64089e4da3
The frontend (lib/payu.ts, payu-return.tsx) and admin config UI had already switched to PayU, but the payments service was still calling Razorpay's order API and verifying Razorpay HMAC signatures - payments were broken end to end. Rewrites apps/payments to PayU's hash-based hosted-checkout flow (SHA-512 request/response hash, key+salt from admin config or PAYU_MERCHANT_KEY/PAYU_SALT), for both the tracecoin wallet purchase flow and the AI credits flow. The AI credits frontend checkout was also fabricating a fake payment_id and signature client-side instead of ever opening a real PayU checkout - fixed to use the same real flow as tracecoin purchases. Also fixes the ai_create_ticket endpoint on the users service, which never validated the X-AI-Service-Key header despite the client sending one - anyone could create tickets under an arbitrary user_id. |
||
|---|---|---|
| .. | ||
| src | ||
| Cargo.toml | ||
| Dockerfile | ||