Refactored the whole app based on the requirements shared

apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts

@@ -0,0 +1,270 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import request from 'supertest';
+import { AppModule } from '../../app.module';
+import { PrismaService } from '../../common/prisma.service';
+
+describe('Payments E2E', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let authToken: string;
+  let bookingId: string;
+
+  beforeAll(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    app.useGlobalPipes(new ValidationPipe({ transform: true, whitelist: true }));
+    await app.init();
+
+    prisma = app.get<PrismaService>(PrismaService);
+
+    // Create test user and authenticate
+    const testUser = await prisma.user.create({
+      data: {
+        email: 'payment-test@example.com',
+        phone: '+251911111111',
+        fullName: 'Payment Test User',
+        passwordHash: '$2b$10$abcdefghijklmnopqrstuvwxyz', // Mock hash
+        role: 'PASSENGER',
+      },
+    });
+
+    const passenger = await prisma.passenger.create({
+      data: {
+        userId: testUser.id,
+      },
+    });
+
+    // Create wallet for test user
+    await prisma.walletAccount.create({
+      data: {
+        passengerId: passenger.id,
+        balanceMinor: 100000, // 1000 ETB
+        currency: 'ETB',
+      },
+    });
+
+    // Mock JWT token (in real test, call /auth/login)
+    authToken = 'mock-jwt-token';
+
+    // Create test booking
+    const station1 = await prisma.station.create({
+      data: {
+        code: 'TEST1',
+        name: 'Test Station 1',
+        city: 'Test City',
+        lat: 9.0,
+        lng: 38.0,
+      },
+    });
+
+    const station2 = await prisma.station.create({
+      data: {
+        code: 'TEST2',
+        name: 'Test Station 2',
+        city: 'Test City 2',
+        lat: 9.5,
+        lng: 38.5,
+      },
+    });
+
+    const service = await prisma.trainService.create({
+      data: {
+        number: 'TEST-001',
+        name: 'Test Service',
+      },
+    });
+
+    const trip = await prisma.trip.create({
+      data: {
+        serviceId: service.id,
+        originStationId: station1.id,
+        destinationStationId: station2.id,
+        departureAt: new Date(Date.now() + 86400000),
+        arrivalAt: new Date(Date.now() + 90000000),
+        durationMinutes: 60,
+      },
+    });
+
+    const coach = await prisma.coach.create({
+      data: {
+        tripId: trip.id,
+        label: 'A',
+        serviceClass: 'ECONOMY_REGULAR',
+      },
+    });
+
+    const seat = await prisma.seat.create({
+      data: {
+        coachId: coach.id,
+        row: 1,
+        col: 'A',
+        label: '1A',
+        status: 'AVAILABLE',
+      },
+    });
+
+    const booking = await prisma.booking.create({
+      data: {
+        bookingRef: 'TEST-BOOK-001',
+        passengerId: passenger.id,
+        tripId: trip.id,
+        status: 'PENDING_PAYMENT',
+        totalMinor: 50000, // 500 ETB
+        currency: 'ETB',
+      },
+    });
+
+    await prisma.bookingSeat.create({
+      data: {
+        bookingId: booking.id,
+        seatId: seat.id,
+        passengerName: 'Test Passenger',
+      },
+    });
+
+    bookingId = booking.id;
+  });
+
+  afterAll(async () => {
+    await prisma.$transaction([
+      prisma.bookingSeat.deleteMany(),
+      prisma.paymentIntent.deleteMany(),
+      prisma.booking.deleteMany(),
+      prisma.seat.deleteMany(),
+      prisma.coach.deleteMany(),
+      prisma.trip.deleteMany(),
+      prisma.trainService.deleteMany(),
+      prisma.station.deleteMany(),
+      prisma.walletLedgerEntry.deleteMany(),
+      prisma.walletAccount.deleteMany(),
+      prisma.passenger.deleteMany(),
+      prisma.user.deleteMany(),
+    ]);
+    await app.close();
+  });
+
+  describe('POST /payments/initiate', () => {
+    it('should initiate wallet payment successfully', async () => {
+      const response = await request(app.getHttpServer())
+        .post('/payments/initiate')
+        .set('Authorization', `Bearer ${authToken}`)
+        .send({
+          bookingId,
+          method: 'WALLET',
+        })
+        .expect(201);
+
+      expect(response.body.intentId).toBeDefined();
+      expect(response.body.status).toBe('SUCCEEDED');
+    });
+
+    it('should return 400 for invalid payment method', async () => {
+      await request(app.getHttpServer())
+        .post('/payments/initiate')
+        .set('Authorization', `Bearer ${authToken}`)
+        .send({
+          bookingId,
+          method: 'INVALID_METHOD',
+        })
+        .expect(400);
+    });
+
+    it('should return 404 for non-existent booking', async () => {
+      await request(app.getHttpServer())
+        .post('/payments/initiate')
+        .set('Authorization', `Bearer ${authToken}`)
+        .send({
+          bookingId: 'non-existent-id',
+          method: 'WALLET',
+        })
+        .expect(404);
+    });
+  });
+
+  describe('GET /payments/intents/:bookingId', () => {
+    it('should get payment intent status', async () => {
+      const response = await request(app.getHttpServer())
+        .get(`/payments/intents/${bookingId}`)
+        .set('Authorization', `Bearer ${authToken}`)
+        .expect(200);
+
+      expect(response.body.intentId).toBeDefined();
+      expect(response.body.status).toBeDefined();
+    });
+
+    it('should return 404 for non-existent intent', async () => {
+      await request(app.getHttpServer())
+        .get('/payments/intents/non-existent-booking')
+        .set('Authorization', `Bearer ${authToken}`)
+        .expect(404);
+    });
+  });
+
+  describe('Webhook endpoints', () => {
+    it('should handle Telebirr webhook', async () => {
+      await request(app.getHttpServer())
+        .post('/payments/webhooks/telebirr')
+        .send({
+          merch_order_id: 'TEST-ORDER-123',
+          payment_order_id: 'PAY-123',
+          trade_status: 'Completed',
+          sign: 'mock-signature',
+        })
+        .expect(200);
+    });
+
+    it('should handle CBE Birr webhook', async () => {
+      await request(app.getHttpServer())
+        .post('/payments/webhooks/cbe-birr')
+        .send({
+          merchantId: 'TEST-MERCHANT',
+          merchantOrderId: 'TEST-ORDER-123',
+          orderId: 'CBE-ORDER-123',
+          status: 'SUCCESS',
+          signature: 'mock-signature',
+        })
+        .expect(200);
+    });
+
+    it('should handle eBirr webhook', async () => {
+      await request(app.getHttpServer())
+        .post('/payments/webhooks/ebirr')
+        .send({
+          merchantCode: 'TEST-MERCHANT',
+          orderNo: 'TEST-ORDER-123',
+          tradeStatus: 'TRADE_SUCCESS',
+          timestamp: Date.now(),
+          sign: 'mock-signature',
+        })
+        .expect(200);
+    });
+
+    it('should handle Card webhook', async () => {
+      await request(app.getHttpServer())
+        .post('/payments/webhooks/card')
+        .set('stripe-signature', 'mock-signature')
+        .send({
+          id: 'evt_123',
+          type: 'payment_intent.succeeded',
+          data: {
+            object: {
+              id: 'pi_123',
+              status: 'succeeded',
+              amount: 50000,
+              currency: 'ETB',
+              metadata: {
+                merchantOrderId: 'TEST-ORDER-123',
+                bookingRef: 'TEST-BOOK-001',
+              },
+            },
+          },
+          created: Math.floor(Date.now() / 1000),
+        })
+        .expect(200);
+    });
+  });
+});

apps/edr-passenger-api/src/modules/payments/payments.module.ts

@@ -5,12 +5,28 @@ import { PaymentsService } from './payments.service';
 import { SeatsModule } from '../seats/seats.module';
 import { TicketsModule } from '../tickets/tickets.module';
 import { TelebirrProvider } from './providers/telebirr.provider';
+import { CbeBirrProvider } from './providers/cbe-birr.provider';
+import { EBirrProvider } from './providers/ebirr.provider';
+import { CardProvider } from './providers/card.provider';
 import { WebhooksController } from './webhooks/webhooks.controller';
 import { TelebirrWebhookService } from './webhooks/telebirr-webhook.service';
+import { CbeBirrWebhookService } from './webhooks/cbe-birr-webhook.service';
+import { EBirrWebhookService } from './webhooks/ebirr-webhook.service';
+import { CardWebhookService } from './webhooks/card-webhook.service';
 
 @Module({
   imports: [SeatsModule, TicketsModule, HttpModule.register({ timeout: 10_000 })],
   controllers: [PaymentsController, WebhooksController],
-  providers: [PaymentsService, TelebirrProvider, TelebirrWebhookService],
+  providers: [
+    PaymentsService,
+    TelebirrProvider,
+    CbeBirrProvider,
+    EBirrProvider,
+    CardProvider,
+    TelebirrWebhookService,
+    CbeBirrWebhookService,
+    EBirrWebhookService,
+    CardWebhookService,
+  ],
 })
 export class PaymentsModule {}

apps/edr-passenger-api/src/modules/payments/payments.service.spec.ts

@@ -0,0 +1,328 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { PaymentsService } from './payments.service';
+import { PrismaService } from '../../common/prisma.service';
+import { SeatsService } from '../seats/seats.service';
+import { TicketsService } from '../tickets/tickets.service';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { TelebirrProvider } from './providers/telebirr.provider';
+import { CbeBirrProvider } from './providers/cbe-birr.provider';
+import { EBirrProvider } from './providers/ebirr.provider';
+import { CardProvider } from './providers/card.provider';
+import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+
+describe('PaymentsService', () => {
+  let service: PaymentsService;
+  let prisma: PrismaService;
+  let seatsService: SeatsService;
+  let ticketsService: TicketsService;
+  let eventEmitter: EventEmitter2;
+
+  const mockPrisma = {
+    booking: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+    paymentIntent: {
+      findUnique: jest.fn(),
+      findUniqueOrThrow: jest.fn(),
+      upsert: jest.fn(),
+      update: jest.fn(),
+      create: jest.fn(),
+    },
+    walletAccount: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+    walletLedgerEntry: {
+      create: jest.fn(),
+    },
+    loyaltyAccount: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+    loyaltyLedgerEntry: {
+      create: jest.fn(),
+    },
+    $transaction: jest.fn((callback) => callback(mockPrisma)),
+  };
+
+  const mockSeatsService = {
+    confirmSeats: jest.fn(),
+    releaseSeats: jest.fn(),
+  };
+
+  const mockTicketsService = {
+    generate: jest.fn(),
+  };
+
+  const mockEventEmitter = {
+    emit: jest.fn(),
+  };
+
+  const mockTelebirrProvider = {
+    method: PaymentMethodType.TELEBIRR,
+    initiate: jest.fn(),
+    queryStatus: jest.fn(),
+  };
+
+  const mockCbeBirrProvider = {
+    method: PaymentMethodType.CBE_BIRR,
+    initiate: jest.fn(),
+    queryStatus: jest.fn(),
+  };
+
+  const mockEBirrProvider = {
+    method: PaymentMethodType.EBIRR,
+    initiate: jest.fn(),
+    queryStatus: jest.fn(),
+  };
+
+  const mockCardProvider = {
+    method: PaymentMethodType.CARD,
+    initiate: jest.fn(),
+    queryStatus: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        PaymentsService,
+        { provide: PrismaService, useValue: mockPrisma },
+        { provide: SeatsService, useValue: mockSeatsService },
+        { provide: TicketsService, useValue: mockTicketsService },
+        { provide: EventEmitter2, useValue: mockEventEmitter },
+        { provide: TelebirrProvider, useValue: mockTelebirrProvider },
+        { provide: CbeBirrProvider, useValue: mockCbeBirrProvider },
+        { provide: EBirrProvider, useValue: mockEBirrProvider },
+        { provide: CardProvider, useValue: mockCardProvider },
+      ],
+    }).compile();
+
+    service = module.get<PaymentsService>(PaymentsService);
+    prisma = module.get<PrismaService>(PrismaService);
+    seatsService = module.get<SeatsService>(SeatsService);
+    ticketsService = module.get<TicketsService>(TicketsService);
+    eventEmitter = module.get<EventEmitter2>(EventEmitter2);
+
+    jest.clearAllMocks();
+  });
+
+  describe('initiatePayment', () => {
+    const mockBooking = {
+      id: 'booking-1',
+      bookingRef: 'EDR123456',
+      passengerId: 'passenger-1',
+      totalMinor: 50000,
+      currency: 'ETB',
+      status: 'PENDING_PAYMENT',
+      seats: [{ id: 'seat-1', seatId: 'seat-id-1' }],
+    };
+
+    it('should throw NotFoundException if booking not found', async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue(null);
+
+      await expect(
+        service.initiatePayment({
+          bookingId: 'invalid',
+          method: 'TELEBIRR' as any,
+        }),
+      ).rejects.toThrow(NotFoundException);
+    });
+
+    it('should throw BadRequestException if booking not payable', async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue({
+        ...mockBooking,
+        status: 'CONFIRMED',
+      });
+
+      await expect(
+        service.initiatePayment({
+          bookingId: 'booking-1',
+          method: 'TELEBIRR' as any,
+        }),
+      ).rejects.toThrow(BadRequestException);
+    });
+
+    it('should initiate Telebirr payment successfully', async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+      mockTelebirrProvider.initiate.mockResolvedValue({
+        providerOrderId: 'TB-ORDER-123',
+        clientAction: { type: 'REDIRECT', url: 'https://telebirr.com/pay' },
+        expiresAt: new Date(),
+        rawInitiation: {},
+      });
+      mockPrisma.paymentIntent.upsert.mockResolvedValue({
+        id: 'intent-1',
+        status: PaymentIntentStatus.REQUIRES_ACTION,
+        merchantOrderId: 'MERCH-123',
+        clientAction: { type: 'REDIRECT', url: 'https://telebirr.com/pay' },
+      });
+
+      const result = await service.initiatePayment({
+        bookingId: 'booking-1',
+        method: 'TELEBIRR' as any,
+      });
+
+      expect(result.status).toBe(PaymentIntentStatus.REQUIRES_ACTION);
+      expect(mockTelebirrProvider.initiate).toHaveBeenCalled();
+    });
+
+    it('should initiate CBE Birr payment successfully', async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+      mockCbeBirrProvider.initiate.mockResolvedValue({
+        providerOrderId: 'CBE-ORDER-123',
+        clientAction: { type: 'REDIRECT', url: 'https://cbe.com/pay' },
+        expiresAt: new Date(),
+        rawInitiation: {},
+      });
+      mockPrisma.paymentIntent.upsert.mockResolvedValue({
+        id: 'intent-1',
+        status: PaymentIntentStatus.REQUIRES_ACTION,
+        merchantOrderId: 'MERCH-123',
+        clientAction: { type: 'REDIRECT', url: 'https://cbe.com/pay' },
+      });
+
+      const result = await service.initiatePayment({
+        bookingId: 'booking-1',
+        method: 'CBE_BIRR' as any,
+      });
+
+      expect(result.status).toBe(PaymentIntentStatus.REQUIRES_ACTION);
+      expect(mockCbeBirrProvider.initiate).toHaveBeenCalled();
+    });
+
+    it('should initiate wallet payment and debit successfully', async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+      mockPrisma.walletAccount.findUnique.mockResolvedValue({
+        id: 'wallet-1',
+        passengerId: 'passenger-1',
+        balanceMinor: 100000,
+      });
+      mockPrisma.paymentIntent.upsert.mockResolvedValue({
+        id: 'intent-1',
+        status: PaymentIntentStatus.PROCESSING,
+      });
+      mockPrisma.paymentIntent.findUniqueOrThrow.mockResolvedValue({
+        id: 'intent-1',
+        status: PaymentIntentStatus.SUCCEEDED,
+        bookingId: 'booking-1',
+      });
+      mockPrisma.loyaltyAccount.findUnique.mockResolvedValue({
+        id: 'loyalty-1',
+        pointsBalance: 100,
+      });
+
+      const result = await service.initiatePayment({
+        bookingId: 'booking-1',
+        method: 'WALLET' as any,
+      });
+
+      expect(result.status).toBe(PaymentIntentStatus.SUCCEEDED);
+      expect(mockSeatsService.confirmSeats).toHaveBeenCalled();
+      expect(mockTicketsService.generate).toHaveBeenCalled();
+    });
+
+    it('should fail wallet payment with insufficient balance', async () => {
+      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+      mockPrisma.walletAccount.findUnique.mockResolvedValue({
+        id: 'wallet-1',
+        passengerId: 'passenger-1',
+        balanceMinor: 10000, // Less than booking total
+      });
+      mockPrisma.paymentIntent.upsert.mockResolvedValue({
+        id: 'intent-1',
+        status: PaymentIntentStatus.FAILED,
+        failureCode: 'INSUFFICIENT_BALANCE',
+      });
+
+      const result = await service.initiatePayment({
+        bookingId: 'booking-1',
+        method: 'WALLET' as any,
+      });
+
+      expect(result.status).toBe(PaymentIntentStatus.FAILED);
+    });
+  });
+
+  describe('finalizePaymentSuccess', () => {
+    it('should finalize payment and issue ticket', async () => {
+      const mockIntent = {
+        id: 'intent-1',
+        bookingId: 'booking-1',
+        status: PaymentIntentStatus.PROCESSING,
+      };
+      const mockBooking = {
+        id: 'booking-1',
+        passengerId: 'passenger-1',
+        totalMinor: 50000,
+        seats: [{ seatId: 'seat-1' }],
+      };
+
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(mockIntent);
+      mockPrisma.booking.findUnique.mockResolvedValue(mockBooking);
+      mockPrisma.loyaltyAccount.findUnique.mockResolvedValue({
+        id: 'loyalty-1',
+        pointsBalance: 100,
+      });
+
+      const result = await service.finalizePaymentSuccess({
+        intentId: 'intent-1',
+        providerTxnId: 'TXN-123',
+      });
+
+      expect(result.alreadyFinalized).toBe(false);
+      expect(mockSeatsService.confirmSeats).toHaveBeenCalledWith(['seat-1']);
+      expect(mockTicketsService.generate).toHaveBeenCalledWith('booking-1');
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith('payment.succeeded', {
+        booking: mockBooking,
+      });
+    });
+
+    it('should return alreadyFinalized if payment already succeeded', async () => {
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue({
+        id: 'intent-1',
+        status: PaymentIntentStatus.SUCCEEDED,
+      });
+
+      const result = await service.finalizePaymentSuccess({
+        intentId: 'intent-1',
+      });
+
+      expect(result.alreadyFinalized).toBe(true);
+    });
+  });
+
+  describe('getIntentByBookingId', () => {
+    it('should return intent status', async () => {
+      const mockIntent = {
+        id: 'intent-1',
+        bookingId: 'booking-1',
+        status: PaymentIntentStatus.SUCCEEDED,
+        method: PaymentMethodType.TELEBIRR,
+        paidAt: new Date(),
+        merchantOrderId: 'MERCH-123',
+        updatedAt: new Date(),
+      };
+
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(mockIntent);
+
+      const result = await service.getIntentByBookingId('booking-1');
+
+      expect(result.intentId).toBe('intent-1');
+      expect(result.status).toBe(PaymentIntentStatus.SUCCEEDED);
+    });
+
+    it('should throw NotFoundException if intent not found', async () => {
+      mockPrisma.paymentIntent.findUnique.mockResolvedValue(null);
+
+      await expect(service.getIntentByBookingId('invalid')).rejects.toThrow(
+        NotFoundException,
+      );
+    });
+  });
+});

apps/edr-passenger-api/src/modules/payments/payments.service.ts

@@ -5,9 +5,11 @@ import { TicketsService } from '../tickets/tickets.service';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
 import { InitiatePaymentDto, RefundDto, AddPaymentMethodDto, InitiateResponseDto, IntentStatusDto } from './payments.dto';
-import { cbeBirrAdapter, eBirrAdapter, cardAdapter } from './payments.adapters';
 import { PaymentProvider, ProviderStatus } from './payments.types';
 import { TelebirrProvider } from './providers/telebirr.provider';
+import { CbeBirrProvider } from './providers/cbe-birr.provider';
+import { EBirrProvider } from './providers/ebirr.provider';
+import { CardProvider } from './providers/card.provider';
 import { createMerchantOrderId } from './providers/telebirr.crypto';
 
 const NON_TERMINAL_STATUSES: PaymentIntentStatus[] = [
@@ -27,9 +29,15 @@ export class PaymentsService {
     private ticketsService: TicketsService,
     private eventEmitter: EventEmitter2,
     private telebirrProvider: TelebirrProvider,
+    private cbeBirrProvider: CbeBirrProvider,
+    private eBirrProvider: EBirrProvider,
+    private cardProvider: CardProvider,
   ) {
     this.providers = new Map<PaymentMethodType, PaymentProvider>([
       [PaymentMethodType.TELEBIRR, this.telebirrProvider],
+      [PaymentMethodType.CBE_BIRR, this.cbeBirrProvider],
+      [PaymentMethodType.EBIRR, this.eBirrProvider],
+      [PaymentMethodType.CARD, this.cardProvider],
     ]);
   }
 
@@ -61,8 +69,7 @@ export class PaymentsService {
       return this.initiateProviderPayment(booking, provider);
     }
 
-    // TODO: convert CBE_BIRR, EBIRR, CARD into PaymentProvider implementations.
-    return this.initiateStubPayment(booking, method);
+    throw new BadRequestException(`Unsupported payment method: ${method}`);
   }
 
   private async initiateWalletPayment(
@@ -170,41 +177,7 @@ export class PaymentsService {
     return this.formatIntentResponse(intent);
   }
 
-  private async initiateStubPayment(
-    booking: Prisma.BookingGetPayload<{ include: { seats: true } }>,
-    method: PaymentMethodType,
-  ): Promise<InitiateResponseDto> {
-    const adapters = {
-      [PaymentMethodType.CBE_BIRR]: cbeBirrAdapter,
-      [PaymentMethodType.EBIRR]: eBirrAdapter,
-      [PaymentMethodType.CARD]: cardAdapter,
-    } as Partial<Record<PaymentMethodType, (a: number, ref: string) => Promise<{ success: boolean; providerRef: string }>>>;
-    const adapter = adapters[method];
-    if (!adapter) {
-      throw new BadRequestException(`Unsupported payment method: ${method}`);
-    }
-    const result = await adapter(booking.totalMinor, booking.bookingRef);
-    const status = result.success ? PaymentIntentStatus.PROCESSING : PaymentIntentStatus.FAILED;
-    const intent = await this.prisma.paymentIntent.upsert({
-      where: { bookingId: booking.id },
-      update: { status, providerRef: result.providerRef },
-      create: {
-        bookingId: booking.id,
-        amountMinor: booking.totalMinor,
-        method,
-        status,
-        providerRef: result.providerRef,
-      },
-    });
-    if (result.success) {
-      await this.finalizePaymentSuccess({ intentId: intent.id });
-      const refreshed = await this.prisma.paymentIntent.findUniqueOrThrow({
-        where: { id: intent.id },
-      });
-      return this.formatIntentResponse(refreshed);
-    }
-    return this.formatIntentResponse(intent);
-  }
+
 
   private formatIntentResponse(
     intent: Prisma.PaymentIntentGetPayload<Record<string, never>>,

apps/edr-passenger-api/src/modules/payments/providers/card.provider.ts

@@ -0,0 +1,218 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as crypto from 'node:crypto';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+} from '../payments.types';
+
+interface CardInitiateRequest {
+  amount: number;
+  currency: string;
+  description: string;
+  metadata: {
+    merchantOrderId: string;
+    bookingRef: string;
+  };
+  return_url: string;
+  webhook_url: string;
+}
+
+interface CardInitiateResponse {
+  id: string;
+  status: string;
+  client_secret: string;
+  checkout_url: string;
+  expires_at: number;
+}
+
+interface CardQueryResponse {
+  id: string;
+  status: string;
+  amount: number;
+  currency: string;
+  transaction_id?: string;
+  paid_at?: number;
+  failure_code?: string;
+  failure_message?: string;
+}
+
+@Injectable()
+export class CardProvider implements PaymentProvider {
+  readonly method = PaymentMethodType.CARD;
+  private readonly logger = new Logger(CardProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const amount = input.amountMinor / 100;
+    
+    const requestBody: CardInitiateRequest = {
+      amount,
+      currency: input.currency,
+      description: `EDR Train Booking ${input.bookingRef}`,
+      metadata: {
+        merchantOrderId: input.merchantOrderId,
+        bookingRef: input.bookingRef,
+      },
+      return_url: this.returnUrl,
+      webhook_url: this.webhookUrl,
+    };
+
+    const response = await this.postJson<CardInitiateResponse>(
+      `${this.baseUrl}/v1/payment_intents`,
+      requestBody,
+    );
+
+    if (!response.id) {
+      throw new Error(`Card gateway initiate failed: ${JSON.stringify(response)}`);
+    }
+
+    const expiresAt = new Date(response.expires_at * 1000);
+
+    return {
+      providerOrderId: response.id,
+      clientAction: { type: 'REDIRECT', url: response.checkout_url },
+      expiresAt,
+      rawInitiation: {
+        request: requestBody,
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    // For card payments, we need to find the payment intent by metadata
+    // In a real implementation, we'd store the provider order ID and use it directly
+    const response = await this.getJson<CardQueryResponse>(
+      `${this.baseUrl}/v1/payment_intents/search?metadata[merchantOrderId]=${merchantOrderId}`,
+    );
+
+    const mapped = this.mapStatus(response.status);
+
+    return {
+      status: mapped,
+      providerTxnId: response.transaction_id,
+      failureCode: response.failure_code,
+      failureMessage: response.failure_message,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>, signature: string): boolean {
+    const payloadString = JSON.stringify(payload);
+    const expectedSignature = crypto
+      .createHmac('sha256', this.webhookSecret)
+      .update(payloadString)
+      .digest('hex');
+    
+    try {
+      return crypto.timingSafeEqual(
+        Buffer.from(signature),
+        Buffer.from(expectedSignature),
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  mapWebhookStatus(status: string): PaymentIntentStatus {
+    return this.mapStatus(status);
+  }
+
+  private mapStatus(status: string): PaymentIntentStatus {
+    switch (status?.toLowerCase()) {
+      case 'succeeded':
+      case 'paid':
+        return PaymentIntentStatus.SUCCEEDED;
+      case 'failed':
+      case 'canceled':
+      case 'expired':
+        return PaymentIntentStatus.FAILED;
+      case 'requires_payment_method':
+      case 'requires_confirmation':
+      case 'requires_action':
+        return PaymentIntentStatus.REQUIRES_ACTION;
+      case 'processing':
+        return PaymentIntentStatus.PROCESSING;
+      default:
+        return PaymentIntentStatus.PROCESSING;
+    }
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${this.apiKey}`,
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`Card Gateway POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `Card Gateway POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`Card Gateway POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private async getJson<T>(url: string): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Authorization': `Bearer ${this.apiKey}`,
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.get<T>(url, config));
+      this.logger.debug(`Card Gateway GET ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `Card Gateway GET ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`Card Gateway GET ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('card.baseUrl') ?? '';
+  }
+  private get apiKey(): string {
+    return this.config.get<string>('card.apiKey') ?? '';
+  }
+  private get webhookSecret(): string {
+    return this.config.get<string>('card.webhookSecret') ?? '';
+  }
+  private get webhookUrl(): string {
+    return this.config.get<string>('card.webhookUrl') ?? '';
+  }
+  private get returnUrl(): string {
+    return this.config.get<string>('card.returnUrl') ?? '';
+  }
+}

apps/edr-passenger-api/src/modules/payments/providers/cbe-birr.provider.ts

@@ -0,0 +1,215 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as crypto from 'node:crypto';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+} from '../payments.types';
+
+interface CbeBirrInitiateRequest {
+  merchantId: string;
+  merchantOrderId: string;
+  amount: string;
+  currency: string;
+  description: string;
+  returnUrl: string;
+  notifyUrl: string;
+  timestamp: string;
+  signature: string;
+}
+
+interface CbeBirrInitiateResponse {
+  success: boolean;
+  orderId: string;
+  paymentUrl: string;
+  expiresIn: number;
+}
+
+interface CbeBirrQueryResponse {
+  success: boolean;
+  orderId: string;
+  status: string;
+  transactionId?: string;
+  amount?: string;
+  paidAt?: string;
+}
+
+@Injectable()
+export class CbeBirrProvider implements PaymentProvider {
+  readonly method = PaymentMethodType.CBE_BIRR;
+  private readonly logger = new Logger(CbeBirrProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const amount = (input.amountMinor / 100).toFixed(2);
+    const timestamp = new Date().toISOString();
+    
+    const requestBody: CbeBirrInitiateRequest = {
+      merchantId: this.merchantId,
+      merchantOrderId: input.merchantOrderId,
+      amount,
+      currency: input.currency,
+      description: `EDR Booking ${input.bookingRef}`,
+      returnUrl: this.returnUrl,
+      notifyUrl: this.notifyUrl,
+      timestamp,
+      signature: this.signRequest({
+        merchantId: this.merchantId,
+        merchantOrderId: input.merchantOrderId,
+        amount,
+        timestamp,
+      }),
+    };
+
+    const response = await this.postJson<CbeBirrInitiateResponse>(
+      `${this.baseUrl}/api/v1/payment/initiate`,
+      requestBody,
+    );
+
+    if (!response.success || !response.orderId) {
+      throw new Error(`CBE Birr initiate failed: ${JSON.stringify(response)}`);
+    }
+
+    const expiresAt = new Date(Date.now() + response.expiresIn * 1000);
+
+    return {
+      providerOrderId: response.orderId,
+      clientAction: { type: 'REDIRECT', url: response.paymentUrl },
+      expiresAt,
+      rawInitiation: {
+        request: this.sanitize(requestBody),
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    const timestamp = new Date().toISOString();
+    const signature = this.signRequest({
+      merchantId: this.merchantId,
+      merchantOrderId,
+      timestamp,
+    });
+
+    const response = await this.postJson<CbeBirrQueryResponse>(
+      `${this.baseUrl}/api/v1/payment/query`,
+      {
+        merchantId: this.merchantId,
+        merchantOrderId,
+        timestamp,
+        signature,
+      },
+    );
+
+    const mapped = this.mapStatus(response.status);
+
+    return {
+      status: mapped,
+      providerTxnId: response.transactionId,
+      failureCode: mapped === PaymentIntentStatus.FAILED ? response.status : undefined,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
+    const { signature, ...data } = payload;
+    if (!signature || typeof signature !== 'string') return false;
+    
+    const expectedSignature = this.signRequest(data);
+    return crypto.timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature),
+    );
+  }
+
+  mapWebhookStatus(status: string): PaymentIntentStatus {
+    return this.mapStatus(status);
+  }
+
+  private mapStatus(status: string): PaymentIntentStatus {
+    switch (status?.toUpperCase()) {
+      case 'SUCCESS':
+      case 'COMPLETED':
+        return PaymentIntentStatus.SUCCEEDED;
+      case 'FAILED':
+      case 'REJECTED':
+      case 'EXPIRED':
+        return PaymentIntentStatus.FAILED;
+      case 'PENDING':
+        return PaymentIntentStatus.REQUIRES_ACTION;
+      case 'PROCESSING':
+        return PaymentIntentStatus.PROCESSING;
+      default:
+        return PaymentIntentStatus.PROCESSING;
+    }
+  }
+
+  private signRequest(data: Record<string, unknown>): string {
+    const sortedKeys = Object.keys(data).sort();
+    const signString = sortedKeys
+      .map((key) => `${key}=${data[key]}`)
+      .join('&');
+    
+    return crypto
+      .createHmac('sha256', this.secretKey)
+      .update(signString)
+      .digest('hex');
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Merchant-Id': this.merchantId,
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`CBE Birr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `CBE Birr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`CBE Birr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private sanitize(body: CbeBirrInitiateRequest): Record<string, unknown> {
+    const { signature: _signature, ...rest } = body;
+    return rest;
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('cbe.baseUrl') ?? '';
+  }
+  private get merchantId(): string {
+    return this.config.get<string>('cbe.merchantId') ?? '';
+  }
+  private get secretKey(): string {
+    return this.config.get<string>('cbe.secretKey') ?? '';
+  }
+  private get notifyUrl(): string {
+    return this.config.get<string>('cbe.notifyUrl') ?? '';
+  }
+  private get returnUrl(): string {
+    return this.config.get<string>('cbe.returnUrl') ?? '';
+  }
+}

apps/edr-passenger-api/src/modules/payments/providers/ebirr.provider.ts

@@ -0,0 +1,228 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import { PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as crypto from 'node:crypto';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+} from '../payments.types';
+
+interface EBirrInitiateRequest {
+  merchantCode: string;
+  orderNo: string;
+  amount: number;
+  currency: string;
+  subject: string;
+  body: string;
+  notifyUrl: string;
+  returnUrl: string;
+  timestamp: number;
+  sign: string;
+}
+
+interface EBirrInitiateResponse {
+  code: string;
+  message: string;
+  data?: {
+    orderNo: string;
+    payUrl: string;
+    expireTime: number;
+  };
+}
+
+interface EBirrQueryResponse {
+  code: string;
+  message: string;
+  data?: {
+    orderNo: string;
+    tradeStatus: string;
+    tradeNo?: string;
+    totalAmount?: number;
+    payTime?: number;
+  };
+}
+
+@Injectable()
+export class EBirrProvider implements PaymentProvider {
+  readonly method = PaymentMethodType.EBIRR;
+  private readonly logger = new Logger(EBirrProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const amount = input.amountMinor / 100;
+    const timestamp = Date.now();
+    
+    const requestBody: EBirrInitiateRequest = {
+      merchantCode: this.merchantCode,
+      orderNo: input.merchantOrderId,
+      amount,
+      currency: input.currency,
+      subject: `EDR Ticket`,
+      body: `Train booking ${input.bookingRef}`,
+      notifyUrl: this.notifyUrl,
+      returnUrl: this.returnUrl,
+      timestamp,
+      sign: this.signRequest({
+        merchantCode: this.merchantCode,
+        orderNo: input.merchantOrderId,
+        amount,
+        timestamp,
+      }),
+    };
+
+    const response = await this.postJson<EBirrInitiateResponse>(
+      `${this.baseUrl}/gateway/api/pay/create`,
+      requestBody,
+    );
+
+    if (response.code !== '0000' || !response.data?.orderNo) {
+      throw new Error(`eBirr initiate failed: ${response.message}`);
+    }
+
+    const expiresAt = new Date(response.data.expireTime);
+
+    return {
+      providerOrderId: response.data.orderNo,
+      clientAction: { type: 'REDIRECT', url: response.data.payUrl },
+      expiresAt,
+      rawInitiation: {
+        request: this.sanitize(requestBody),
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    const timestamp = Date.now();
+    const requestBody = {
+      merchantCode: this.merchantCode,
+      orderNo: merchantOrderId,
+      timestamp,
+      sign: this.signRequest({
+        merchantCode: this.merchantCode,
+        orderNo: merchantOrderId,
+        timestamp,
+      }),
+    };
+
+    const response = await this.postJson<EBirrQueryResponse>(
+      `${this.baseUrl}/gateway/api/pay/query`,
+      requestBody,
+    );
+
+    if (response.code !== '0000' || !response.data) {
+      throw new Error(`eBirr query failed: ${response.message}`);
+    }
+
+    const mapped = this.mapStatus(response.data.tradeStatus);
+
+    return {
+      status: mapped,
+      providerTxnId: response.data.tradeNo,
+      failureCode: mapped === PaymentIntentStatus.FAILED ? response.data.tradeStatus : undefined,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
+    const { sign, ...data } = payload;
+    if (!sign || typeof sign !== 'string') return false;
+    
+    const expectedSign = this.signRequest(data);
+    return crypto.timingSafeEqual(
+      Buffer.from(sign),
+      Buffer.from(expectedSign),
+    );
+  }
+
+  mapWebhookStatus(tradeStatus: string): PaymentIntentStatus {
+    return this.mapStatus(tradeStatus);
+  }
+
+  private mapStatus(tradeStatus: string): PaymentIntentStatus {
+    switch (tradeStatus?.toUpperCase()) {
+      case 'TRADE_SUCCESS':
+      case 'SUCCESS':
+        return PaymentIntentStatus.SUCCEEDED;
+      case 'TRADE_CLOSED':
+      case 'TRADE_FAILED':
+      case 'FAILED':
+        return PaymentIntentStatus.FAILED;
+      case 'WAIT_BUYER_PAY':
+      case 'PENDING':
+        return PaymentIntentStatus.REQUIRES_ACTION;
+      case 'PROCESSING':
+        return PaymentIntentStatus.PROCESSING;
+      default:
+        return PaymentIntentStatus.PROCESSING;
+    }
+  }
+
+  private signRequest(data: Record<string, unknown>): string {
+    const sortedKeys = Object.keys(data).sort();
+    const signString = sortedKeys
+      .map((key) => `${key}=${data[key]}`)
+      .join('&') + `&key=${this.secretKey}`;
+    
+    return crypto
+      .createHash('md5')
+      .update(signString)
+      .digest('hex')
+      .toUpperCase();
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`eBirr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `eBirr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`eBirr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private sanitize(body: EBirrInitiateRequest): Record<string, unknown> {
+    const { sign: _sign, ...rest } = body;
+    return rest;
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('ebirr.baseUrl') ?? '';
+  }
+  private get merchantCode(): string {
+    return this.config.get<string>('ebirr.merchantCode') ?? '';
+  }
+  private get secretKey(): string {
+    return this.config.get<string>('ebirr.secretKey') ?? '';
+  }
+  private get notifyUrl(): string {
+    return this.config.get<string>('ebirr.notifyUrl') ?? '';
+  }
+  private get returnUrl(): string {
+    return this.config.get<string>('ebirr.returnUrl') ?? '';
+  }
+}

apps/edr-passenger-api/src/modules/payments/webhooks/card-webhook.service.ts

@@ -0,0 +1,147 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { PrismaService } from '../../../common/prisma.service';
+import { PaymentsService } from '../payments.service';
+import { CardProvider } from '../providers/card.provider';
+
+export interface CardWebhookPayload {
+  id: string;
+  type: string;
+  data: {
+    object: {
+      id: string;
+      status: string;
+      amount: number;
+      currency: string;
+      metadata: {
+        merchantOrderId: string;
+        bookingRef: string;
+      };
+      transaction_id?: string;
+      paid_at?: number;
+      failure_code?: string;
+      failure_message?: string;
+    };
+  };
+  created: number;
+}
+
+@Injectable()
+export class CardWebhookService {
+  private readonly logger = new Logger(CardWebhookService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly provider: CardProvider,
+    private readonly payments: PaymentsService,
+  ) {}
+
+  async handle(payload: CardWebhookPayload, signature: string): Promise<void> {
+    const merchantOrderId = payload.data.object.metadata.merchantOrderId;
+    const externalEventId = `${payload.id}_${payload.type}`;
+    const signatureValid = this.provider.verifyWebhookSignature(
+      payload as unknown as Record<string, unknown>,
+      signature,
+    );
+
+    const eventRow = await this.persistEvent({
+      externalEventId,
+      merchantOrderId,
+      providerTxnId: payload.data.object.transaction_id,
+      signatureValid,
+      status: payload.data.object.status,
+      payload,
+    });
+
+    if (!eventRow) {
+      this.logger.log(`Card webhook duplicate: ${externalEventId} — short-circuit OK`);
+      return;
+    }
+
+    if (!signatureValid) {
+      this.logger.warn(`Card webhook signature invalid for merchantOrderId=${merchantOrderId}`);
+      await this.markProcessed(eventRow.id, 'signature-invalid');
+      return;
+    }
+
+    const intent = await this.prisma.paymentIntent.findUnique({
+      where: { merchantOrderId },
+    });
+    if (!intent) {
+      this.logger.warn(`Card webhook: no PaymentIntent for merchantOrderId=${merchantOrderId}`);
+      await this.markProcessed(eventRow.id, 'intent-not-found');
+      return;
+    }
+
+    const mapped = this.provider.mapWebhookStatus(payload.data.object.status);
+
+    try {
+      if (mapped === PaymentIntentStatus.SUCCEEDED) {
+        await this.payments.finalizePaymentSuccess({
+          intentId: intent.id,
+          providerTxnId: payload.data.object.transaction_id,
+          paidAt: payload.data.object.paid_at ? new Date(payload.data.object.paid_at * 1000) : undefined,
+        });
+      } else if (mapped === PaymentIntentStatus.FAILED) {
+        await this.payments.markPaymentFailed({
+          intentId: intent.id,
+          failureCode: payload.data.object.failure_code,
+          failureMessage: payload.data.object.failure_message,
+        });
+      } else {
+        await this.prisma.paymentIntent.update({
+          where: { id: intent.id },
+          data: {
+            status: mapped,
+            providerTxnId: payload.data.object.transaction_id ?? undefined,
+          },
+        });
+      }
+      await this.markProcessed(eventRow.id);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(`Card webhook processing failed for ${merchantOrderId}: ${message}`);
+      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
+      throw err;
+    }
+  }
+
+  private async persistEvent(input: {
+    externalEventId: string;
+    merchantOrderId: string;
+    providerTxnId?: string;
+    signatureValid: boolean;
+    status: string;
+    payload: CardWebhookPayload;
+  }): Promise<{ id: string } | null> {
+    try {
+      return await this.prisma.paymentWebhookEvent.create({
+        data: {
+          provider: PaymentMethodType.CARD,
+          externalEventId: input.externalEventId,
+          merchantOrderId: input.merchantOrderId,
+          providerTxnId: input.providerTxnId,
+          signatureValid: input.signatureValid,
+          status: input.status,
+          payload: input.payload as unknown as Prisma.InputJsonValue,
+        },
+        select: { id: true },
+      });
+    } catch (err) {
+      if (
+        err instanceof Prisma.PrismaClientKnownRequestError &&
+        err.code === 'P2002'
+      ) {
+        return null;
+      }
+      throw err;
+    }
+  }
+
+  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
+    await this.prisma.paymentWebhookEvent.update({
+      where: { id: eventId },
+      data: { processedAt: new Date(), processingError },
+    });
+  }
+}

apps/edr-passenger-api/src/modules/payments/webhooks/cbe-birr-webhook.service.ts

@@ -0,0 +1,133 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { PrismaService } from '../../../common/prisma.service';
+import { PaymentsService } from '../payments.service';
+import { CbeBirrProvider } from '../providers/cbe-birr.provider';
+
+export interface CbeBirrWebhookPayload {
+  merchantId: string;
+  merchantOrderId: string;
+  orderId: string;
+  status: string;
+  transactionId?: string;
+  amount?: string;
+  currency?: string;
+  paidAt?: string;
+  signature: string;
+  [key: string]: unknown;
+}
+
+@Injectable()
+export class CbeBirrWebhookService {
+  private readonly logger = new Logger(CbeBirrWebhookService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly provider: CbeBirrProvider,
+    private readonly payments: PaymentsService,
+  ) {}
+
+  async handle(payload: CbeBirrWebhookPayload): Promise<void> {
+    const merchantOrderId = payload.merchantOrderId;
+    const externalEventId = `${payload.orderId}_${payload.status}`;
+    const signatureValid = this.provider.verifyWebhookSignature(
+      payload as unknown as Record<string, unknown>,
+    );
+
+    const eventRow = await this.persistEvent({
+      externalEventId,
+      merchantOrderId,
+      providerTxnId: payload.transactionId ?? payload.orderId,
+      signatureValid,
+      status: payload.status,
+      payload,
+    });
+
+    if (!eventRow) {
+      this.logger.log(`CBE Birr webhook duplicate: ${externalEventId} — short-circuit OK`);
+      return;
+    }
+
+    if (!signatureValid) {
+      this.logger.warn(`CBE Birr webhook signature invalid for merchantOrderId=${merchantOrderId}`);
+      await this.markProcessed(eventRow.id, 'signature-invalid');
+      return;
+    }
+
+    const intent = await this.prisma.paymentIntent.findUnique({
+      where: { merchantOrderId },
+    });
+    if (!intent) {
+      this.logger.warn(`CBE Birr webhook: no PaymentIntent for merchantOrderId=${merchantOrderId}`);
+      await this.markProcessed(eventRow.id, 'intent-not-found');
+      return;
+    }
+
+    const mapped = this.provider.mapWebhookStatus(payload.status);
+
+    try {
+      if (mapped === PaymentIntentStatus.SUCCEEDED) {
+        await this.payments.finalizePaymentSuccess({
+          intentId: intent.id,
+          providerTxnId: payload.transactionId ?? payload.orderId,
+          paidAt: payload.paidAt ? new Date(payload.paidAt) : undefined,
+        });
+      } else if (mapped === PaymentIntentStatus.FAILED) {
+        await this.payments.markPaymentFailed({
+          intentId: intent.id,
+          failureCode: payload.status,
+        });
+      } else {
+        await this.prisma.paymentIntent.update({
+          where: { id: intent.id },
+          data: { status: mapped, providerTxnId: payload.transactionId ?? undefined },
+        });
+      }
+      await this.markProcessed(eventRow.id);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(`CBE Birr webhook processing failed for ${merchantOrderId}: ${message}`);
+      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
+      throw err;
+    }
+  }
+
+  private async persistEvent(input: {
+    externalEventId: string;
+    merchantOrderId: string;
+    providerTxnId?: string;
+    signatureValid: boolean;
+    status: string;
+    payload: CbeBirrWebhookPayload;
+  }): Promise<{ id: string } | null> {
+    try {
+      return await this.prisma.paymentWebhookEvent.create({
+        data: {
+          provider: PaymentMethodType.CBE_BIRR,
+          externalEventId: input.externalEventId,
+          merchantOrderId: input.merchantOrderId,
+          providerTxnId: input.providerTxnId,
+          signatureValid: input.signatureValid,
+          status: input.status,
+          payload: input.payload as unknown as Prisma.InputJsonValue,
+        },
+        select: { id: true },
+      });
+    } catch (err) {
+      if (
+        err instanceof Prisma.PrismaClientKnownRequestError &&
+        err.code === 'P2002'
+      ) {
+        return null;
+      }
+      throw err;
+    }
+  }
+
+  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
+    await this.prisma.paymentWebhookEvent.update({
+      where: { id: eventId },
+      data: { processedAt: new Date(), processingError },
+    });
+  }
+}

apps/edr-passenger-api/src/modules/payments/webhooks/ebirr-webhook.service.ts

@@ -0,0 +1,133 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Prisma, PaymentIntentStatus, PaymentMethodType } from '@prisma/client';
+import { PrismaService } from '../../../common/prisma.service';
+import { PaymentsService } from '../payments.service';
+import { EBirrProvider } from '../providers/ebirr.provider';
+
+export interface EBirrWebhookPayload {
+  merchantCode: string;
+  orderNo: string;
+  tradeStatus: string;
+  tradeNo?: string;
+  totalAmount?: number;
+  currency?: string;
+  payTime?: number;
+  timestamp: number;
+  sign: string;
+  [key: string]: unknown;
+}
+
+@Injectable()
+export class EBirrWebhookService {
+  private readonly logger = new Logger(EBirrWebhookService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly provider: EBirrProvider,
+    private readonly payments: PaymentsService,
+  ) {}
+
+  async handle(payload: EBirrWebhookPayload): Promise<void> {
+    const merchantOrderId = payload.orderNo;
+    const externalEventId = `${payload.orderNo}_${payload.tradeStatus}_${payload.timestamp}`;
+    const signatureValid = this.provider.verifyWebhookSignature(
+      payload as unknown as Record<string, unknown>,
+    );
+
+    const eventRow = await this.persistEvent({
+      externalEventId,
+      merchantOrderId,
+      providerTxnId: payload.tradeNo,
+      signatureValid,
+      status: payload.tradeStatus,
+      payload,
+    });
+
+    if (!eventRow) {
+      this.logger.log(`eBirr webhook duplicate: ${externalEventId} — short-circuit OK`);
+      return;
+    }
+
+    if (!signatureValid) {
+      this.logger.warn(`eBirr webhook signature invalid for orderNo=${merchantOrderId}`);
+      await this.markProcessed(eventRow.id, 'signature-invalid');
+      return;
+    }
+
+    const intent = await this.prisma.paymentIntent.findUnique({
+      where: { merchantOrderId },
+    });
+    if (!intent) {
+      this.logger.warn(`eBirr webhook: no PaymentIntent for orderNo=${merchantOrderId}`);
+      await this.markProcessed(eventRow.id, 'intent-not-found');
+      return;
+    }
+
+    const mapped = this.provider.mapWebhookStatus(payload.tradeStatus);
+
+    try {
+      if (mapped === PaymentIntentStatus.SUCCEEDED) {
+        await this.payments.finalizePaymentSuccess({
+          intentId: intent.id,
+          providerTxnId: payload.tradeNo,
+          paidAt: payload.payTime ? new Date(payload.payTime) : undefined,
+        });
+      } else if (mapped === PaymentIntentStatus.FAILED) {
+        await this.payments.markPaymentFailed({
+          intentId: intent.id,
+          failureCode: payload.tradeStatus,
+        });
+      } else {
+        await this.prisma.paymentIntent.update({
+          where: { id: intent.id },
+          data: { status: mapped, providerTxnId: payload.tradeNo ?? undefined },
+        });
+      }
+      await this.markProcessed(eventRow.id);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(`eBirr webhook processing failed for ${merchantOrderId}: ${message}`);
+      await this.markProcessed(eventRow.id, `processing-error: ${message}`);
+      throw err;
+    }
+  }
+
+  private async persistEvent(input: {
+    externalEventId: string;
+    merchantOrderId: string;
+    providerTxnId?: string;
+    signatureValid: boolean;
+    status: string;
+    payload: EBirrWebhookPayload;
+  }): Promise<{ id: string } | null> {
+    try {
+      return await this.prisma.paymentWebhookEvent.create({
+        data: {
+          provider: PaymentMethodType.EBIRR,
+          externalEventId: input.externalEventId,
+          merchantOrderId: input.merchantOrderId,
+          providerTxnId: input.providerTxnId,
+          signatureValid: input.signatureValid,
+          status: input.status,
+          payload: input.payload as unknown as Prisma.InputJsonValue,
+        },
+        select: { id: true },
+      });
+    } catch (err) {
+      if (
+        err instanceof Prisma.PrismaClientKnownRequestError &&
+        err.code === 'P2002'
+      ) {
+        return null;
+      }
+      throw err;
+    }
+  }
+
+  private async markProcessed(eventId: string, processingError?: string): Promise<void> {
+    await this.prisma.paymentWebhookEvent.update({
+      where: { id: eventId },
+      data: { processedAt: new Date(), processingError },
+    });
+  }
+}

apps/edr-passenger-api/src/modules/payments/webhooks/webhooks.controller.ts

@@ -1,16 +1,33 @@
-import { Body, Controller, HttpCode, HttpStatus, Logger, Post } from '@nestjs/common';
+import { Body, Controller, Headers, HttpCode, HttpStatus, Logger, Post } from '@nestjs/common';
 import { ApiOperation, ApiTags } from '@nestjs/swagger';
 import {
   TelebirrWebhookPayload,
   TelebirrWebhookService,
 } from './telebirr-webhook.service';
+import {
+  CbeBirrWebhookPayload,
+  CbeBirrWebhookService,
+} from './cbe-birr-webhook.service';
+import {
+  EBirrWebhookPayload,
+  EBirrWebhookService,
+} from './ebirr-webhook.service';
+import {
+  CardWebhookPayload,
+  CardWebhookService,
+} from './card-webhook.service';
 
 @ApiTags('Payment Webhooks')
 @Controller('payments/webhooks')
 export class WebhooksController {
   private readonly logger = new Logger(WebhooksController.name);
 
-  constructor(private readonly telebirr: TelebirrWebhookService) {}
+  constructor(
+    private readonly telebirr: TelebirrWebhookService,
+    private readonly cbeBirr: CbeBirrWebhookService,
+    private readonly eBirr: EBirrWebhookService,
+    private readonly card: CardWebhookService,
+  ) {}
 
   @Post('telebirr')
   @HttpCode(HttpStatus.OK)
@@ -24,4 +41,46 @@ export class WebhooksController {
     }
     return { code: '0', message: 'OK' };
   }
+
+  @Post('cbe-birr')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'CBE Birr payment notification callback' })
+  async receiveCbeBirr(@Body() payload: CbeBirrWebhookPayload) {
+    try {
+      await this.cbeBirr.handle(payload);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(`CBE Birr webhook handler threw: ${message}`);
+    }
+    return { success: true };
+  }
+
+  @Post('ebirr')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'eBirr payment notification callback' })
+  async receiveEBirr(@Body() payload: EBirrWebhookPayload) {
+    try {
+      await this.eBirr.handle(payload);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(`eBirr webhook handler threw: ${message}`);
+    }
+    return { code: '0000', message: 'success' };
+  }
+
+  @Post('card')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Card payment notification callback' })
+  async receiveCard(
+    @Body() payload: CardWebhookPayload,
+    @Headers('stripe-signature') signature: string,
+  ) {
+    try {
+      await this.card.handle(payload, signature);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.error(`Card webhook handler threw: ${message}`);
+    }
+    return { received: true };
+  }
 }