fix: scrub real customer PII and a captured webhook payload from docs
server/openapi.json, server/README.md, and the Postman collection used what turned out to be real customer names/phone numbers and a real Midtrans webhook notification (copied during earlier debugging) as documentation examples instead of fabricated placeholder data. Replaced with clearly synthetic values (Budi Santoso, DEMO-MERCHANT-*, placeholder UUIDs/signature). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
parent
97349e9d1e
commit
860a636a2c
|
|
@ -7,7 +7,7 @@
|
|||
"variable": [
|
||||
{ "key": "base_url", "value": "http://localhost:8000", "type": "string" },
|
||||
{ "key": "api_key", "value": "dev-key", "type": "string" },
|
||||
{ "key": "order_id", "value": "ERPSKRIP-2608030000000627:TKG-260803000063", "type": "string" },
|
||||
{ "key": "order_id", "value": "DEMO-MERCHANT-0001:ITEM-0001", "type": "string" },
|
||||
{ "key": "payment_token", "value": "", "type": "string" },
|
||||
{ "key": "midtrans_order_id", "value": "", "type": "string" },
|
||||
{ "key": "log_user", "value": "", "type": "string" },
|
||||
|
|
@ -66,7 +66,7 @@
|
|||
"description": "Creates a signed, shareable Midtrans Snap payment link directly from the given payload.\n\norder_id is used as-is for tracking, and sanitized (':' -> '.') for the value actually sent to Midtrans, since Midtrans order_id only allows alphanumeric and - _ ~ .\n\nexpire_at is honored if it's a future epoch-ms timestamp; otherwise it falls back to PAYMENT_LINK_TTL_MINUTES.\n\nResponse: `{ status, messages, data: { url, order_id, midtrans_order_id, expire_at } }` - `data.url` is the link to share with the customer.\n\nRate-limited (RATE_LIMIT_MAX per RATE_LIMIT_WINDOW_MS per IP).",
|
||||
"body": {
|
||||
"mode": "raw",
|
||||
"raw": "{\n \"order_id\": \"ERPSKRIP-2608030000000627:TKG-260803000063\",\n \"nominal\": 179000,\n \"customer\": {\n \"name\": \"Yusnika Nur Faidah\",\n \"phone\": \"0881022144656\",\n \"email\": \"yusnika_nur_faidah@example.com\"\n },\n \"expire_at\": 1785852063058\n}",
|
||||
"raw": "{\n \"order_id\": \"DEMO-MERCHANT-0001:ITEM-0001\",\n \"nominal\": 179000,\n \"customer\": {\n \"name\": \"Budi Santoso\",\n \"phone\": \"081234567890\",\n \"email\": \"budi.santoso@example.com\"\n },\n \"expire_at\": 1785852063058\n}",
|
||||
"options": { "raw": { "language": "json" } }
|
||||
}
|
||||
},
|
||||
|
|
@ -99,7 +99,7 @@
|
|||
"description": "Legacy/ERP-facing endpoint. order_id is derived server-side as `mercant_id.item[0].item_id` (dot-joined; Midtrans order_id only allows alphanumeric and - _ ~ .).\n\nexpire_at is NOT client-supplied — computed server-side from PAYMENT_LINK_TTL_MINUTES (default 1440 min).\n\nResponse: `{ status, messages, data: { url } }`. Rate-limited.",
|
||||
"body": {
|
||||
"mode": "raw",
|
||||
"raw": "{\n \"mercant_id\": \"ERPSKRIP-2608030000000627\",\n \"nominal\": 179000,\n \"nama\": \"Yusnika Nur Faidah\",\n \"no_telepon\": \"0881022144656\",\n \"email\": \"yusnika_nur_faidah@example.com\",\n \"item\": [\n { \"item_id\": \"TKG-260803000063\" }\n ]\n}",
|
||||
"raw": "{\n \"mercant_id\": \"DEMO-MERCHANT-0001\",\n \"nominal\": 179000,\n \"nama\": \"Budi Santoso\",\n \"no_telepon\": \"081234567890\",\n \"email\": \"budi.santoso@example.com\",\n \"item\": [\n { \"item_id\": \"ITEM-0001\" }\n ]\n}",
|
||||
"options": { "raw": { "language": "json" } }
|
||||
}
|
||||
}
|
||||
|
|
@ -177,7 +177,7 @@
|
|||
"description": "Replays a REAL webhook payload (copied from Midtrans Dashboard's notification history) straight into the local server, so you can debug the ERP-notify flow without waiting for Midtrans to reach a public URL.\n\nIMPORTANT: `signature_key` in the body must have been generated with the SAME `MIDTRANS_SERVER_KEY` as this local server's `.env` (production key vs sandbox key mismatch = signature invalid). Paste the exact JSON from Dashboard as-is; do not modify order_id/status_code/gross_amount or the signature will no longer match.",
|
||||
"body": {
|
||||
"mode": "raw",
|
||||
"raw": "{\n \"transaction_type\": \"off-us\",\n \"transaction_time\": \"2026-08-03 21:26:58\",\n \"transaction_status\": \"settlement\",\n \"transaction_id\": \"5654e1a9-0d00-4e93-8629-026e6282e4d5\",\n \"status_message\": \"midtrans payment notification\",\n \"status_code\": \"200\",\n \"signature_key\": \"27bad17aac3ca8e2d22096d747d4ea6630237db179df4d3576c93a4300c6bcb72b69c9ca62f90b7af2a005100373b584051406df4f47ec51af4b55bd84de6898\",\n \"settlement_time\": \"2026-08-03 21:31:20\",\n \"pop_id\": \"7c27736b-deb2-483f-a152-2ff50803a3ba\",\n \"payment_type\": \"qris\",\n \"order_id\": \"ERPSKRIP-2608030000000637.TKG-260801001361\",\n \"merchant_id\": \"G277033254\",\n \"merchant_cross_reference_id\": \"d65f691f-4ba1-4dc6-a6eb-bd3f3303416a\",\n \"issuer\": \"BJB\",\n \"gross_amount\": \"159000.00\",\n \"fraud_status\": \"accept\",\n \"expiry_time\": \"2026-08-04 21:26:58\",\n \"customer_details\": {\n \"phone\": \"+6281952988381\",\n \"full_name\": \"Saepudin \",\n \"email\": \"saepudin@example.com\"\n },\n \"currency\": \"IDR\",\n \"acquirer\": \"gopay\"\n}",
|
||||
"raw": "{\n \"transaction_type\": \"off-us\",\n \"transaction_time\": \"2026-08-03 21:26:58\",\n \"transaction_status\": \"settlement\",\n \"transaction_id\": \"00000000-0000-4000-8000-000000000001\",\n \"status_message\": \"midtrans payment notification\",\n \"status_code\": \"200\",\n \"signature_key\": \"REPLACE_WITH_YOUR_OWN_CAPTURED_SIGNATURE_KEY_1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890\",\n \"settlement_time\": \"2026-08-03 21:31:20\",\n \"pop_id\": \"00000000-0000-4000-8000-000000000002\",\n \"payment_type\": \"qris\",\n \"order_id\": \"DEMO-MERCHANT-0002.ITEM-0002\",\n \"merchant_id\": \"G000000000\",\n \"merchant_cross_reference_id\": \"00000000-0000-4000-8000-000000000003\",\n \"issuer\": \"BJB\",\n \"gross_amount\": \"159000.00\",\n \"fraud_status\": \"accept\",\n \"expiry_time\": \"2026-08-04 21:26:58\",\n \"customer_details\": {\n \"phone\": \"+628123456789\",\n \"full_name\": \"Contoh Pelanggan\",\n \"email\": \"contoh.pelanggan@example.com\"\n },\n \"currency\": \"IDR\",\n \"acquirer\": \"gopay\"\n}",
|
||||
"options": { "raw": { "language": "json" } }
|
||||
}
|
||||
}
|
||||
|
|
@ -295,7 +295,7 @@
|
|||
"header": [{ "key": "Content-Type", "value": "application/json" }],
|
||||
"url": { "raw": "{{base_url}}/api/test/notify-erp", "host": ["{{base_url}}"], "path": ["api", "test", "notify-erp"] },
|
||||
"description": "Bypasses the webhook entirely and calls notifyERP() directly — useful for testing ERP_NOTIFICATION_URL(S)/ERP_CLIENT_ID wiring in isolation.",
|
||||
"body": { "mode": "raw", "raw": "{\n \"orderId\": \"ERPSKRIP-2608030000000627.TKG-260803000063\",\n \"nominal\": \"179000\",\n \"mercant_id\": \"ERPSKRIP-2608030000000627\"\n}", "options": { "raw": { "language": "json" } } }
|
||||
"body": { "mode": "raw", "raw": "{\n \"orderId\": \"DEMO-MERCHANT-0001.ITEM-0001\",\n \"nominal\": \"179000\",\n \"mercant_id\": \"DEMO-MERCHANT-0001\"\n}", "options": { "raw": { "language": "json" } } }
|
||||
}
|
||||
}
|
||||
]
|
||||
|
|
|
|||
|
|
@ -129,9 +129,9 @@ Cek status transaksi (passthrough Midtrans). Juga memicu fallback notifikasi ERP
|
|||
Requires `X-API-KEY`. **Rate-limited.**
|
||||
```json
|
||||
{
|
||||
"order_id": "ERPSKRIP-2608030000000627:TKG-260803000063",
|
||||
"order_id": "DEMO-MERCHANT-0001:ITEM-0001",
|
||||
"nominal": 179000,
|
||||
"customer": { "name": "Yusnika Nur Faidah", "phone": "0881022144656", "email": "yusnika_nur_faidah@example.com" },
|
||||
"customer": { "name": "Budi Santoso", "phone": "081234567890", "email": "budi.santoso@example.com" },
|
||||
"expire_at": 1785852063058
|
||||
}
|
||||
```
|
||||
|
|
@ -240,7 +240,7 @@ Atau pakai `postman/Midtrans-Middleware.postman_collection.json` — mencakup se
|
|||
|
||||
### Format Log (file, satu baris per event)
|
||||
```
|
||||
[2026-08-03T21:35:54.746+07:00] [INFO ] webhook.notifying_erp | {"order_id":"ERPSKRIP-2608030000000637.TKG-260801001361","mercant_id":"ERPSKRIP-2608030000000637"}
|
||||
[2026-08-03T21:35:54.746+07:00] [INFO ] webhook.notifying_erp | {"order_id":"DEMO-MERCHANT-0002.ITEM-0002","mercant_id":"DEMO-MERCHANT-0002"}
|
||||
```
|
||||
|
||||
Paling nyaman dibaca lewat `GET /api/logs/view` (filter level, cari teks, klik nilai untuk trace) daripada membaca file mentah.
|
||||
|
|
|
|||
|
|
@ -88,9 +88,9 @@
|
|||
"content": {
|
||||
"application/json": {
|
||||
"example": {
|
||||
"order_id": "ERPSKRIP-2608030000000627:TKG-260803000063",
|
||||
"order_id": "DEMO-MERCHANT-0001:ITEM-0001",
|
||||
"nominal": 179000,
|
||||
"customer": { "name": "Yusnika Nur Faidah", "phone": "0881022144656", "email": "yusnika_nur_faidah@example.com" },
|
||||
"customer": { "name": "Budi Santoso", "phone": "081234567890", "email": "budi.santoso@example.com" },
|
||||
"expire_at": 1785852063058
|
||||
}
|
||||
}
|
||||
|
|
@ -99,7 +99,7 @@
|
|||
"responses": {
|
||||
"200": {
|
||||
"description": "Link created",
|
||||
"content": { "application/json": { "example": { "status": "200", "messages": "SUCCESS", "data": { "url": "http://localhost:5173/pay/eyJ2Ijox...", "order_id": "ERPSKRIP-2608030000000627:TKG-260803000063", "midtrans_order_id": "ERPSKRIP-2608030000000627.TKG-260803000063", "expire_at": 1785852063058 } } } }
|
||||
"content": { "application/json": { "example": { "status": "200", "messages": "SUCCESS", "data": { "url": "http://localhost:5173/pay/eyJ2Ijox...", "order_id": "DEMO-MERCHANT-0001:ITEM-0001", "midtrans_order_id": "DEMO-MERCHANT-0001.ITEM-0001", "expire_at": 1785852063058 } } } }
|
||||
},
|
||||
"400": { "description": "Missing/invalid order_id or nominal" },
|
||||
"401": { "description": "Invalid X-API-KEY" },
|
||||
|
|
@ -116,7 +116,7 @@
|
|||
"responses": {
|
||||
"200": {
|
||||
"description": "OK",
|
||||
"content": { "application/json": { "example": { "order_id": "ERPSKRIP-2608030000000627.TKG-260803000063", "nominal": 179000, "customer": { "name": "Yusnika Nur Faidah", "phone": "0881022144656", "email": "yusnika_nur_faidah@example.com" }, "expire_at": 1785852063058, "allowed_methods": null } } }
|
||||
"content": { "application/json": { "example": { "order_id": "DEMO-MERCHANT-0001.ITEM-0001", "nominal": 179000, "customer": { "name": "Budi Santoso", "phone": "081234567890", "email": "budi.santoso@example.com" }, "expire_at": 1785852063058, "allowed_methods": null } } }
|
||||
},
|
||||
"400": { "description": "Invalid token" },
|
||||
"410": { "description": "Token expired" }
|
||||
|
|
@ -134,12 +134,12 @@
|
|||
"content": {
|
||||
"application/json": {
|
||||
"example": {
|
||||
"mercant_id": "ERPSKRIP-2608030000000627",
|
||||
"mercant_id": "DEMO-MERCHANT-0001",
|
||||
"nominal": 179000,
|
||||
"nama": "Yusnika Nur Faidah",
|
||||
"no_telepon": "0881022144656",
|
||||
"email": "yusnika_nur_faidah@example.com",
|
||||
"item": [{ "item_id": "TKG-260803000063" }],
|
||||
"nama": "Budi Santoso",
|
||||
"no_telepon": "081234567890",
|
||||
"email": "budi.santoso@example.com",
|
||||
"item": [{ "item_id": "ITEM-0001" }],
|
||||
"allowed_methods": ["bank_transfer", "gopay"]
|
||||
}
|
||||
}
|
||||
|
|
@ -215,7 +215,7 @@
|
|||
"required": true,
|
||||
"content": {
|
||||
"application/json": {
|
||||
"example": { "order_id": "ERPSKRIP-2608030000000637.TKG-260801001361", "transaction_status": "settlement", "status_code": "200", "gross_amount": "159000.00", "signature_key": "..." }
|
||||
"example": { "order_id": "DEMO-MERCHANT-0002.ITEM-0002", "transaction_status": "settlement", "status_code": "200", "gross_amount": "159000.00", "signature_key": "..." }
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
|
|||
Loading…
Reference in New Issue