parseEnable()'s generic fallback (return true for an unset var) is correct
for the payment-method toggles it's shared with, but wrong for a security
gate: LOG_EXPOSE_API controlled whether /api/logs*, /openapi.json, and /docs
serve anything at all, and previously defaulted to true (open) when the env
var was absent, contradicting what .env.example already documented as the
safe default. Now explicitly defaults to 'false'.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
server/openapi.json, server/README.md, and the Postman collection used what
turned out to be real customer names/phone numbers and a real Midtrans
webhook notification (copied during earlier debugging) as documentation
examples instead of fabricated placeholder data. Replaced with clearly
synthetic values (Budi Santoso, DEMO-MERCHANT-*, placeholder UUIDs/signature).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Root README.md was frontend-only and didn't mention the backend at all.
server/README.md was stale relative to the endpoint/security changes in this
branch (missing POST /api/payment-links, the sanitized order_id behavior,
rate limiting, CORS, log retention, state persistence, admin auth) and linked
to a temp/README.md that no longer exists. Both now point to /docs, /openapi.json,
and the Postman collection as the source of truth for the API surface.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Added 'Inter' font to global CSS and Tailwind config for improved typography.
- Deleted unused test files related to payment link creation and Snap token testing.
- Created comprehensive README for server setup, API endpoints, and payment flow.
- Added testing documentation for easier integration and usage of the payment system.
Tengku Achmad