getIntentByBookingId('booking-1');
+      const result = await service.getIntentByBookingId("booking-1");
 
-      expect(result.intentId).toBe('intent-1');
+      expect(result.intentId).toBe("intent-1");
       expect(result.status).toBe(PaymentIntentStatus.SUCCEEDED);
     });
 
-    it('should throw NotFoundException if intent not found', async () => {
+    it("should mirror a payment-service snapshot into the local projection", async () => {
       mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+      mockPaymentClient.getIntentByReference.mockResolvedValue(
+        requiresActionSnapshot(ProviderMethod.WAAFI),
+      );
+      mockPrisma.paymentIntent.upsert.mockResolvedValue({
+        id: "intent-1",
+        bookingId: "booking-1",
+        status: PaymentIntentStatus.REQUIRES_ACTION,
+        merchantOrderId: "PSG-MERCH-123",
+        clientAction: { type: "REDIRECT", url: "https://provider.example/pay" },
+      });
 
-      await expect(service.getIntentByBookingId('invalid')).rejects.toThrow(
+      const result = await service.getIntentByBookingId("booking-1");
+
+      expect(mockPaymentClient.getIntentByReference).toHaveBeenCalledWith(
+        PaymentReferenceType.BOOKING,
+        "booking-1",
+      );
+      expect(result.status).toBe(PaymentIntentStatus.REQUIRES_ACTION);
+      expect(result.clientAction?.url).toBe("https://provider.example/pay");
+    });
+
+    it("should throw NotFoundException if intent not found anywhere", async () => {
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+      mockPaymentClient.getIntentByReference.mockResolvedValue(null);
+
+      await expect(service.getIntentByBookingId("invalid")).rejects.toThrow(
         NotFoundException,
       );
     });

apps/edr-passenger-api/src/modules/payments/payments.service.ts

@@ -1,17 +1,37 @@
-import { Injectable, Logger, NotFoundException, BadRequestException } from '@nestjs/common';
-import { PrismaService } from '../../common/prisma.service';
-import { SeatsService } from '../seats/seats.service';
-import { TicketsService } from '../tickets/tickets.service';
-import { EventEmitter2 } from '@nestjs/event-emitter';
-import { Prisma, PaymentIntentStatus, PaymentMethodType, PaymentRegion } from '@prisma/client';
-import { InitiatePaymentDto, RefundDto, AddPaymentMethodDto, InitiateResponseDto, IntentStatusDto, PaymentRegionEnum } from './payments.dto';
-import { ClientAction, PaymentProvider, ProviderStatus } from './payments.types';
-import { TelebirrProvider } from './providers/telebirr.provider';
-import { CbeBirrProvider } from './providers/cbe-birr.provider';
-import { EBirrProvider } from './providers/ebirr.provider';
-import { CardProvider } from './providers/card.provider';
-import { WaafiProvider } from './providers/waafi.provider';
-import { createMerchantOrderId } from './providers/telebirr.crypto';
+import {
+  Injectable,
+  Logger,
+  NotFoundException,
+  BadRequestException,
+} from "@nestjs/common";
+import { PrismaService } from "../../common/prisma.service";
+import { SeatsService } from "../seats/seats.service";
+import { TicketsService } from "../tickets/tickets.service";
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import {
+  Prisma,
+  PaymentIntentStatus,
+  PaymentMethodType,
+  PaymentRegion,
+} from "@prisma/client";
+import {
+  InitiatePaymentDto,
+  RefundDto,
+  AddPaymentMethodDto,
+  InitiateResponseDto,
+  IntentStatusDto,
+  PaymentRegionEnum,
+} from "./payments.dto";
+import { PaymentEventDto, MarkPaidResponseDto } from "./internal-payments.dto";
+import { PaymentClientService } from "./payment-client.service";
+import {
+  PaymentService as PaymentServiceEnum,
+  PaymentReferenceType,
+  PaymentIntentSnapshot,
+  ProviderMethod,
+  ClientAction,
+  ProviderPaymentStatus,
+} from "@edr/types";
 
 const NON_TERMINAL_STATUSES: PaymentIntentStatus[] = [
   PaymentIntentStatus.REQUIRES_ACTION,
@@ -22,26 +42,70 @@ const NON_TERMINAL_STATUSES: PaymentIntentStatus[] = [
 @Injectable()
 export class PaymentsService {
   private readonly logger = new Logger(PaymentsService.name);
-  private readonly providers: Map<PaymentMethodType, PaymentProvider>;
+  private readonly walletDemoAutoSucceed = true;
+
+  private readonly waafiDemoTrustReturn = true;
 
   constructor(
     private prisma: PrismaService,
     private seatsService: SeatsService,
     private ticketsService: TicketsService,
     private eventEmitter: EventEmitter2,
-    private telebirrProvider: TelebirrProvider,
-    private cbeBirrProvider: CbeBirrProvider,
-    private eBirrProvider: EBirrProvider,
-    private cardProvider: CardProvider,
-    private waafiProvider: WaafiProvider,
-  ) {
-    this.providers = new Map<PaymentMethodType, PaymentProvider>([
-      [PaymentMethodType.TELEBIRR, this.telebirrProvider],
-      [PaymentMethodType.CBE_BIRR, this.cbeBirrProvider],
-      [PaymentMethodType.EBIRR, this.eBirrProvider],
-      [PaymentMethodType.CARD, this.cardProvider],
-      [PaymentMethodType.WAAFI, this.waafiProvider],
+    private paymentClient: PaymentClientService,
+  ) {}
+
+  async getAll(filters: {
+    search?: string;
+    status?: string;
+    method?: string;
+    page?: number;
+    pageSize?: number;
+  }) {
+    const { search, status, method, page = 1, pageSize = 10 } = filters;
+    const skip = (page - 1) * pageSize;
+
+    const where: any = {};
+    if (search) {
+      where.OR = [
+        { id: { contains: search, mode: "insensitive" } },
+        { booking: { bookingRef: { contains: search, mode: "insensitive" } } },
+      ];
+    }
+    if (status) {
+      where.status = status;
+    }
+    if (method) {
+      where.method = method;
+    }
+
+    const [items, total] = await Promise.all([
+      this.prisma.paymentIntent.findMany({
+        where,
+        include: { booking: true },
+        skip,
+        take: pageSize,
+        orderBy: { createdAt: "desc" },
+      }),
+      this.prisma.paymentIntent.count({ where }),
     ]);
+
+    return {
+      items: items.map((item) => ({
+        id: item.id,
+        reference: item.id.substring(0, 8),
+        bookingId: item.bookingId,
+        booking: { bookingRef: item.booking?.bookingRef },
+        amountMinor: item.amountMinor,
+        currency: item.currency,
+        method: item.method,
+        status: item.status,
+        createdAt: item.createdAt,
+        paidAt: item.paidAt,
+      })),
+      total,
+      page,
+      pageSize,
+    };
   }
 
   async initiatePayment(dto: InitiatePaymentDto): Promise<InitiateResponseDto> {
@@ -49,35 +113,188 @@ export class PaymentsService {
       where: { id: dto.bookingId },
       include: { seats: true },
     });
-    if (!booking) throw new NotFoundException('Booking not found');
-    if (booking.status !== 'PENDING_PAYMENT') {
-      throw new BadRequestException('Booking not payable');
-    }
-
-    const existing = await this.prisma.paymentIntent.findUnique({
-      where: { bookingId: dto.bookingId },
-    });
-    if (existing && NON_TERMINAL_STATUSES.includes(existing.status)) {
-      return this.formatIntentResponse(existing);
+    if (!booking) throw new NotFoundException("Booking not found");
+    if (booking.status !== "PENDING_PAYMENT") {
+      throw new BadRequestException("Booking not payable");
     }
 
     const method = dto.method as PaymentMethodType;
 
+    // WALLET is an internal balance debit — it never leaves this app.
     if (method === PaymentMethodType.WALLET) {
+      const existing = await this.prisma.paymentIntent.findUnique({
+        where: { bookingId: dto.bookingId },
+      });
+      if (existing && NON_TERMINAL_STATUSES.includes(existing.status)) {
+        return this.formatIntentResponse(existing);
+      }
       return this.initiateWalletPayment(booking);
     }
 
-    const provider = this.providers.get(method);
-    if (provider) {
-      return this.initiateProviderPayment(booking, provider, dto.platform);
+    const { returnUrl, failureUrl } = this.resolveReturnUrls(method);
+    const snapshot = await this.paymentClient.initiate({
+      service: PaymentServiceEnum.PASSENGER,
+      referenceType: PaymentReferenceType.BOOKING,
+      referenceId: booking.id,
+      orderRef: booking.bookingRef,
+      // Send the REAL (major) price, not minor units. The payment API no longer divides by 100
+      // (freight already passes the real price), so the providers charge this value as-is.
+      amountMinor: booking.totalMinor / 100,
+      currency: booking.currency,
+      provider: method as unknown as ProviderMethod,
+      platform: dto.platform,
+      returnUrl,
+      failureUrl,
+    });
+
+    let intent = await this.syncIntentProjection(booking.id, snapshot);
+    if (snapshot.status === ProviderPaymentStatus.SUCCEEDED) {
+      // Already-paid order re-initiated: converge the booking now (idempotent).
+      await this.finalizePaymentSuccess({
+        intentId: intent.id,
+        providerTxnId: snapshot.providerTxnId,
+        paidAt: snapshot.paidAt ? new Date(snapshot.paidAt) : undefined,
+      });
+      intent = await this.prisma.paymentIntent.findUniqueOrThrow({
+        where: { id: intent.id },
+      });
+    }
+    return this.formatIntentResponse(intent);
+  }
+  private resolveReturnUrls(method: PaymentMethodType): {
+    returnUrl?: string;
+    failureUrl?: string;
+  } {
+    const perMethod: Partial<
+      Record<PaymentMethodType, { returnUrl?: string; failureUrl?: string }>
+    > = {
+      [PaymentMethodType.TELEBIRR]: {
+        returnUrl: process.env.TELEBIRR_RETURN_URL,
+      },
+      [PaymentMethodType.WAAFI]: {
+        returnUrl: process.env.WAAFI_SUCCESS_REDIRECT,
+        failureUrl: process.env.WAAFI_FAIL_REDIRECT,
+      },
+      [PaymentMethodType.DMONEY]: {
+        returnUrl: process.env.DMONEY_RETURN_URL,
+      },
+      [PaymentMethodType.CBE_BIRR]: {
+        returnUrl: process.env.CBE_RETURN_URL,
+      },
+      [PaymentMethodType.EBIRR]: {
+        returnUrl: process.env.EBIRR_RETURN_URL,
+      },
+      [PaymentMethodType.CARD]: {
+        returnUrl: process.env.CARD_RETURN_URL,
+      },
+    };
+
+    const m = perMethod[method] ?? {};
+    const returnUrl = m.returnUrl || process.env.PAYMENT_RETURN_URL || undefined;
+    const failureUrl =
+      m.failureUrl || process.env.PAYMENT_FAILURE_URL || returnUrl;
+    return { returnUrl, failureUrl };
+  }
+
+  async confirmWaafiReturnDemo(params: {
+    referenceId?: string;
+    state?: string;
+    transactionId?: string;
+  }): Promise<{ confirmed: boolean; bookingId?: string; reason?: string }> {
+    if (!this.waafiDemoTrustReturn) {
+      return { confirmed: false, reason: "demo-disabled" };
+    }
+    if ((params.state ?? "").toUpperCase() !== "APPROVED") {
+      return { confirmed: false, reason: `not-approved (${params.state})` };
+    }
+    if (!params.referenceId) {
+      return { confirmed: false, reason: "missing-referenceId" };
     }
 
-    throw new BadRequestException(`Unsupported payment method: ${method}`);
+    const intent = await this.prisma.paymentIntent.findFirst({
+      where: { merchantOrderId: params.referenceId },
+    });
+    if (!intent) {
+      this.logger.warn(
+        `waafi demo return: no local intent for referenceId ${params.referenceId}`,
+      );
+      return { confirmed: false, reason: "intent-not-found" };
+    }
+
+    this.logger.warn(
+      `WAAFI_DEMO_TRUST_RETURN enabled — confirming booking ${intent.bookingId} from browser return (INSECURE, demo only)`,
+    );
+    await this.finalizePaymentSuccess({
+      intentId: intent.id,
+      providerTxnId: params.transactionId,
+    });
+    return { confirmed: true, bookingId: intent.bookingId };
+  }
+
+  private async syncIntentProjection(
+    bookingId: string,
+    snapshot: PaymentIntentSnapshot,
+  ) {
+    const status =
+      snapshot.status === ProviderPaymentStatus.SUCCEEDED
+        ? PaymentIntentStatus.PROCESSING
+        : (snapshot.status as unknown as PaymentIntentStatus);
+    const data = {
+      status,
+      method: snapshot.provider as unknown as PaymentMethodType,
+      merchantOrderId: snapshot.merchantOrderId,
+      clientAction: snapshot.clientAction
+        ? (snapshot.clientAction as unknown as Prisma.InputJsonValue)
+        : Prisma.DbNull,
+      providerTxnId: snapshot.providerTxnId ?? null,
+      expiresAt: snapshot.expiresAt ? new Date(snapshot.expiresAt) : null,
+      failureCode: snapshot.failureCode ?? null,
+      failureMessage: snapshot.failureMessage ?? null,
+    };
+    return this.prisma.paymentIntent.upsert({
+      where: { bookingId },
+      update: data,
+      create: {
+        bookingId,
+        amountMinor: snapshot.amountMinor,
+        currency: snapshot.currency,
+        ...data,
+      },
+    });
   }
 
   private async initiateWalletPayment(
     booking: Prisma.BookingGetPayload<{ include: { seats: true } }>,
   ): Promise<InitiateResponseDto> {
+    // DEMO ONLY (WALLET_DEMO_AUTO_SUCCEED): pretend the payment succeeded — no balance check,
+    // no debit — and run the exact same finalize path a real successful payment uses
+    // (booking → CONFIRMED, seats confirmed, ticket issued). Remove once a real provider works.
+    if (this.walletDemoAutoSucceed) {
+      this.logger.warn(
+        `WALLET_DEMO_AUTO_SUCCEED enabled — faking a successful WALLET payment for booking ${booking.bookingRef} (${booking.id})`,
+      );
+      const demoIntent = await this.prisma.paymentIntent.upsert({
+        where: { bookingId: booking.id },
+        update: {
+          status: PaymentIntentStatus.PROCESSING,
+          failureCode: null,
+          method: PaymentMethodType.WALLET,
+        },
+        create: {
+          bookingId: booking.id,
+          amountMinor: booking.totalMinor,
+          method: PaymentMethodType.WALLET,
+          status: PaymentIntentStatus.PROCESSING,
+          providerRef: `WALLET-DEMO-${Date.now()}`,
+        },
+      });
+      await this.finalizePaymentSuccess({ intentId: demoIntent.id });
+      const settled = await this.prisma.paymentIntent.findUniqueOrThrow({
+        where: { id: demoIntent.id },
+      });
+      return this.formatIntentResponse(settled);
+    }
+
     const debitResult = await this.prisma.$transaction(async (tx) => {
       const wallet = await tx.walletAccount.findUnique({
         where: { passengerId: booking.passengerId },
@@ -93,7 +310,7 @@ export class PaymentsService {
       await tx.walletLedgerEntry.create({
         data: {
           walletId: wallet.id,
-          type: 'DEBIT',
+          type: "DEBIT",
           amountMinor: booking.totalMinor,
           balanceAfterMinor: newBalance,
           description: `Train Ticket - ${booking.bookingRef}`,
@@ -108,14 +325,14 @@ export class PaymentsService {
         where: { bookingId: booking.id },
         update: {
           status: PaymentIntentStatus.FAILED,
-          failureCode: 'INSUFFICIENT_BALANCE',
+          failureCode: "INSUFFICIENT_BALANCE",
         },
         create: {
           bookingId: booking.id,
           amountMinor: booking.totalMinor,
           method: PaymentMethodType.WALLET,
           status: PaymentIntentStatus.FAILED,
-          failureCode: 'INSUFFICIENT_BALANCE',
+          failureCode: "INSUFFICIENT_BALANCE",
         },
       });
       return this.formatIntentResponse(failed);
@@ -139,54 +356,11 @@ export class PaymentsService {
     return this.formatIntentResponse(refreshed);
   }
 
-  private async initiateProviderPayment(
-    booking: Prisma.BookingGetPayload<{ include: { seats: true } }>,
-    provider: PaymentProvider,
-    platform: 'web' | 'mobile' | undefined,
-  ): Promise<InitiateResponseDto> {
-    const merchantOrderId = createMerchantOrderId();
-    const result = await provider.initiate({
-      merchantOrderId,
-      bookingRef: booking.bookingRef,
-      amountMinor: booking.totalMinor,
-      currency: booking.currency,
-      platform,
-    });
-
-    const intent = await this.prisma.paymentIntent.upsert({
-      where: { bookingId: booking.id },
-      update: {
-        status: PaymentIntentStatus.REQUIRES_ACTION,
-        method: provider.method,
-        merchantOrderId,
-        providerOrderId: result.providerOrderId,
-        clientAction: result.clientAction as unknown as Prisma.InputJsonValue,
-        rawInitiation: result.rawInitiation as Prisma.InputJsonValue,
-        expiresAt: result.expiresAt,
-        failureCode: null,
-        failureMessage: null,
-      },
-      create: {
-        bookingId: booking.id,
-        amountMinor: booking.totalMinor,
-        currency: booking.currency,
-        method: provider.method,
-        status: PaymentIntentStatus.REQUIRES_ACTION,
-        merchantOrderId,
-        providerOrderId: result.providerOrderId,
-        clientAction: result.clientAction as unknown as Prisma.InputJsonValue,
-        rawInitiation: result.rawInitiation as Prisma.InputJsonValue,
-        expiresAt: result.expiresAt,
-      },
-    });
-    return this.formatIntentResponse(intent);
-  }
-
   private formatIntentResponse(
     intent: Prisma.PaymentIntentGetPayload<Record<string, never>>,
   ): InitiateResponseDto {
     const clientAction =
-      intent.clientAction && typeof intent.clientAction === 'object'
+      intent.clientAction && typeof intent.clientAction === "object"
         ? (intent.clientAction as unknown as ClientAction)
         : undefined;
     return {
@@ -198,62 +372,52 @@ export class PaymentsService {
   }
 
   async getIntentByBookingId(bookingId: string): Promise<IntentStatusDto> {
-    const intent = await this.prisma.paymentIntent.findUnique({
+    const local = await this.prisma.paymentIntent.findUnique({
       where: { bookingId },
     });
-    if (!intent) throw new NotFoundException('PaymentIntent not found');
 
-    const refreshable =
-      intent.status === PaymentIntentStatus.REQUIRES_ACTION ||
-      intent.status === PaymentIntentStatus.PROCESSING;
-    const stale = intent.updatedAt.getTime() < Date.now() - 5_000;
-    const provider = this.providers.get(intent.method);
-
-    if (refreshable && stale && intent.merchantOrderId && provider) {
-      try {
-        const status = await provider.queryStatus(intent.merchantOrderId);
-        await this.applyProviderStatus(intent.id, status);
-        const refreshed = await this.prisma.paymentIntent.findUniqueOrThrow({
-          where: { id: intent.id },
-        });
-        return this.formatIntentStatus(refreshed);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        this.logger.warn(
-          `queryStatus failed for intent ${intent.id}: ${message}; returning cached`,
-        );
-      }
+    // WALLET payments never leave this app — no remote intent exists for them.
+    if (local?.method === PaymentMethodType.WALLET) {
+      return this.formatIntentStatus(local);
     }
 
-    return this.formatIntentStatus(intent);
-  }
+    // Pull/reconcile through the payment microservice (it refreshes stale intents from the
+    // provider itself). Falls back to the legacy local path when the service is unreachable
+    // or only a pre-cutover local intent exists.
+    let snapshot: PaymentIntentSnapshot | null = null;
+    try {
+      snapshot = await this.paymentClient.getIntentByReference(
+        PaymentReferenceType.BOOKING,
+        bookingId,
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.warn(
+        `payment service lookup failed for booking ${bookingId}: ${message}; using local intent`,
+      );
+    }
 
-  private async applyProviderStatus(
-    intentId: string,
-    status: ProviderStatus,
-  ): Promise<void> {
-    if (status.status === PaymentIntentStatus.SUCCEEDED) {
+    if (!snapshot) {
+      // Pre-cutover/local-only intent (or service briefly unreachable): serve the cached
+      // status. The payment service owns provider refresh for everything initiated after
+      // the cutover; webhooks/mark-paid converge the rest.
+      if (!local) throw new NotFoundException("PaymentIntent not found");
+      return this.formatIntentStatus(local);
+    }
+
+    let intent = await this.syncIntentProjection(bookingId, snapshot);
+    if (snapshot.status === ProviderPaymentStatus.SUCCEEDED) {
+      // Poll observed success before (or instead of) the mark-paid event — converge now.
       await this.finalizePaymentSuccess({
-        intentId,
-        providerTxnId: status.providerTxnId,
+        intentId: intent.id,
+        providerTxnId: snapshot.providerTxnId,
+        paidAt: snapshot.paidAt ? new Date(snapshot.paidAt) : undefined,
       });
-      return;
-    }
-    if (status.status === PaymentIntentStatus.FAILED) {
-      await this.markPaymentFailed({
-        intentId,
-        failureCode: status.failureCode,
-        failureMessage: status.failureMessage,
+      intent = await this.prisma.paymentIntent.findUniqueOrThrow({
+        where: { id: intent.id },
       });
-      return;
     }
-    await this.prisma.paymentIntent.update({
-      where: { id: intentId },
-      data: {
-        status: status.status,
-        providerTxnId: status.providerTxnId ?? undefined,
-      },
-    });
+    return this.formatIntentStatus(intent);
   }
 
   private formatIntentStatus(
@@ -269,13 +433,25 @@ export class PaymentsService {
   }
 
   async refund(dto: RefundDto) {
-    const intent = await this.prisma.paymentIntent.findUnique({ where: { bookingId: dto.bookingId } });
-    if (!intent || intent.status !== 'SUCCEEDED') throw new BadRequestException('No successful payment to refund');
-    await this.prisma.paymentIntent.update({ where: { bookingId: dto.bookingId }, data: { status: 'CANCELLED' } });
-    const booking = await this.prisma.booking.findUnique({ where: { id: dto.bookingId }, include: { seats: true } });
+    const intent = await this.prisma.paymentIntent.findUnique({
+      where: { bookingId: dto.bookingId },
+    });
+    if (!intent || intent.status !== "SUCCEEDED")
+      throw new BadRequestException("No successful payment to refund");
+    await this.prisma.paymentIntent.update({
+      where: { bookingId: dto.bookingId },
+      data: { status: "CANCELLED" },
+    });
+    const booking = await this.prisma.booking.findUnique({
+      where: { id: dto.bookingId },
+      include: { seats: true },
+    });
     if (booking) {
       await this.seatsService.releaseSeats(booking.seats.map((s) => s.seatId));
-      await this.prisma.booking.update({ where: { id: dto.bookingId }, data: { status: 'CANCELLED' } });
+      await this.prisma.booking.update({
+        where: { id: dto.bookingId },
+        data: { status: "CANCELLED" },
+      });
     }
     return { refunded: true, bookingRef: booking?.bookingRef };
   }
@@ -285,7 +461,7 @@ export class PaymentsService {
       type: dto.type as unknown as PaymentMethodType,
       displayName: dto.displayName,
       region: dto.region as unknown as PaymentRegion,
-      currency: dto.currency ?? 'ETB',
+      currency: dto.currency ?? "ETB",
       providerId: dto.providerId,
       enabled: dto.enabled ?? true,
       sortOrder: dto.sortOrder ?? 0,
@@ -302,13 +478,44 @@ export class PaymentsService {
       where: {
         enabled: true,
         ...(region
-          ? { region: { in: [region, PaymentRegionEnum.GLOBAL] as unknown as PaymentRegion[] } }
+          ? {
+              region: {
+                in: [
+                  region,
+                  PaymentRegionEnum.GLOBAL,
+                ] as unknown as PaymentRegion[],
+              },
+            }
           : {}),
       },
-      orderBy: [{ sortOrder: 'asc' }, { displayName: 'asc' }],
+      orderBy: [{ sortOrder: "asc" }, { displayName: "asc" }],
     });
   }
 
+  /**
+   * Guard against an implausible paidAt from a provider event (e.g. a Telebirr epoch parsed as
+   * ms×1000 → year 58429), which Prisma/Postgres rejects and would otherwise dead-letter the
+   * whole confirmation. Falls back to "now" for missing/invalid/far-future/ancient values so the
+   * booking still confirms.
+   */
+  private sanitizePaidAt(value?: Date): Date {
+    const now = new Date();
+    if (!value) return now;
+    const t = value.getTime();
+    const oneDayMs = 86_400_000;
+    if (
+      Number.isNaN(t) ||
+      t > now.getTime() + oneDayMs ||
+      t < Date.UTC(2000, 0, 1)
+    ) {
+      this.logger.warn(
+        `finalizePaymentSuccess: implausible paidAt (epoch=${t}); using current time instead`,
+      );
+      return now;
+    }
+    return value;
+  }
+
   async finalizePaymentSuccess(input: {
     intentId: string;
     providerTxnId?: string;
@@ -317,65 +524,166 @@ export class PaymentsService {
     const intent = await this.prisma.paymentIntent.findUnique({
       where: { id: input.intentId },
     });
-    if (!intent) throw new NotFoundException('PaymentIntent not found');
+    if (!intent) throw new NotFoundException("PaymentIntent not found");
     if (intent.status === PaymentIntentStatus.SUCCEEDED) {
       return { alreadyFinalized: true };
     }
     if (intent.status === PaymentIntentStatus.CANCELLED) {
-      throw new BadRequestException('PaymentIntent is cancelled; cannot finalize');
+      throw new BadRequestException(
+        "PaymentIntent is cancelled; cannot finalize",
+      );
     }
 
     const booking = await this.prisma.booking.findUnique({
       where: { id: intent.bookingId },
       include: { seats: true },
     });
-    if (!booking) throw new NotFoundException('Booking not found');
+    if (!booking) throw new NotFoundException("Booking not found");
 
-    const paidAt = input.paidAt ?? new Date();
+    const paidAt = this.sanitizePaidAt(input.paidAt);
     await this.prisma.$transaction(async (tx) => {
       await tx.paymentIntent.update({
         where: { id: intent.id },
         data: {
           status: PaymentIntentStatus.SUCCEEDED,
-          providerTxnId: input.providerTxnId ?? intent.providerTxnId ?? undefined,
+          providerTxnId:
+            input.providerTxnId ?? intent.providerTxnId ?? undefined,
           paidAt,
         },
       });
       await tx.booking.update({
         where: { id: booking.id },
-        data: { status: 'CONFIRMED' },
+        data: { status: "CONFIRMED" },
       });
     });
 
     try {
       await this.seatsService.confirmSeats(booking.seats.map((s) => s.seatId));
     } catch (err) {
-      this.logger.error(`Error confirming seats: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(
+        `Error confirming seats: ${err instanceof Error ? err.message : String(err)}`,
+      );
     }
 
     try {
       await this.createJourneySegments(booking);
     } catch (err) {
-      this.logger.error(`Error creating journey segments: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(
+        `Error creating journey segments: ${err instanceof Error ? err.message : String(err)}`,
+      );
     }
 
     try {
       await this.ticketsService.generate(booking.id);
     } catch (err) {
-      this.logger.error(`Error generating ticket: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(
+        `Error generating ticket: ${err instanceof Error ? err.message : String(err)}`,
+      );
       throw err;
     }
 
     try {
-      await this.awardLoyaltyPoints(booking.passengerId, booking.totalMinor, booking.id);
+      await this.awardLoyaltyPoints(
+        booking.passengerId,
+        booking.totalMinor,
+        booking.id,
+      );
     } catch (err) {
-      this.logger.warn(`Error awarding loyalty points: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.warn(
+        `Error awarding loyalty points: ${err instanceof Error ? err.message : String(err)}`,
+      );
     }
 
-    this.eventEmitter.emit('payment.succeeded', { booking });
+    this.eventEmitter.emit("payment.succeeded", { booking });
     return { alreadyFinalized: false };
   }
 
+  async handlePaymentEvent(
+    event: PaymentEventDto,
+  ): Promise<MarkPaidResponseDto> {
+    if (
+      event.service !== PaymentServiceEnum.PASSENGER ||
+      event.referenceType !== PaymentReferenceType.BOOKING
+    ) {
+      this.logger.warn(
+        `mark-paid: ignoring foreign reference ${event.service}/${event.referenceType}/${event.referenceId}`,
+      );
+      return { processed: false, reason: "foreign-reference" };
+    }
+
+    if (event.eventType === "payment.failed") {
+      const intent = await this.prisma.paymentIntent.findUnique({
+        where: { bookingId: event.referenceId },
+      });
+      if (intent) {
+        await this.markPaymentFailed({
+          intentId: intent.id,
+          failureCode: event.failureCode,
+          failureMessage: event.failureMessage,
+        });
+      }
+      const failedBooking = await this.prisma.booking.findUnique({
+        where: { id: event.referenceId },
+      });
+      if (failedBooking) {
+        this.eventEmitter.emit("payment.failed", { booking: failedBooking });
+      }
+      return { processed: true };
+    }
+
+    const booking = await this.prisma.booking.findUnique({
+      where: { id: event.referenceId },
+    });
+    if (!booking) {
+      // Ack (200) — a missing booking will not appear on redelivery; needs investigation.
+      this.logger.error(
+        `mark-paid: no booking for reference ${event.referenceId}`,
+      );
+      return { processed: false, reason: "booking-not-found" };
+    }
+
+    // The event carries the REAL (major) price the provider charged (passenger now sends
+    // booking.totalMinor/100 on initiate), so convert it back to minor units before comparing
+    // with booking.totalMinor (which is in minor units).
+    const eventAmountMinor = Math.round(event.amountMinor * 100);
+    if (booking.totalMinor !== eventAmountMinor) {
+      // Refuse to confirm: a 4xx makes the relay retry and eventually flag the row FAILED,
+      // which is the alertable signal for an asserted-vs-paid amount divergence.
+      this.logger.error(
+        `mark-paid: amount mismatch for booking ${booking.id}: booking=${booking.totalMinor} event=${event.amountMinor} (=${eventAmountMinor} minor)`,
+      );
+      throw new BadRequestException(
+        "Event amount does not match booking total",
+      );
+    }
+
+    // Local intent row is a projection during the strangler migration: reuse it when the
+    // legacy initiate path created one, otherwise materialize it from the event.
+    let intent = await this.prisma.paymentIntent.findUnique({
+      where: { bookingId: event.referenceId },
+    });
+    if (!intent) {
+      intent = await this.prisma.paymentIntent.create({
+        data: {
+          bookingId: event.referenceId,
+          amountMinor: event.amountMinor,
+          currency: event.currency,
+          method: event.provider as unknown as PaymentMethodType,
+          status: PaymentIntentStatus.PROCESSING,
+          merchantOrderId: event.merchantOrderId,
+          providerTxnId: event.providerTxnId,
+        },
+      });
+    }
+
+    const { alreadyFinalized } = await this.finalizePaymentSuccess({
+      intentId: intent.id,
+      providerTxnId: event.providerTxnId,
+      paidAt: event.paidAt ? new Date(event.paidAt) : undefined,
+    });
+    return { processed: true, alreadyFinalized };
+  }
+
   async markPaymentFailed(input: {
     intentId: string;
     failureCode?: string;
@@ -384,7 +692,7 @@ export class PaymentsService {
     const intent = await this.prisma.paymentIntent.findUnique({
       where: { id: input.intentId },
     });
-    if (!intent) throw new NotFoundException('PaymentIntent not found');
+    if (!intent) throw new NotFoundException("PaymentIntent not found");
     if (
       intent.status === PaymentIntentStatus.SUCCEEDED ||
       intent.status === PaymentIntentStatus.CANCELLED
@@ -401,35 +709,72 @@ export class PaymentsService {
     });
   }
 
-  private async awardLoyaltyPoints(passengerId: string, amountMinor: number, bookingId: string) {
+  private async awardLoyaltyPoints(
+    passengerId: string,
+    amountMinor: number,
+    bookingId: string,
+  ) {
     const points = Math.floor(amountMinor / 100);
-    const account = await this.prisma.loyaltyAccount.findUnique({ where: { passengerId } });
+    const account = await this.prisma.loyaltyAccount.findUnique({
+      where: { passengerId },
+    });
     if (!account) return;
     const newBalance = account.pointsBalance + points;
-    const tier = newBalance >= 10000 ? 'PLATINUM' : newBalance >= 5000 ? 'GOLD' : newBalance >= 2000 ? 'SILVER' : 'BRONZE';
-    await this.prisma.loyaltyAccount.update({ where: { passengerId }, data: { pointsBalance: { increment: points }, tier: tier as any } });
-    await this.prisma.loyaltyLedgerEntry.create({ data: { accountId: account.id, delta: points, reason: 'TRIP_COMPLETED', bookingId, balanceAfter: newBalance } });
+    const tier =
+      newBalance >= 10000
+        ? "PLATINUM"
+        : newBalance >= 5000
+          ? "GOLD"
+          : newBalance >= 2000
+            ? "SILVER"
+            : "BRONZE";
+    await this.prisma.loyaltyAccount.update({
+      where: { passengerId },
+      data: { pointsBalance: { increment: points }, tier: tier as any },
+    });
+    await this.prisma.loyaltyLedgerEntry.create({
+      data: {
+        accountId: account.id,
+        delta: points,
+        reason: "TRIP_COMPLETED",
+        bookingId,
+        balanceAfter: newBalance,
+      },
+    });
   }
 
-  private async createJourneySegments(booking: Prisma.BookingGetPayload<{ include: { seats: true } }>) {
+  private async createJourneySegments(
+    booking: Prisma.BookingGetPayload<{ include: { seats: true } }>,
+  ) {
     const schedule = await this.prisma.trainSchedule.findUnique({
       where: { id: booking.scheduleId },
-      include: { stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } },
+      include: {
+        stopTimes: { include: { station: true }, orderBy: { sequence: "asc" } },
+      },
     });
     if (!schedule) return;
 
     const stopTimes = schedule.stopTimes;
     if (stopTimes.length < 2) return;
 
-    const originSequence = stopTimes.findIndex(st => st.stationId === schedule.originStationId);
-    const destSequence = stopTimes.findIndex(st => st.stationId === schedule.destinationStationId);
+    const originSequence = stopTimes.findIndex(
+      (st) => st.stationId === schedule.originStationId,
+    );
+    const destSequence = stopTimes.findIndex(
+      (st) => st.stationId === schedule.destinationStationId,
+    );
 
-    if (originSequence < 0 || destSequence < 0 || originSequence >= destSequence) return;
+    if (
+      originSequence < 0 ||
+      destSequence < 0 ||
+      originSequence >= destSequence
+    )
+      return;
 
     const journey = await this.prisma.journey.create({
       data: {
         passengerId: booking.passengerId,
-        status: 'CONFIRMED',
+        status: "CONFIRMED",
         totalMinor: booking.totalMinor,
         currency: booking.currency,
       },

apps/edr-passenger-api/src/modules/payments/payments.types.ts

@@ -1,36 +1,12 @@
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-
-export type PaymentPlatform = 'web' | 'mobile';
-
-export type ClientAction =
-  | { type: 'REDIRECT'; url: string }
-  | { type: 'LAUNCH_APP'; prepayId: string; receiveCode?: string; shortCode: string };
-
-export interface ProviderInitiationInput {
-  merchantOrderId: string;
-  bookingRef: string;
-  amountMinor: number;
-  currency: string;
-  platform?: PaymentPlatform;
-}
-
-export interface ProviderInitiationResult {
-  providerOrderId: string;
-  clientAction: ClientAction;
-  expiresAt: Date;
-  rawInitiation: Record<string, unknown>;
-}
-
-export interface ProviderStatus {
-  status: PaymentIntentStatus;
-  providerTxnId?: string;
-  failureCode?: string;
-  failureMessage?: string;
-  rawResponse: Record<string, unknown>;
-}
-
-export interface PaymentProvider {
-  readonly method: PaymentMethodType;
-  initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult>;
-  queryStatus(merchantOrderId: string): Promise<ProviderStatus>;
-}
+// The payment provider contract lives in @edr/types; the gateways themselves now run only
+// inside apps/edr-payment-api. This file remains as a thin re-export so existing local
+// imports keep working.
+export type {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ClientAction,
+  PaymentPlatform,
+} from "@edr/types";
+export { ProviderPaymentStatus, ProviderMethod } from "@edr/types";

apps/edr-passenger-api/src/modules/payments/providers/card.provider.ts

@@ -1,218 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { AxiosError, AxiosRequestConfig } from 'axios';
-import { firstValueFrom } from 'rxjs';
-import * as crypto from 'node:crypto';
-import {
-  PaymentProvider,
-  ProviderInitiationInput,
-  ProviderInitiationResult,
-  ProviderStatus,
-} from '../payments.types';
-
-interface CardInitiateRequest {
-  amount: number;
-  currency: string;
-  description: string;
-  metadata: {
-    merchantOrderId: string;
-    bookingRef: string;
-  };
-  return_url: string;
-  webhook_url: string;
-}
-
-interface CardInitiateResponse {
-  id: string;
-  status: string;
-  client_secret: string;
-  checkout_url: string;
-  expires_at: number;
-}
-
-interface CardQueryResponse {
-  id: string;
-  status: string;
-  amount: number;
-  currency: string;
-  transaction_id?: string;
-  paid_at?: number;
-  failure_code?: string;
-  failure_message?: string;
-}
-
-@Injectable()
-export class CardProvider implements PaymentProvider {
-  readonly method = PaymentMethodType.CARD;
-  private readonly logger = new Logger(CardProvider.name);
-
-  constructor(
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {}
-
-  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
-    const amount = input.amountMinor / 100;
-    
-    const requestBody: CardInitiateRequest = {
-      amount,
-      currency: input.currency,
-      description: `EDR Train Booking ${input.bookingRef}`,
-      metadata: {
-        merchantOrderId: input.merchantOrderId,
-        bookingRef: input.bookingRef,
-      },
-      return_url: this.returnUrl,
-      webhook_url: this.webhookUrl,
-    };
-
-    const response = await this.postJson<CardInitiateResponse>(
-      `${this.baseUrl}/v1/payment_intents`,
-      requestBody,
-    );
-
-    if (!response.id) {
-      throw new Error(`Card gateway initiate failed: ${JSON.stringify(response)}`);
-    }
-
-    const expiresAt = new Date(response.expires_at * 1000);
-
-    return {
-      providerOrderId: response.id,
-      clientAction: { type: 'REDIRECT', url: response.checkout_url },
-      expiresAt,
-      rawInitiation: {
-        request: requestBody,
-        response,
-      },
-    };
-  }
-
-  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
-    // For card payments, we need to find the payment intent by metadata
-    // In a real implementation, we'd store the provider order ID and use it directly
-    const response = await this.getJson<CardQueryResponse>(
-      `${this.baseUrl}/v1/payment_intents/search?metadata[merchantOrderId]=${merchantOrderId}`,
-    );
-
-    const mapped = this.mapStatus(response.status);
-
-    return {
-      status: mapped,
-      providerTxnId: response.transaction_id,
-      failureCode: response.failure_code,
-      failureMessage: response.failure_message,
-      rawResponse: response as unknown as Record<string, unknown>,
-    };
-  }
-
-  verifyWebhookSignature(payload: Record<string, unknown>, signature: string): boolean {
-    const payloadString = JSON.stringify(payload);
-    const expectedSignature = crypto
-      .createHmac('sha256', this.webhookSecret)
-      .update(payloadString)
-      .digest('hex');
-    
-    try {
-      return crypto.timingSafeEqual(
-        Buffer.from(signature),
-        Buffer.from(expectedSignature),
-      );
-    } catch {
-      return false;
-    }
-  }
-
-  mapWebhookStatus(status: string): PaymentIntentStatus {
-    return this.mapStatus(status);
-  }
-
-  private mapStatus(status: string): PaymentIntentStatus {
-    switch (status?.toLowerCase()) {
-      case 'succeeded':
-      case 'paid':
-        return PaymentIntentStatus.SUCCEEDED;
-      case 'failed':
-      case 'canceled':
-      case 'expired':
-        return PaymentIntentStatus.FAILED;
-      case 'requires_payment_method':
-      case 'requires_confirmation':
-      case 'requires_action':
-        return PaymentIntentStatus.REQUIRES_ACTION;
-      case 'processing':
-        return PaymentIntentStatus.PROCESSING;
-      default:
-        return PaymentIntentStatus.PROCESSING;
-    }
-  }
-
-  private async postJson<T>(url: string, body: unknown): Promise<T> {
-    const config: AxiosRequestConfig = {
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': `Bearer ${this.apiKey}`,
-      },
-      timeout: 10_000,
-    };
-
-    const started = Date.now();
-    try {
-      const res = await firstValueFrom(this.http.post<T>(url, body, config));
-      this.logger.debug(`Card Gateway POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
-      return res.data;
-    } catch (err) {
-      if (err instanceof AxiosError) {
-        this.logger.error(
-          `Card Gateway POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
-        );
-      } else {
-        this.logger.error(`Card Gateway POST ${url} threw: ${err instanceof Error ? err.message : err}`);
-      }
-      throw err;
-    }
-  }
-
-  private async getJson<T>(url: string): Promise<T> {
-    const config: AxiosRequestConfig = {
-      headers: {
-        'Authorization': `Bearer ${this.apiKey}`,
-      },
-      timeout: 10_000,
-    };
-
-    const started = Date.now();
-    try {
-      const res = await firstValueFrom(this.http.get<T>(url, config));
-      this.logger.debug(`Card Gateway GET ${url} status=${res.status} latency=${Date.now() - started}ms`);
-      return res.data;
-    } catch (err) {
-      if (err instanceof AxiosError) {
-        this.logger.error(
-          `Card Gateway GET ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
-        );
-      } else {
-        this.logger.error(`Card Gateway GET ${url} threw: ${err instanceof Error ? err.message : err}`);
-      }
-      throw err;
-    }
-  }
-
-  private get baseUrl(): string {
-    return this.config.get<string>('card.baseUrl') ?? '';
-  }
-  private get apiKey(): string {
-    return this.config.get<string>('card.apiKey') ?? '';
-  }
-  private get webhookSecret(): string {
-    return this.config.get<string>('card.webhookSecret') ?? '';
-  }
-  private get webhookUrl(): string {
-    return this.config.get<string>('card.webhookUrl') ?? '';
-  }
-  private get returnUrl(): string {
-    return this.config.get<string>('card.returnUrl') ?? '';
-  }
-}

apps/edr-passenger-api/src/modules/payments/providers/cbe-birr.provider.ts

@@ -1,215 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { AxiosError, AxiosRequestConfig } from 'axios';
-import { firstValueFrom } from 'rxjs';
-import * as crypto from 'node:crypto';
-import {
-  PaymentProvider,
-  ProviderInitiationInput,
-  ProviderInitiationResult,
-  ProviderStatus,
-} from '../payments.types';
-
-interface CbeBirrInitiateRequest {
-  merchantId: string;
-  merchantOrderId: string;
-  amount: string;
-  currency: string;
-  description: string;
-  returnUrl: string;
-  notifyUrl: string;
-  timestamp: string;
-  signature: string;
-}
-
-interface CbeBirrInitiateResponse {
-  success: boolean;
-  orderId: string;
-  paymentUrl: string;
-  expiresIn: number;
-}
-
-interface CbeBirrQueryResponse {
-  success: boolean;
-  orderId: string;
-  status: string;
-  transactionId?: string;
-  amount?: string;
-  paidAt?: string;
-}
-
-@Injectable()
-export class CbeBirrProvider implements PaymentProvider {
-  readonly method = PaymentMethodType.CBE_BIRR;
-  private readonly logger = new Logger(CbeBirrProvider.name);
-
-  constructor(
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {}
-
-  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
-    const amount = (input.amountMinor / 100).toFixed(2);
-    const timestamp = new Date().toISOString();
-    
-    const requestBody: CbeBirrInitiateRequest = {
-      merchantId: this.merchantId,
-      merchantOrderId: input.merchantOrderId,
-      amount,
-      currency: input.currency,
-      description: `EDR Booking ${input.bookingRef}`,
-      returnUrl: this.returnUrl,
-      notifyUrl: this.notifyUrl,
-      timestamp,
-      signature: this.signRequest({
-        merchantId: this.merchantId,
-        merchantOrderId: input.merchantOrderId,
-        amount,
-        timestamp,
-      }),
-    };
-
-    const response = await this.postJson<CbeBirrInitiateResponse>(
-      `${this.baseUrl}/api/v1/payment/initiate`,
-      requestBody,
-    );
-
-    if (!response.success || !response.orderId) {
-      throw new Error(`CBE Birr initiate failed: ${JSON.stringify(response)}`);
-    }
-
-    const expiresAt = new Date(Date.now() + response.expiresIn * 1000);
-
-    return {
-      providerOrderId: response.orderId,
-      clientAction: { type: 'REDIRECT', url: response.paymentUrl },
-      expiresAt,
-      rawInitiation: {
-        request: this.sanitize(requestBody),
-        response,
-      },
-    };
-  }
-
-  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
-    const timestamp = new Date().toISOString();
-    const signature = this.signRequest({
-      merchantId: this.merchantId,
-      merchantOrderId,
-      timestamp,
-    });
-
-    const response = await this.postJson<CbeBirrQueryResponse>(
-      `${this.baseUrl}/api/v1/payment/query`,
-      {
-        merchantId: this.merchantId,
-        merchantOrderId,
-        timestamp,
-        signature,
-      },
-    );
-
-    const mapped = this.mapStatus(response.status);
-
-    return {
-      status: mapped,
-      providerTxnId: response.transactionId,
-      failureCode: mapped === PaymentIntentStatus.FAILED ? response.status : undefined,
-      rawResponse: response as unknown as Record<string, unknown>,
-    };
-  }
-
-  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
-    const { signature, ...data } = payload;
-    if (!signature || typeof signature !== 'string') return false;
-    
-    const expectedSignature = this.signRequest(data);
-    return crypto.timingSafeEqual(
-      Buffer.from(signature),
-      Buffer.from(expectedSignature),
-    );
-  }
-
-  mapWebhookStatus(status: string): PaymentIntentStatus {
-    return this.mapStatus(status);
-  }
-
-  private mapStatus(status: string): PaymentIntentStatus {
-    switch (status?.toUpperCase()) {
-      case 'SUCCESS':
-      case 'COMPLETED':
-        return PaymentIntentStatus.SUCCEEDED;
-      case 'FAILED':
-      case 'REJECTED':
-      case 'EXPIRED':
-        return PaymentIntentStatus.FAILED;
-      case 'PENDING':
-        return PaymentIntentStatus.REQUIRES_ACTION;
-      case 'PROCESSING':
-        return PaymentIntentStatus.PROCESSING;
-      default:
-        return PaymentIntentStatus.PROCESSING;
-    }
-  }
-
-  private signRequest(data: Record<string, unknown>): string {
-    const sortedKeys = Object.keys(data).sort();
-    const signString = sortedKeys
-      .map((key) => `${key}=${data[key]}`)
-      .join('&');
-    
-    return crypto
-      .createHmac('sha256', this.secretKey)
-      .update(signString)
-      .digest('hex');
-  }
-
-  private async postJson<T>(url: string, body: unknown): Promise<T> {
-    const config: AxiosRequestConfig = {
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Merchant-Id': this.merchantId,
-      },
-      timeout: 10_000,
-    };
-
-    const started = Date.now();
-    try {
-      const res = await firstValueFrom(this.http.post<T>(url, body, config));
-      this.logger.debug(`CBE Birr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
-      return res.data;
-    } catch (err) {
-      if (err instanceof AxiosError) {
-        this.logger.error(
-          `CBE Birr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
-        );
-      } else {
-        this.logger.error(`CBE Birr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
-      }
-      throw err;
-    }
-  }
-
-  private sanitize(body: CbeBirrInitiateRequest): Record<string, unknown> {
-    const { signature: _signature, ...rest } = body;
-    return rest;
-  }
-
-  private get baseUrl(): string {
-    return this.config.get<string>('cbe.baseUrl') ?? '';
-  }
-  private get merchantId(): string {
-    return this.config.get<string>('cbe.merchantId') ?? '';
-  }
-  private get secretKey(): string {
-    return this.config.get<string>('cbe.secretKey') ?? '';
-  }
-  private get notifyUrl(): string {
-    return this.config.get<string>('cbe.notifyUrl') ?? '';
-  }
-  private get returnUrl(): string {
-    return this.config.get<string>('cbe.returnUrl') ?? '';
-  }
-}

apps/edr-passenger-api/src/modules/payments/providers/ebirr.provider.ts

@@ -1,228 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { AxiosError, AxiosRequestConfig } from 'axios';
-import { firstValueFrom } from 'rxjs';
-import * as crypto from 'node:crypto';
-import {
-  PaymentProvider,
-  ProviderInitiationInput,
-  ProviderInitiationResult,
-  ProviderStatus,
-} from '../payments.types';
-
-interface EBirrInitiateRequest {
-  merchantCode: string;
-  orderNo: string;
-  amount: number;
-  currency: string;
-  subject: string;
-  body: string;
-  notifyUrl: string;
-  returnUrl: string;
-  timestamp: number;
-  sign: string;
-}
-
-interface EBirrInitiateResponse {
-  code: string;
-  message: string;
-  data?: {
-    orderNo: string;
-    payUrl: string;
-    expireTime: number;
-  };
-}
-
-interface EBirrQueryResponse {
-  code: string;
-  message: string;
-  data?: {
-    orderNo: string;
-    tradeStatus: string;
-    tradeNo?: string;
-    totalAmount?: number;
-    payTime?: number;
-  };
-}
-
-@Injectable()
-export class EBirrProvider implements PaymentProvider {
-  readonly method = PaymentMethodType.EBIRR;
-  private readonly logger = new Logger(EBirrProvider.name);
-
-  constructor(
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {}
-
-  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
-    const amount = input.amountMinor / 100;
-    const timestamp = Date.now();
-    
-    const requestBody: EBirrInitiateRequest = {
-      merchantCode: this.merchantCode,
-      orderNo: input.merchantOrderId,
-      amount,
-      currency: input.currency,
-      subject: `EDR Ticket`,
-      body: `Train booking ${input.bookingRef}`,
-      notifyUrl: this.notifyUrl,
-      returnUrl: this.returnUrl,
-      timestamp,
-      sign: this.signRequest({
-        merchantCode: this.merchantCode,
-        orderNo: input.merchantOrderId,
-        amount,
-        timestamp,
-      }),
-    };
-
-    const response = await this.postJson<EBirrInitiateResponse>(
-      `${this.baseUrl}/gateway/api/pay/create`,
-      requestBody,
-    );
-
-    if (response.code !== '0000' || !response.data?.orderNo) {
-      throw new Error(`eBirr initiate failed: ${response.message}`);
-    }
-
-    const expiresAt = new Date(response.data.expireTime);
-
-    return {
-      providerOrderId: response.data.orderNo,
-      clientAction: { type: 'REDIRECT', url: response.data.payUrl },
-      expiresAt,
-      rawInitiation: {
-        request: this.sanitize(requestBody),
-        response,
-      },
-    };
-  }
-
-  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
-    const timestamp = Date.now();
-    const requestBody = {
-      merchantCode: this.merchantCode,
-      orderNo: merchantOrderId,
-      timestamp,
-      sign: this.signRequest({
-        merchantCode: this.merchantCode,
-        orderNo: merchantOrderId,
-        timestamp,
-      }),
-    };
-
-    const response = await this.postJson<EBirrQueryResponse>(
-      `${this.baseUrl}/gateway/api/pay/query`,
-      requestBody,
-    );
-
-    if (response.code !== '0000' || !response.data) {
-      throw new Error(`eBirr query failed: ${response.message}`);
-    }
-
-    const mapped = this.mapStatus(response.data.tradeStatus);
-
-    return {
-      status: mapped,
-      providerTxnId: response.data.tradeNo,
-      failureCode: mapped === PaymentIntentStatus.FAILED ? response.data.tradeStatus : undefined,
-      rawResponse: response as unknown as Record<string, unknown>,
-    };
-  }
-
-  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
-    const { sign, ...data } = payload;
-    if (!sign || typeof sign !== 'string') return false;
-    
-    const expectedSign = this.signRequest(data);
-    return crypto.timingSafeEqual(
-      Buffer.from(sign),
-      Buffer.from(expectedSign),
-    );
-  }
-
-  mapWebhookStatus(tradeStatus: string): PaymentIntentStatus {
-    return this.mapStatus(tradeStatus);
-  }
-
-  private mapStatus(tradeStatus: string): PaymentIntentStatus {
-    switch (tradeStatus?.toUpperCase()) {
-      case 'TRADE_SUCCESS':
-      case 'SUCCESS':
-        return PaymentIntentStatus.SUCCEEDED;
-      case 'TRADE_CLOSED':
-      case 'TRADE_FAILED':
-      case 'FAILED':
-        return PaymentIntentStatus.FAILED;
-      case 'WAIT_BUYER_PAY':
-      case 'PENDING':
-        return PaymentIntentStatus.REQUIRES_ACTION;
-      case 'PROCESSING':
-        return PaymentIntentStatus.PROCESSING;
-      default:
-        return PaymentIntentStatus.PROCESSING;
-    }
-  }
-
-  private signRequest(data: Record<string, unknown>): string {
-    const sortedKeys = Object.keys(data).sort();
-    const signString = sortedKeys
-      .map((key) => `${key}=${data[key]}`)
-      .join('&') + `&key=${this.secretKey}`;
-    
-    return crypto
-      .createHash('md5')
-      .update(signString)
-      .digest('hex')
-      .toUpperCase();
-  }
-
-  private async postJson<T>(url: string, body: unknown): Promise<T> {
-    const config: AxiosRequestConfig = {
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      timeout: 10_000,
-    };
-
-    const started = Date.now();
-    try {
-      const res = await firstValueFrom(this.http.post<T>(url, body, config));
-      this.logger.debug(`eBirr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
-      return res.data;
-    } catch (err) {
-      if (err instanceof AxiosError) {
-        this.logger.error(
-          `eBirr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
-        );
-      } else {
-        this.logger.error(`eBirr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
-      }
-      throw err;
-    }
-  }
-
-  private sanitize(body: EBirrInitiateRequest): Record<string, unknown> {
-    const { sign: _sign, ...rest } = body;
-    return rest;
-  }
-
-  private get baseUrl(): string {
-    return this.config.get<string>('ebirr.baseUrl') ?? '';
-  }
-  private get merchantCode(): string {
-    return this.config.get<string>('ebirr.merchantCode') ?? '';
-  }
-  private get secretKey(): string {
-    return this.config.get<string>('ebirr.secretKey') ?? '';
-  }
-  private get notifyUrl(): string {
-    return this.config.get<string>('ebirr.notifyUrl') ?? '';
-  }
-  private get returnUrl(): string {
-    return this.config.get<string>('ebirr.returnUrl') ?? '';
-  }
-}

apps/edr-passenger-api/src/modules/payments/providers/payment-provider.interface.ts

@@ -1,9 +0,0 @@
-export type {
-  PaymentProvider,
-  ProviderInitiationInput,
-  ProviderInitiationResult,
-  ProviderStatus,
-  ClientAction,
-} from '../payments.types';
-
-export const PAYMENT_PROVIDERS = Symbol('PAYMENT_PROVIDERS');

apps/edr-passenger-api/src/modules/payments/providers/telebirr.crypto.ts

@@ -1,98 +0,0 @@
-import * as crypto from 'crypto';
-
-const EXCLUDE_FIELDS = new Set([
-  'sign',
-  'sign_type',
-  'header',
-  'refund_info',
-  'openType',
-  'raw_request',
-  'biz_content',
-]);
-
-const NONCE_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
-
-export function buildCanonicalString(requestObject: Record<string, unknown>): string {
-  const fieldMap: Record<string, unknown> = {};
-
-  for (const key of Object.keys(requestObject)) {
-    if (EXCLUDE_FIELDS.has(key)) continue;
-    fieldMap[key] = requestObject[key];
-  }
-
-  const biz = requestObject['biz_content'];
-  if (biz && typeof biz === 'object') {
-    for (const key of Object.keys(biz as Record<string, unknown>)) {
-      if (EXCLUDE_FIELDS.has(key)) continue;
-      fieldMap[key] = (biz as Record<string, unknown>)[key];
-    }
-  }
-
-  return Object.keys(fieldMap)
-    .sort()
-    .map((k) => `${k}=${fieldMap[k]}`)
-    .join('&');
-}
-
-export function signRequestObject(
-  requestObject: Record<string, unknown>,
-  privateKey: string,
-): string {
-  return signString(buildCanonicalString(requestObject), privateKey);
-}
-
-export function verifyRequestObject(
-  requestObject: Record<string, unknown>,
-  publicKey: string,
-): boolean {
-  const signature = requestObject['sign'];
-  if (typeof signature !== 'string' || signature.length === 0) return false;
-  return verifySignature(buildCanonicalString(requestObject), signature, publicKey);
-}
-
-export function signString(text: string, privateKey: string): string {
-  const signature = crypto.sign('sha256', Buffer.from(text), {
-    key: privateKey,
-    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,
-  });
-  return signature.toString('base64');
-}
-
-export function verifySignature(
-  text: string,
-  signatureBase64: string,
-  publicKey: string,
-): boolean {
-  try {
-    return crypto.verify(
-      'sha256',
-      Buffer.from(text),
-      {
-        key: publicKey,
-        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
-        saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,
-      },
-      Buffer.from(signatureBase64, 'base64'),
-    );
-  } catch {
-    return false;
-  }
-}
-
-export function createTimestamp(): string {
-  return Math.round(Date.now() / 1000).toString();
-}
-
-export function createNonceStr(length = 32): string {
-  const bytes = crypto.randomBytes(length);
-  let out = '';
-  for (let i = 0; i < length; i++) {
-    out += NONCE_CHARS[bytes[i] % NONCE_CHARS.length];
-  }
-  return out;
-}
-
-export function createMerchantOrderId(): string {
-  return `${Date.now()}${crypto.randomBytes(4).toString('hex')}`;
-}

apps/edr-passenger-api/src/modules/payments/providers/telebirr.provider.ts

@@ -1,300 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { AxiosError, AxiosRequestConfig } from 'axios';
-import { firstValueFrom } from 'rxjs';
-import * as https from 'node:https';
-import {
-  PaymentProvider,
-  ProviderInitiationInput,
-  ProviderInitiationResult,
-  ProviderStatus,
-} from '../payments.types';
-import {
-  createNonceStr,
-  createTimestamp,
-  signRequestObject,
-  verifyRequestObject,
-} from './telebirr.crypto';
-import {
-  CreateOrderRequest,
-  CreateOrderResponse,
-  FabricTokenResponse,
-  QueryOrderResponse,
-} from './telebirr.types';
-
-const TELEBIRR_HTTP_TIMEOUT_MS = 10_000;
-
-@Injectable()
-export class TelebirrProvider implements PaymentProvider {
-  readonly method = PaymentMethodType.TELEBIRR;
-  private readonly logger = new Logger(TelebirrProvider.name);
-  private readonly httpsAgent: https.Agent;
-
-  constructor(
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {
-    const insecure = this.config.get<boolean>('telebirr.insecureTls');
-    if (insecure) {
-      this.logger.warn('TELEBIRR_INSECURE_TLS=true — TLS verification disabled for Telebirr calls. DEV ONLY.');
-    }
-    this.httpsAgent = new https.Agent({
-      rejectUnauthorized: !insecure,
-      secureProtocol: 'TLSv1_2_method',
-    });
-  }
-
-  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
-    const fabricToken = await this.applyFabricToken();
-    const requestBody = this.buildCreateOrderRequest(input);
-    const response = await this.requestCreateOrder(fabricToken, requestBody);
-
-    const prepayId = response.biz_content?.prepay_id;
-    if (!prepayId) {
-      throw new Error(
-        `Telebirr createOrder returned no prepay_id: ${JSON.stringify(response)}`,
-      );
-    }
-
-    const expiresAt = this.computeExpiresAt(requestBody.biz_content.timeout_express);
-    const platform = input.platform ?? 'web';
-    const clientAction =
-      platform === 'mobile'
-        ? {
-            type: 'LAUNCH_APP' as const,
-            prepayId,
-            receiveCode: response.biz_content?.receiveCode,
-            shortCode: this.merchantCode,
-          }
-        : { type: 'REDIRECT' as const, url: this.buildCheckoutUrl(prepayId) };
-
-    return {
-      providerOrderId: prepayId,
-      clientAction,
-      expiresAt,
-      rawInitiation: {
-        request: this.sanitize(requestBody),
-        response,
-      },
-    };
-  }
-
-  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
-    const fabricToken = await this.applyFabricToken();
-    const requestBody = this.buildQueryOrderRequest(merchantOrderId);
-    const response = await this.postJson<QueryOrderResponse>(
-      `${this.baseUrl}/payment/v1/merchant/queryOrder`,
-      requestBody,
-      {
-        'Content-Type': 'application/json',
-        'X-APP-Key': this.fabricAppId,
-        Authorization: fabricToken,
-      },
-    );
-
-    const tradeStatus = response.biz_content?.trade_status;
-    const providerTxnId =
-      response.biz_content?.trans_id ?? response.biz_content?.payment_order_id;
-    const mapped = this.mapTradeStatus(tradeStatus);
-
-    return {
-      status: mapped,
-      providerTxnId,
-      failureCode:
-        mapped === PaymentIntentStatus.FAILED && tradeStatus ? tradeStatus : undefined,
-      rawResponse: response as Record<string, unknown>,
-    };
-  }
-
-  mapTradeStatus(tradeStatus: string | undefined): PaymentIntentStatus {
-    switch (tradeStatus) {
-      case 'PAY_SUCCESS':
-        return PaymentIntentStatus.SUCCEEDED;
-      case 'PAY_FAILED':
-      case 'ORDER_CLOSED':
-        return PaymentIntentStatus.FAILED;
-      case 'WAIT_PAY':
-        return PaymentIntentStatus.REQUIRES_ACTION;
-      case 'PAYING':
-        return PaymentIntentStatus.PROCESSING;
-      default:
-        return PaymentIntentStatus.PROCESSING;
-    }
-  }
-
-  mapWebhookTradeStatus(tradeStatus: string | undefined): PaymentIntentStatus {
-    switch (tradeStatus) {
-      case 'Completed':
-        return PaymentIntentStatus.SUCCEEDED;
-      case 'Failure':
-      case 'Expired':
-        return PaymentIntentStatus.FAILED;
-      case 'Paying':
-      case 'Pending':
-        return PaymentIntentStatus.PROCESSING;
-      default:
-        return PaymentIntentStatus.PROCESSING;
-    }
-  }
-
-  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
-    if (!this.publicKey) {
-      this.logger.error('TELEBIRR_PUBLIC_KEY not configured; rejecting all webhooks');
-      return false;
-    }
-    return verifyRequestObject(payload, this.publicKey);
-  }
-
-  private async applyFabricToken(): Promise<string> {
-    const response = await this.postJson<FabricTokenResponse>(
-      `${this.baseUrl}/payment/v1/token`,
-      { appSecret: this.appSecret },
-      {
-        'Content-Type': 'application/json',
-        'X-APP-Key': this.fabricAppId,
-      },
-    );
-    if (!response?.token) {
-      throw new Error(`Telebirr token request failed: ${JSON.stringify(response)}`);
-    }
-    return response.token;
-  }
-
-  private async requestCreateOrder(
-    fabricToken: string,
-    body: CreateOrderRequest,
-  ): Promise<CreateOrderResponse> {
-    return this.postJson<CreateOrderResponse>(
-      `${this.baseUrl}/payment/v1/inapp/createOrder`,
-      body,
-      {
-        'Content-Type': 'application/json',
-        'X-APP-Key': this.fabricAppId,
-        Authorization: fabricToken,
-      },
-    );
-  }
-
-  private buildCreateOrderRequest(input: ProviderInitiationInput): CreateOrderRequest {
-    const totalAmount = String(input.amountMinor / 100);
-    const req = {
-      timestamp: createTimestamp(),
-      nonce_str: createNonceStr(),
-      method: 'payment.preorder' as const,
-      version: '1.0' as const,
-      biz_content: {
-        notify_url: this.notifyUrl,
-        appid: this.merchantAppId,
-        merch_code: this.merchantCode,
-        merch_order_id: input.merchantOrderId,
-        trade_type: 'Checkout' as const,
-        title: `EDR Booking`,
-        total_amount: totalAmount,
-        trans_currency: input.currency,
-        timeout_express: this.timeoutExpress,
-      },
-    };
-    const sign = signRequestObject(req as unknown as Record<string, unknown>, this.privateKey);
-    return { ...req, sign, sign_type: 'SHA256WithRSA' };
-  }
-
-  private buildQueryOrderRequest(merchantOrderId: string): Record<string, unknown> {
-    const req = {
-      timestamp: createTimestamp(),
-      nonce_str: createNonceStr(),
-      method: 'payment.queryorder',
-      version: '1.0',
-      biz_content: {
-        appid: this.merchantAppId,
-        merch_code: this.merchantCode,
-        merch_order_id: merchantOrderId,
-      },
-    };
-    const sign = signRequestObject(req as Record<string, unknown>, this.privateKey);
-    return { ...req, sign, sign_type: 'SHA256WithRSA' };
-  }
-
-  private buildCheckoutUrl(prepayId: string): string {
-    const map: Record<string, string> = {
-      appid: this.merchantAppId,
-      merch_code: this.merchantCode,
-      nonce_str: createNonceStr(),
-      prepay_id: prepayId,
-      timestamp: createTimestamp(),
-    };
-    const sign = signRequestObject(map, this.privateKey);
-    const rawRequest = [
-      `appid=${map.appid}`,
-      `merch_code=${map.merch_code}`,
-      `nonce_str=${map.nonce_str}`,
-      `prepay_id=${map.prepay_id}`,
-      `timestamp=${map.timestamp}`,
-      'sign_type=SHA256WithRSA',
-      `sign=${sign}`,
-      'version=1.0',
-      'trade_type=Checkout',
-    ].join('&');
-    return `${this.webBaseUrl}${rawRequest}`;
-  }
-
-  private computeExpiresAt(timeoutExpress: string): Date {
-    const match = /^(\d+)([smhd])$/.exec(timeoutExpress);
-    const minutes = match ? this.toMinutes(parseInt(match[1], 10), match[2]) : 15;
-    return new Date(Date.now() + minutes * 60_000);
-  }
-
-  private toMinutes(n: number, unit: string): number {
-    switch (unit) {
-      case 's': return Math.max(1, Math.round(n / 60));
-      case 'm': return n;
-      case 'h': return n * 60;
-      case 'd': return n * 60 * 24;
-      default: return 15;
-    }
-  }
-
-  private async postJson<T>(
-    url: string,
-    body: unknown,
-    headers: Record<string, string>,
-  ): Promise<T> {
-    const config: AxiosRequestConfig = {
-      headers,
-      timeout: TELEBIRR_HTTP_TIMEOUT_MS,
-      httpsAgent: this.httpsAgent,
-    };
-    const started = Date.now();
-    try {
-      const res = await firstValueFrom(this.http.post<T>(url, body, config));
-      this.logger.debug(`Telebirr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
-      return res.data;
-    } catch (err) {
-      if (err instanceof AxiosError) {
-        this.logger.error(
-          `Telebirr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)} code=${err.code} message=${err.message}`,
-        );
-      } else {
-        this.logger.error(`Telebirr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
-      }
-      throw err;
-    }
-  }
-
-  private sanitize(body: CreateOrderRequest): Record<string, unknown> {
-    const { sign: _sign, ...rest } = body;
-    return rest;
-  }
-
-  private get baseUrl(): string { return this.config.get<string>('telebirr.baseUrl') ?? ''; }
-  private get webBaseUrl(): string { return this.config.get<string>('telebirr.webBaseUrl') ?? ''; }
-  private get fabricAppId(): string { return this.config.get<string>('telebirr.fabricAppId') ?? ''; }
-  private get appSecret(): string { return this.config.get<string>('telebirr.appSecret') ?? ''; }
-  private get merchantAppId(): string { return this.config.get<string>('telebirr.merchantAppId') ?? ''; }
-  private get merchantCode(): string { return this.config.get<string>('telebirr.merchantCode') ?? ''; }
-  private get notifyUrl(): string { return this.config.get<string>('telebirr.notifyUrl') ?? ''; }
-  private get timeoutExpress(): string { return this.config.get<string>('telebirr.timeoutExpress') ?? '15m'; }
-  private get privateKey(): string { return this.config.get<string>('telebirr.privateKey') ?? ''; }
-  private get publicKey(): string { return this.config.get<string>('telebirr.publicKey') ?? ''; }
-}

apps/edr-passenger-api/src/modules/payments/providers/telebirr.types.ts

@@ -1,69 +0,0 @@
-export interface FabricTokenResponse {
-  token: string;
-  expires_in?: number | string;
-}
-
-export interface CreateOrderBizContent {
-  notify_url: string;
-  appid: string;
-  merch_code: string;
-  merch_order_id: string;
-  trade_type: 'Checkout' | 'InApp' | 'MiniApp';
-  title: string;
-  total_amount: string;
-  trans_currency: string;
-  timeout_express: string;
-}
-
-export interface CreateOrderRequest {
-  timestamp: string;
-  nonce_str: string;
-  method: 'payment.preorder';
-  version: '1.0';
-  biz_content: CreateOrderBizContent;
-  sign: string;
-  sign_type: 'SHA256WithRSA';
-}
-
-export interface CreateOrderResponse {
-  code?: string;
-  msg?: string;
-  biz_content?: {
-    prepay_id?: string;
-    receiveCode?: string;
-    [key: string]: unknown;
-  };
-  [key: string]: unknown;
-}
-
-export type TelebirrTradeStatus =
-  | 'PAY_SUCCESS'
-  | 'PAY_FAILED'
-  | 'WAIT_PAY'
-  | 'ORDER_CLOSED'
-  | 'PAYING'
-  | 'ACCEPTED'
-  | 'REFUNDING'
-  | 'REFUND_SUCCESS'
-  | 'REFUND_FAILED';
-
-export interface QueryOrderResponse {
-  result?: 'SUCCESS' | 'FAIL';
-  code?: string;
-  msg?: string;
-  nonce_str?: string;
-  sign?: string;
-  sign_type?: string;
-  biz_content?: {
-    merch_order_id?: string;
-    order_status?: string;
-    trade_status?: TelebirrTradeStatus | string;
-    payment_order_id?: string;
-    trans_id?: string;
-    trans_time?: string;
-    trans_currency?: string;
-    total_amount?: string;
-    [key: string]: unknown;
-  };
-  [key: string]: unknown;
-}

apps/edr-passenger-api/src/modules/payments/providers/waafi.provider.ts

@@ -1,274 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { AxiosError, AxiosRequestConfig } from 'axios';
-import { firstValueFrom } from 'rxjs';
-import {
-  PaymentProvider,
-  ProviderInitiationInput,
-  ProviderInitiationResult,
-  ProviderStatus,
-} from '../payments.types';
-
-const WAAFI_HTTP_TIMEOUT_MS = 10_000;
-
-interface WaafiInitiateRequest {
-  schemaVersion: string;
-  requestId: string;
-  timestamp: string;
-  channelName: string;
-  serviceName: string;
-  serviceParams: {
-    merchantUid: string;
-    apiUserId: string;
-    apiKey: string;
-    paymentMethod: string;
-    payerInfo: {
-      accountNo: string;
-    };
-    transactionInfo: {
-      referenceId: string;
-      invoiceId: string;
-      amount: number;
-      currency: string;
-      description: string;
-    };
-  };
-}
-
-interface WaafiInitiateResponse {
-  responseCode: string;
-  responseMsg: string;
-  params?: {
-    state: string;
-    referenceId: string;
-    transactionId: string;
-    checkoutUrl?: string;
-  };
-}
-
-interface WaafiQueryRequest {
-  schemaVersion: string;
-  requestId: string;
-  timestamp: string;
-  channelName: string;
-  serviceName: string;
-  serviceParams: {
-    merchantUid: string;
-    apiUserId: string;
-    apiKey: string;
-    transactionId?: string;
-    referenceId?: string;
-  };
-}
-
-interface WaafiQueryResponse {
-  responseCode: string;
-  responseMsg: string;
-  params?: {
-    state: string;
-    referenceId: string;
-    transactionId: string;
-    amount: number;
-    currency: string;
-    paidAmount?: number;
-  };
-}
-
-@Injectable()
-export class WaafiProvider implements PaymentProvider {
-  readonly method = PaymentMethodType.WAAFI;
-  private readonly logger = new Logger(WaafiProvider.name);
-
-  constructor(
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {}
-
-  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
-    const requestBody = this.buildInitiateRequest(input);
-    const response = await this.postJson<WaafiInitiateResponse>(
-      `${this.baseUrl}/asm`,
-      requestBody,
-    );
-
-    if (response.responseCode !== '2001') {
-      throw new Error(
-        `Waafi initiate failed: ${response.responseCode} - ${response.responseMsg}`,
-      );
-    }
-
-    const transactionId = response.params?.transactionId;
-    const checkoutUrl = response.params?.checkoutUrl || `${this.baseUrl}/checkout?ref=${transactionId}`;
-
-    if (!transactionId) {
-      throw new Error(`Waafi returned no transactionId: ${JSON.stringify(response)}`);
-    }
-
-    const expiresAt = new Date(Date.now() + 15 * 60_000); // 15 minutes
-
-    return {
-      providerOrderId: transactionId,
-      clientAction: { type: 'REDIRECT', url: checkoutUrl },
-      expiresAt,
-      rawInitiation: {
-        request: this.sanitize(requestBody),
-        response,
-      },
-    };
-  }
-
-  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
-    const requestBody = this.buildQueryRequest(merchantOrderId);
-    const response = await this.postJson<WaafiQueryResponse>(
-      `${this.baseUrl}/asm`,
-      requestBody,
-    );
-
-    const state = response.params?.state;
-    const transactionId = response.params?.transactionId;
-    const mapped = this.mapState(state);
-
-    return {
-      status: mapped,
-      providerTxnId: transactionId,
-      failureCode: mapped === PaymentIntentStatus.FAILED && state ? state : undefined,
-      rawResponse: response as unknown as Record<string, unknown>,
-    };
-  }
-
-  mapState(state: string | undefined): PaymentIntentStatus {
-    switch (state) {
-      case 'APPROVED':
-      case 'SUCCESS':
-        return PaymentIntentStatus.SUCCEEDED;
-      case 'FAILED':
-      case 'DECLINED':
-      case 'CANCELLED':
-      case 'EXPIRED':
-        return PaymentIntentStatus.FAILED;
-      case 'PENDING':
-      case 'INITIATED':
-        return PaymentIntentStatus.REQUIRES_ACTION;
-      case 'PROCESSING':
-        return PaymentIntentStatus.PROCESSING;
-      default:
-        return PaymentIntentStatus.PROCESSING;
-    }
-  }
-
-  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
-    // Waafi webhook signature verification
-    // Implementation depends on Waafi's webhook signature mechanism
-    const signature = payload.signature as string;
-    const apiKey = this.apiKey;
-
-    if (!signature || !apiKey) {
-      this.logger.error('Waafi webhook missing signature or API key not configured');
-      return false;
-    }
-
-    // TODO: Implement actual signature verification based on Waafi documentation
-    // For now, basic validation
-    return signature.length > 0;
-  }
-
-  private buildInitiateRequest(input: ProviderInitiationInput): WaafiInitiateRequest {
-    const amount = input.amountMinor / 100; // Convert minor units to major
-
-    return {
-      schemaVersion: '1.0',
-      requestId: this.generateRequestId(),
-      timestamp: new Date().toISOString(),
-      channelName: 'WEB',
-      serviceName: 'API_PURCHASE',
-      serviceParams: {
-        merchantUid: this.merchantUid,
-        apiUserId: this.apiUserId,
-        apiKey: this.apiKey,
-        paymentMethod: 'MWALLET_ACCOUNT',
-        payerInfo: {
-          accountNo: 'CUSTOMER', // Customer enters their number on Waafi page
-        },
-        transactionInfo: {
-          referenceId: input.merchantOrderId,
-          invoiceId: input.bookingRef,
-          amount,
-          currency: input.currency === 'ETB' ? 'DJF' : input.currency, // Convert ETB to DJF
-          description: `EDR Train Booking ${input.bookingRef}`,
-        },
-      },
-    };
-  }
-
-  private buildQueryRequest(merchantOrderId: string): WaafiQueryRequest {
-    return {
-      schemaVersion: '1.0',
-      requestId: this.generateRequestId(),
-      timestamp: new Date().toISOString(),
-      channelName: 'WEB',
-      serviceName: 'API_QUERY',
-      serviceParams: {
-        merchantUid: this.merchantUid,
-        apiUserId: this.apiUserId,
-        apiKey: this.apiKey,
-        referenceId: merchantOrderId,
-      },
-    };
-  }
-
-  private generateRequestId(): string {
-    return `EDR-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
-  }
-
-  private async postJson<T>(url: string, body: unknown): Promise<T> {
-    const config: AxiosRequestConfig = {
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      timeout: WAAFI_HTTP_TIMEOUT_MS,
-    };
-
-    const started = Date.now();
-    try {
-      const res = await firstValueFrom(this.http.post<T>(url, body, config));
-      this.logger.debug(
-        `Waafi POST ${url} status=${res.status} latency=${Date.now() - started}ms`,
-      );
-      return res.data;
-    } catch (err) {
-      if (err instanceof AxiosError) {
-        this.logger.error(
-          `Waafi POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)} code=${err.code} message=${err.message}`,
-        );
-      } else {
-        this.logger.error(
-          `Waafi POST ${url} threw: ${err instanceof Error ? err.message : err}`,
-        );
-      }
-      throw err;
-    }
-  }
-
-  private sanitize(body: WaafiInitiateRequest): Record<string, unknown> {
-    const sanitized = { ...body };
-    if (sanitized.serviceParams?.apiKey) {
-      sanitized.serviceParams.apiKey = '***REDACTED***';
-    }
-    return sanitized as unknown as Record<string, unknown>;
-  }
-
-  private get baseUrl(): string {
-    return this.config.get<string>('waafi.baseUrl') ?? 'https://api.waafipay.net';
-  }
-  private get merchantUid(): string {
-    return this.config.get<string>('waafi.merchantUid') ?? '';
-  }
-  private get apiUserId(): string {
-    return this.config.get<string>('waafi.apiUserId') ?? '';
-  }
-  private get apiKey(): string {
-    return this.config.get<string>('waafi.apiKey') ?? '';
-  }
-}

apps/edr-passenger-api/src/modules/payments/webhooks/card-webhook.service.ts

@@ -1,147 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { PrismaService } from '../../../common/prisma.service';
-import { PaymentsService } from '../payments.service';
-import { CardProvider } from '../providers/card.provider';
-
-export interface CardWebhookPayload {
-  id: string;
-  type: string;
-  data: {
-    object: {
-      id: string;
-      status: string;
-      amount: number;
-      currency: string;
-      metadata: {
-        merchantOrderId: string;
-        bookingRef: string;
-      };
-      transaction_id?: string;
-      paid_at?: number;
-      failure_code?: string;
-      failure_message?: string;
-    };
-  };
-  created: number;
-}
-
-@Injectable()
-export class CardWebhookService {
-  private readonly logger = new Logger(CardWebhookService.name);
-
-  constructor(
-    private readonly prisma: PrismaService,
-    private readonly provider: CardProvider,
-    private readonly payments: PaymentsService,
-  ) {}
-
-  async handle(payload: CardWebhookPayload, signature: string): Promise<void> {
-    const merchantOrderId = payload.data.object.metadata.merchantOrderId;
-    const externalEventId = `${payload.id}_${payload.type}`;
-    const signatureValid = this.provider.verifyWebhookSignature(
-      payload as unknown as Record<string, unknown>,
-      signature,
-    );
-
-    const eventRow = await this.persistEvent({
-      externalEventId,
-      merchantOrderId,
-      providerTxnId: payload.data.object.transaction_id,
-      signatureValid,
-      status: payload.data.object.status,
-      payload,
-    });
-
-    if (!eventRow) {
-      this.logger.log(`Card webhook duplicate: ${externalEventId} — short-circuit OK`);
-      return;
-    }
-
-    if (!signatureValid) {
-      this.logger.warn(`Card webhook signature invalid for merchantOrderId=${merchantOrderId}`);
-      await this.markProcessed(eventRow.id, 'signature-invalid');
-      return;
-    }
-
-    const intent = await this.prisma.paymentIntent.findUnique({
-      where: { merchantOrderId },
-    });
-    if (!intent) {
-      this.logger.warn(`Card webhook: no PaymentIntent for merchantOrderId=${merchantOrderId}`);
-      await this.markProcessed(eventRow.id, 'intent-not-found');
-      return;
-    }
-
-    const mapped = this.provider.mapWebhookStatus(payload.data.object.status);
-
-    try {
-      if (mapped === PaymentIntentStatus.SUCCEEDED) {
-        await this.payments.finalizePaymentSuccess({
-          intentId: intent.id,
-          providerTxnId: payload.data.object.transaction_id,
-          paidAt: payload.data.object.paid_at ? new Date(payload.data.object.paid_at * 1000) : undefined,
-        });
-      } else if (mapped === PaymentIntentStatus.FAILED) {
-        await this.payments.markPaymentFailed({
-          intentId: intent.id,
-          failureCode: payload.data.object.failure_code,
-          failureMessage: payload.data.object.failure_message,
-        });
-      } else {
-        await this.prisma.paymentIntent.update({
-          where: { id: intent.id },
-          data: {
-            status: mapped,
-            providerTxnId: payload.data.object.transaction_id ?? undefined,
-          },
-        });
-      }
-      await this.markProcessed(eventRow.id);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`Card webhook processing failed for ${merchantOrderId}: ${message}`);
-      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
-      throw err;
-    }
-  }
-
-  private async persistEvent(input: {
-    externalEventId: string;
-    merchantOrderId: string;
-    providerTxnId?: string;
-    signatureValid: boolean;
-    status: string;
-    payload: CardWebhookPayload;
-  }): Promise<{ id: string } | null> {
-    try {
-      return await this.prisma.paymentWebhookEvent.create({
-        data: {
-          provider: PaymentMethodType.CARD,
-          externalEventId: input.externalEventId,
-          merchantOrderId: input.merchantOrderId,
-          providerTxnId: input.providerTxnId,
-          signatureValid: input.signatureValid,
-          status: input.status,
-          payload: input.payload as unknown as Prisma.InputJsonValue,
-        },
-        select: { id: true },
-      });
-    } catch (err) {
-      if (
-        err instanceof Prisma.PrismaClientKnownRequestError &&
-        err.code === 'P2002'
-      ) {
-        return null;
-      }
-      throw err;
-    }
-  }
-
-  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
-    await this.prisma.paymentWebhookEvent.update({
-      where: { id: eventId },
-      data: { processedAt: new Date(), processingError },
-    });
-  }
-}

apps/edr-passenger-api/src/modules/payments/webhooks/cbe-birr-webhook.service.ts

@@ -1,133 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { PrismaService } from '../../../common/prisma.service';
-import { PaymentsService } from '../payments.service';
-import { CbeBirrProvider } from '../providers/cbe-birr.provider';
-
-export interface CbeBirrWebhookPayload {
-  merchantId: string;
-  merchantOrderId: string;
-  orderId: string;
-  status: string;
-  transactionId?: string;
-  amount?: string;
-  currency?: string;
-  paidAt?: string;
-  signature: string;
-  [key: string]: unknown;
-}
-
-@Injectable()
-export class CbeBirrWebhookService {
-  private readonly logger = new Logger(CbeBirrWebhookService.name);
-
-  constructor(
-    private readonly prisma: PrismaService,
-    private readonly provider: CbeBirrProvider,
-    private readonly payments: PaymentsService,
-  ) {}
-
-  async handle(payload: CbeBirrWebhookPayload): Promise<void> {
-    const merchantOrderId = payload.merchantOrderId;
-    const externalEventId = `${payload.orderId}_${payload.status}`;
-    const signatureValid = this.provider.verifyWebhookSignature(
-      payload as unknown as Record<string, unknown>,
-    );
-
-    const eventRow = await this.persistEvent({
-      externalEventId,
-      merchantOrderId,
-      providerTxnId: payload.transactionId ?? payload.orderId,
-      signatureValid,
-      status: payload.status,
-      payload,
-    });
-
-    if (!eventRow) {
-      this.logger.log(`CBE Birr webhook duplicate: ${externalEventId} — short-circuit OK`);
-      return;
-    }
-
-    if (!signatureValid) {
-      this.logger.warn(`CBE Birr webhook signature invalid for merchantOrderId=${merchantOrderId}`);
-      await this.markProcessed(eventRow.id, 'signature-invalid');
-      return;
-    }
-
-    const intent = await this.prisma.paymentIntent.findUnique({
-      where: { merchantOrderId },
-    });
-    if (!intent) {
-      this.logger.warn(`CBE Birr webhook: no PaymentIntent for merchantOrderId=${merchantOrderId}`);
-      await this.markProcessed(eventRow.id, 'intent-not-found');
-      return;
-    }
-
-    const mapped = this.provider.mapWebhookStatus(payload.status);
-
-    try {
-      if (mapped === PaymentIntentStatus.SUCCEEDED) {
-        await this.payments.finalizePaymentSuccess({
-          intentId: intent.id,
-          providerTxnId: payload.transactionId ?? payload.orderId,
-          paidAt: payload.paidAt ? new Date(payload.paidAt) : undefined,
-        });
-      } else if (mapped === PaymentIntentStatus.FAILED) {
-        await this.payments.markPaymentFailed({
-          intentId: intent.id,
-          failureCode: payload.status,
-        });
-      } else {
-        await this.prisma.paymentIntent.update({
-          where: { id: intent.id },
-          data: { status: mapped, providerTxnId: payload.transactionId ?? undefined },
-        });
-      }
-      await this.markProcessed(eventRow.id);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`CBE Birr webhook processing failed for ${merchantOrderId}: ${message}`);
-      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
-      throw err;
-    }
-  }
-
-  private async persistEvent(input: {
-    externalEventId: string;
-    merchantOrderId: string;
-    providerTxnId?: string;
-    signatureValid: boolean;
-    status: string;
-    payload: CbeBirrWebhookPayload;
-  }): Promise<{ id: string } | null> {
-    try {
-      return await this.prisma.paymentWebhookEvent.create({
-        data: {
-          provider: PaymentMethodType.CBE_BIRR,
-          externalEventId: input.externalEventId,
-          merchantOrderId: input.merchantOrderId,
-          providerTxnId: input.providerTxnId,
-          signatureValid: input.signatureValid,
-          status: input.status,
-          payload: input.payload as unknown as Prisma.InputJsonValue,
-        },
-        select: { id: true },
-      });
-    } catch (err) {
-      if (
-        err instanceof Prisma.PrismaClientKnownRequestError &&
-        err.code === 'P2002'
-      ) {
-        return null;
-      }
-      throw err;
-    }
-  }
-
-  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
-    await this.prisma.paymentWebhookEvent.update({
-      where: { id: eventId },
-      data: { processedAt: new Date(), processingError },
-    });
-  }
-}

apps/edr-passenger-api/src/modules/payments/webhooks/ebirr-webhook.service.ts

@@ -1,133 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { PrismaService } from '../../../common/prisma.service';
-import { PaymentsService } from '../payments.service';
-import { EBirrProvider } from '../providers/ebirr.provider';
-
-export interface EBirrWebhookPayload {
-  merchantCode: string;
-  orderNo: string;
-  tradeStatus: string;
-  tradeNo?: string;
-  totalAmount?: number;
-  currency?: string;
-  payTime?: number;
-  timestamp: number;
-  sign: string;
-  [key: string]: unknown;
-}
-
-@Injectable()
-export class EBirrWebhookService {
-  private readonly logger = new Logger(EBirrWebhookService.name);
-
-  constructor(
-    private readonly prisma: PrismaService,
-    private readonly provider: EBirrProvider,
-    private readonly payments: PaymentsService,
-  ) {}
-
-  async handle(payload: EBirrWebhookPayload): Promise<void> {
-    const merchantOrderId = payload.orderNo;
-    const externalEventId = `${payload.orderNo}_${payload.tradeStatus}_${payload.timestamp}`;
-    const signatureValid = this.provider.verifyWebhookSignature(
-      payload as unknown as Record<string, unknown>,
-    );
-
-    const eventRow = await this.persistEvent({
-      externalEventId,
-      merchantOrderId,
-      providerTxnId: payload.tradeNo,
-      signatureValid,
-      status: payload.tradeStatus,
-      payload,
-    });
-
-    if (!eventRow) {
-      this.logger.log(`eBirr webhook duplicate: ${externalEventId} — short-circuit OK`);
-      return;
-    }
-
-    if (!signatureValid) {
-      this.logger.warn(`eBirr webhook signature invalid for orderNo=${merchantOrderId}`);
-      await this.markProcessed(eventRow.id, 'signature-invalid');
-      return;
-    }
-
-    const intent = await this.prisma.paymentIntent.findUnique({
-      where: { merchantOrderId },
-    });
-    if (!intent) {
-      this.logger.warn(`eBirr webhook: no PaymentIntent for orderNo=${merchantOrderId}`);
-      await this.markProcessed(eventRow.id, 'intent-not-found');
-      return;
-    }
-
-    const mapped = this.provider.mapWebhookStatus(payload.tradeStatus);
-
-    try {
-      if (mapped === PaymentIntentStatus.SUCCEEDED) {
-        await this.payments.finalizePaymentSuccess({
-          intentId: intent.id,
-          providerTxnId: payload.tradeNo,
-          paidAt: payload.payTime ? new Date(payload.payTime) : undefined,
-        });
-      } else if (mapped === PaymentIntentStatus.FAILED) {
-        await this.payments.markPaymentFailed({
-          intentId: intent.id,
-          failureCode: payload.tradeStatus,
-        });
-      } else {
-        await this.prisma.paymentIntent.update({
-          where: { id: intent.id },
-          data: { status: mapped, providerTxnId: payload.tradeNo ?? undefined },
-        });
-      }
-      await this.markProcessed(eventRow.id);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`eBirr webhook processing failed for ${merchantOrderId}: ${message}`);
-      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
-      throw err;
-    }
-  }
-
-  private async persistEvent(input: {
-    externalEventId: string;
-    merchantOrderId: string;
-    providerTxnId?: string;
-    signatureValid: boolean;
-    status: string;
-    payload: EBirrWebhookPayload;
-  }): Promise<{ id: string } | null> {
-    try {
-      return await this.prisma.paymentWebhookEvent.create({
-        data: {
-          provider: PaymentMethodType.EBIRR,
-          externalEventId: input.externalEventId,
-          merchantOrderId: input.merchantOrderId,
-          providerTxnId: input.providerTxnId,
-          signatureValid: input.signatureValid,
-          status: input.status,
-          payload: input.payload as unknown as Prisma.InputJsonValue,
-        },
-        select: { id: true },
-      });
-    } catch (err) {
-      if (
-        err instanceof Prisma.PrismaClientKnownRequestError &&
-        err.code === 'P2002'
-      ) {
-        return null;
-      }
-      throw err;
-    }
-  }
-
-  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
-    await this.prisma.paymentWebhookEvent.update({
-      where: { id: eventId },
-      data: { processedAt: new Date(), processingError },
-    });
-  }
-}

apps/edr-passenger-api/src/modules/payments/webhooks/telebirr-webhook.service.ts

@@ -1,153 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-import { PrismaService } from '../../../common/prisma.service';
-import { PaymentsService } from '../payments.service';
-import { TelebirrProvider } from '../providers/telebirr.provider';
-
-export interface TelebirrWebhookPayload {
-  merch_order_id: string;
-  payment_order_id: string;
-  trade_status: string;
-  trans_id?: string;
-  total_amount?: string;
-  trans_currency?: string;
-  notify_time?: string;
-  trans_end_time?: string;
-  sign: string;
-  sign_type?: string;
-  [key: string]: unknown;
-}
-
-@Injectable()
-export class TelebirrWebhookService {
-  private readonly logger = new Logger(TelebirrWebhookService.name);
-
-  constructor(
-    private readonly prisma: PrismaService,
-    private readonly provider: TelebirrProvider,
-    private readonly payments: PaymentsService,
-  ) {}
-
-  async handle(payload: TelebirrWebhookPayload): Promise<void> {
-    const merchantOrderId = payload.merch_order_id;
-    const externalEventId = this.buildExternalEventId(payload);
-    const signatureValid = this.provider.verifyWebhookSignature(
-      payload as unknown as Record<string, unknown>,
-    );
-
-    const eventRow = await this.persistEvent({
-      externalEventId,
-      merchantOrderId,
-      providerTxnId: payload.trans_id ?? payload.payment_order_id,
-      signatureValid,
-      status: payload.trade_status,
-      payload,
-    });
-
-    if (!eventRow) {
-      this.logger.log(
-        `Telebirr webhook duplicate: ${externalEventId} — short-circuit OK`,
-      );
-      return;
-    }
-
-    if (!signatureValid) {
-      this.logger.warn(
-        `Telebirr webhook signature invalid for merch_order_id=${merchantOrderId}`,
-      );
-      await this.markProcessed(eventRow.id, 'signature-invalid');
-      return;
-    }
-
-    const intent = await this.prisma.paymentIntent.findUnique({
-      where: { merchantOrderId },
-    });
-    if (!intent) {
-      this.logger.warn(
-        `Telebirr webhook: no PaymentIntent for merch_order_id=${merchantOrderId}`,
-      );
-      await this.markProcessed(eventRow.id, 'intent-not-found');
-      return;
-    }
-
-    const mapped = this.provider.mapWebhookTradeStatus(payload.trade_status);
-
-    try {
-      if (mapped === PaymentIntentStatus.SUCCEEDED) {
-        await this.payments.finalizePaymentSuccess({
-          intentId: intent.id,
-          providerTxnId: payload.trans_id ?? payload.payment_order_id,
-          paidAt: this.parseEpochSeconds(payload.trans_end_time),
-        });
-      } else if (mapped === PaymentIntentStatus.FAILED) {
-        await this.payments.markPaymentFailed({
-          intentId: intent.id,
-          failureCode: payload.trade_status,
-        });
-      } else {
-        await this.prisma.paymentIntent.update({
-          where: { id: intent.id },
-          data: { status: mapped, providerTxnId: payload.trans_id ?? undefined },
-        });
-      }
-      await this.markProcessed(eventRow.id);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(
-        `Telebirr webhook processing failed for ${merchantOrderId}: ${message}`,
-      );
-      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
-      throw err;
-    }
-  }
-
-  private buildExternalEventId(payload: TelebirrWebhookPayload): string {
-    return `${payload.payment_order_id}_${payload.trade_status}`;
-  }
-
-  private async persistEvent(input: {
-    externalEventId: string;
-    merchantOrderId: string;
-    providerTxnId?: string;
-    signatureValid: boolean;
-    status: string;
-    payload: TelebirrWebhookPayload;
-  }): Promise<{ id: string } | null> {
-    try {
-      return await this.prisma.paymentWebhookEvent.create({
-        data: {
-          provider: PaymentMethodType.TELEBIRR,
-          externalEventId: input.externalEventId,
-          merchantOrderId: input.merchantOrderId,
-          providerTxnId: input.providerTxnId,
-          signatureValid: input.signatureValid,
-          status: input.status,
-          payload: input.payload as unknown as Prisma.InputJsonValue,
-        },
-        select: { id: true },
-      });
-    } catch (err) {
-      if (
-        err instanceof Prisma.PrismaClientKnownRequestError &&
-        err.code === 'P2002'
-      ) {
-        return null;
-      }
-      throw err;
-    }
-  }
-
-  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
-    await this.prisma.paymentWebhookEvent.update({
-      where: { id: eventId },
-      data: { processedAt: new Date(), processingError },
-    });
-  }
-
-  private parseEpochSeconds(raw: string | undefined): Date | undefined {
-    if (!raw) return undefined;
-    const n = parseInt(raw, 10);
-    if (Number.isNaN(n)) return undefined;
-    return new Date(n * 1000);
-  }
-}

apps/edr-passenger-api/src/modules/payments/webhooks/waafi-webhook.service.ts

@@ -1,105 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { PrismaService } from '../../../common/prisma.service';
-import { PaymentsService } from '../payments.service';
-import { WaafiProvider } from '../providers/waafi.provider';
-import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
-
-interface WaafiWebhookPayload {
-  schemaVersion: string;
-  requestId: string;
-  timestamp: string;
-  eventType: string;
-  params: {
-    state: string;
-    referenceId: string;
-    transactionId: string;
-    amount: number;
-    currency: string;
-    description?: string;
-  };
-  signature?: string;
-}
-
-@Injectable()
-export class WaafiWebhookService {
-  private readonly logger = new Logger(WaafiWebhookService.name);
-
-  constructor(
-    private prisma: PrismaService,
-    private paymentsService: PaymentsService,
-    private waafiProvider: WaafiProvider,
-  ) {}
-
-  async handleWebhook(payload: WaafiWebhookPayload): Promise<{ received: boolean }> {
-    this.logger.log(
-      `Waafi webhook received: event=${payload.eventType} ref=${payload.params?.referenceId}`,
-    );
-
-    const signatureValid = this.waafiProvider.verifyWebhookSignature(
-      payload as unknown as Record<string, unknown>,
-    );
-
-    const merchantOrderId = payload.params?.referenceId;
-    const transactionId = payload.params?.transactionId;
-    const state = payload.params?.state;
-
-    await this.prisma.paymentWebhookEvent.create({
-      data: {
-        provider: PaymentMethodType.WAAFI,
-        externalEventId: payload.requestId,
-        merchantOrderId,
-        providerTxnId: transactionId,
-        signatureValid,
-        status: state || 'UNKNOWN',
-        payload: payload as any,
-      },
-    });
-
-    if (!signatureValid) {
-      this.logger.warn(`Waafi webhook signature invalid for ref=${merchantOrderId}`);
-      return { received: true };
-    }
-
-    if (!merchantOrderId) {
-      this.logger.error('Waafi webhook missing referenceId');
-      return { received: true };
-    }
-
-    const intent = await this.prisma.paymentIntent.findFirst({
-      where: { merchantOrderId },
-    });
-
-    if (!intent) {
-      this.logger.warn(`No PaymentIntent found for merchantOrderId=${merchantOrderId}`);
-      return { received: true };
-    }
-
-    const mappedStatus = this.waafiProvider.mapState(state);
-
-    if (mappedStatus === PaymentIntentStatus.SUCCEEDED) {
-      await this.paymentsService.finalizePaymentSuccess({
-        intentId: intent.id,
-        providerTxnId: transactionId,
-      });
-      this.logger.log(`Waafi payment succeeded: intent=${intent.id} txn=${transactionId}`);
-    } else if (mappedStatus === PaymentIntentStatus.FAILED) {
-      await this.paymentsService.markPaymentFailed({
-        intentId: intent.id,
-        failureCode: state,
-        failureMessage: payload.params?.description,
-      });
-      this.logger.log(`Waafi payment failed: intent=${intent.id} state=${state}`);
-    } else {
-      await this.prisma.paymentIntent.update({
-        where: { id: intent.id },
-        data: {
-          status: mappedStatus,
-          providerTxnId: transactionId,
-        },
-      });
-      this.logger.log(`Waafi payment status updated: intent=${intent.id} status=${mappedStatus}`);
-    }
-
-    return { received: true };
-  }
-}

apps/edr-passenger-api/src/modules/payments/webhooks/webhooks.controller.ts

@@ -1,116 +0,0 @@
-import { Body, Controller, Headers, HttpCode, HttpStatus, Logger, Post } from '@nestjs/common';
-import { ApiOperation, ApiTags } from '@nestjs/swagger';
-import {
-  TelebirrWebhookPayload,
-  TelebirrWebhookService,
-} from './telebirr-webhook.service';
-import {
-  CbeBirrWebhookPayload,
-  CbeBirrWebhookService,
-} from './cbe-birr-webhook.service';
-import {
-  EBirrWebhookPayload,
-  EBirrWebhookService,
-} from './ebirr-webhook.service';
-import {
-  CardWebhookPayload,
-  CardWebhookService,
-} from './card-webhook.service';
-import { WaafiWebhookService } from './waafi-webhook.service';
-
-@ApiTags('Payment Webhooks')
-@Controller('payments/webhooks')
-export class WebhooksController {
-  private readonly logger = new Logger(WebhooksController.name);
-
-  constructor(
-    private readonly telebirr: TelebirrWebhookService,
-    private readonly cbeBirr: CbeBirrWebhookService,
-    private readonly eBirr: EBirrWebhookService,
-    private readonly card: CardWebhookService,
-    private readonly waafi: WaafiWebhookService,
-  ) {}
-
-  @Post('telebirr')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Telebirr payment notification callback (Ethiopia)',
-    description: 'Webhook endpoint for Telebirr payment status updates. Used by Ethiopian passengers.'
-  })
-  async receiveTelebirr(@Body() payload: TelebirrWebhookPayload) {
-    try {
-      await this.telebirr.handle(payload);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`Telebirr webhook handler threw: ${message}`);
-    }
-    return { code: '0', message: 'OK' };
-  }
-
-  @Post('cbe-birr')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'CBE Birr payment notification callback (Ethiopia)',
-    description: 'Webhook endpoint for Commercial Bank of Ethiopia payment status updates.'
-  })
-  async receiveCbeBirr(@Body() payload: CbeBirrWebhookPayload) {
-    try {
-      await this.cbeBirr.handle(payload);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`CBE Birr webhook handler threw: ${message}`);
-    }
-    return { success: true };
-  }
-
-  @Post('ebirr')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'eBirr payment notification callback (Ethiopia)',
-    description: 'Webhook endpoint for eBirr electronic payment gateway status updates.'
-  })
-  async receiveEBirr(@Body() payload: EBirrWebhookPayload) {
-    try {
-      await this.eBirr.handle(payload);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`eBirr webhook handler threw: ${message}`);
-    }
-    return { code: '0000', message: 'success' };
-  }
-
-  @Post('card')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Card payment notification callback (International)',
-    description: 'Webhook endpoint for international card payments (Visa, Mastercard) via Stripe.'
-  })
-  async receiveCard(
-    @Body() payload: CardWebhookPayload,
-    @Headers('stripe-signature') signature: string,
-  ) {
-    try {
-      await this.card.handle(payload, signature);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`Card webhook handler threw: ${message}`);
-    }
-    return { received: true };
-  }
-
-  @Post('waafi')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Waafi payment notification callback (Djibouti)',
-    description: 'Webhook endpoint for Waafi mobile money payment status updates. Used by Djiboutian passengers.'
-  })
-  async receiveWaafi(@Body() payload: any) {
-    try {
-      await this.waafi.handleWebhook(payload);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.logger.error(`Waafi webhook handler threw: ${message}`);
-    }
-    return { responseCode: '2001', responseMsg: 'Success' };
-  }
-}