State maps (activeOrders, notifiedOrders, orderRetryCount, orderMerchantId)
were keyed by the raw order_id in /createtransaksi and /api/payment-links,
but Midtrans webhooks and status checks always report back the sanitized
('.'-joined) order_id. Whenever the original order_id contained characters
Midtrans disallows (e.g. ':'), the two never matched — breaking duplicate/
already-completed detection and retry-suffix lookups. Both endpoints now
key exclusively on the sanitized order_id, with retry-suffix support added
to /api/payment-links for parity with /createtransaksi.
Also add HTTP Basic Auth (requireLogBasicAuth) in front of /api/logs,
/api/logs/files, and /api/logs/files/:filename — these were previously
gated only by LOG_EXPOSE_API, which defaults to true, leaving order data
and transaction details publicly readable with no credentials.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a new endpoint that creates a shareable Midtrans Snap payment link
straight from { order_id, nominal, customer, expire_at } without remapping
to the mercant_id/item[] shape required by /createtransaksi.
order_id is sanitized (':' and other disallowed chars -> '.') before being
sent to Midtrans, while the mercant_id used for ERP webhook notification is
derived from the original, unsanitized order_id so ERP always gets a clean
identifier instead of the full composite order_id.
Includes a Postman collection covering link creation, resolution, status
check, and replaying a captured Midtrans notification payload for local
webhook debugging.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Midtrans rejects order_id values containing ':' (only alphanumeric and
- _ ~ . are allowed). The composite mercant_id:item_id order_id and the
:rN retry suffix violated this, causing Snap token requests to fail
with a 400 once both a mercant_id and item_id were present.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Added 'Inter' font to global CSS and Tailwind config for improved typography.
- Deleted unused test files related to payment link creation and Snap token testing.
- Created comprehensive README for server setup, API endpoints, and payment flow.
- Added testing documentation for easier integration and usage of the payment system.
- Add customerName prop to PaymentSheet component
- Display customer name in payment summary below Order ID
- Pass customer name from CheckoutPage form to PaymentSheet
- Fix TypeScript build errors (remove unused variables)
- Improve error logging in API interceptor
- Clean up snapLoader (remove unused snapLoading variable)
- Clean up PayPage (remove unused allowedMethods, runtimeCfg)
- Move lockOrder call to onSuccess callback in PayPage
- Add BOM handling in test-create-payment-link script
- Update test payment data (REFNO-002, TKG-2512041)
- Add guard in AutoSnapPayment to only trigger when orderId and amount are valid
- Show loading state while waiting for payment data to resolve
- Prevent premature Snap token creation with empty/invalid data
- Fix PayPage and CheckoutPage auto-payment flow
- Add AutoSnapPayment component that auto-triggers Snap popup on mount
- Update CheckoutPage: auto-open Snap payment after form submission
- Update PayPage: auto-open Snap payment on page load
- Remove manual button clicks for smoother UX
- Add loading states and error handling for auto-payment flow
- Created src/lib/errorMessages.ts for user-friendly Bahasa Indonesia error messages
- Created src/components/LoadingOverlay.tsx with Framer Motion animations
- Updated BankTransferPanel with LoadingOverlay and mapErrorToUserMessage
- All 4 error catch blocks now use user-friendly messages
- GoPayPanel imports restored (ready for next iteration)
Story: 1.1 - Prevent Duplicate VA/QR/Code Generation & Improve Feedback
Status: Partial (BankTransferPanel complete, GoPayPanel & CStorePanel pending)
Update default payment link TTL from 30 minutes to 24 hours across frontend and backend. Also modify countdown display to show hours in addition to minutes and seconds.
otifyERP to broadcast payload to all endpoints and aggregate results\n- Log per-endpoint result and summary via erp.notify.success and erp.notify.summary\n- Add dev endpoint /api/echo2 for local multi-URL testing\n\nThis ensures signature is included in body for all endpoints and improves visibility in logs.
Tengku Achmad
root
CIFO Dev
Ariq