root
/
Midtrans-Middleware
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Midtrans-Middleware
81 Commits 6 Branches 0 Tags 5.2 MiB
TypeScript 68.8%
JavaScript 25.4%
HTML 4.9%
CSS 0.9%
Go to file
Tengku Achmad 0936b0e84f fix: default LOG_EXPOSE_API to closed (false) when unset 
parseEnable()'s generic fallback (return true for an unset var) is correct
for the payment-method toggles it's shared with, but wrong for a security
gate: LOG_EXPOSE_API controlled whether /api/logs*, /openapi.json, and /docs
serve anything at all, and previously defaulted to true (open) when the env
var was absent, contradicting what .env.example already documented as the
safe default. Now explicitly defaults to 'false'.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 		2026-08-03 23:06:36 +07:00
postman fix: scrub real customer PII and a captured webhook payload from docs 2026-08-03 23:01:16 +07:00
public feat: update favicon and page title for branding 2025-11-22 11:58:37 +07:00
scripts Fix Snap payment flow: direct to payment UI in step 2 and add customer/item details to API request 2025-12-03 17:01:12 +07:00
server fix: default LOG_EXPOSE_API to closed (false) when unset 2026-08-03 23:06:36 +07:00
src Merge branch 'main' of https://git.winteraccess.id/root/Midtrans-Middleware 2026-01-06 20:46:26 +07:00
tests fix: update webhook signature retrieval and enhance error logging; correct file path in payment link test 2025-12-08 11:58:44 +07:00
.env.example fix: default LOG_EXPOSE_API to closed (false) when unset 2026-08-03 23:06:36 +07:00
.gitignore fix: harden payment-creation endpoints and persist server state 2026-08-03 22:48:37 +07:00
README.md docs: rewrite README with backend setup, security, and tooling references 2026-08-03 22:49:48 +07:00
ecosystem.config.cjs fix: harden payment-creation endpoints and persist server state 2026-08-03 22:48:37 +07:00
eslint.config.js feat(payments): stabilisasi QRIS & CStore; hapus tombol Buat QR 2025-11-10 11:10:35 +07:00
index.html feat: update global styles and Tailwind configuration with Inter font; remove obsolete test files and add server documentation 2025-12-04 22:57:38 +07:00
package-lock.json feat: add fs and path dependencies; update server logging and webhook handling 2025-12-05 15:05:51 +07:00
package.json feat: add fs and path dependencies; update server logging and webhook handling 2025-12-05 15:05:51 +07:00
postcss.config.cjs feat(payments): stabilisasi QRIS & CStore; hapus tombol Buat QR 2025-11-10 11:10:35 +07:00
tailwind.config.ts feat: update global styles and Tailwind configuration with Inter font; remove obsolete test files and add server documentation 2025-12-04 22:57:38 +07:00
tsconfig.app.json feat(payments): stabilisasi QRIS & CStore; hapus tombol Buat QR 2025-11-10 11:10:35 +07:00
tsconfig.json feat(payments): stabilisasi QRIS & CStore; hapus tombol Buat QR 2025-11-10 11:10:35 +07:00
tsconfig.node.json feat(payments): stabilisasi QRIS & CStore; hapus tombol Buat QR 2025-11-10 11:10:35 +07:00
vite.config.ts feat(payments): stabilisasi QRIS & CStore; hapus tombol Buat QR 2025-11-10 11:10:35 +07:00

README.md

Midtrans Middleware (CIFO)

Vite + React frontend dan Express backend untuk integrasi pembayaran Midtrans (Core API + Snap) dengan sistem ERP.

Struktur Project

server/     Express backend (single-file: server/index.cjs)
src/        Frontend React (checkout, halaman /pay, dashboard demo)
postman/    Postman collection — seluruh endpoint API
tests/      Script testing manual untuk backend
scripts/    Utility script (mis. fetch-logos.mjs)

Setup

  1. Duplikasi file contoh env dan isi nilainya:
cp .env.example .env

Isi .env sesuai kebutuhan — lihat .env.example untuk daftar lengkap variabel beserta penjelasannya (Midtrans key, EXTERNAL_API_KEY, PAYMENT_LINK_SECRET, LOG_BASIC_AUTH_USER/PASS, dll). Generate secret yang kuat dengan:

node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
  1. Install dependencies:
npm install
  1. Jalankan backend dan frontend (dua terminal terpisah):
npm run server   # backend Express, default http://localhost:8000
npm run dev      # frontend Vite, default http://localhost:5173

API Backend

Dokumentasi lengkap seluruh endpoint ada di dua tempat:

  • Interaktif (Scalar) — buka http://localhost:8000/docs di browser (dilindungi HTTP Basic Auth, kredensial sama dengan /api/logs*, lihat LOG_BASIC_AUTH_USER/LOG_BASIC_AUTH_PASS). Spec mentah tersedia di /openapi.json.
  • Postman — import postman/Midtrans-Middleware.postman_collection.json, sudah berisi seluruh route (payment link, charge, snap token, webhook, logs, dev/test endpoints) dikelompokkan per folder.

Detail arsitektur & alur pembayaran ada di server/README.md.

Alat Bantu Operasional

  • Log viewer — http://localhost:8000/api/logs/view (dilindungi Basic Auth). Bisa filter per level, cari teks/order_id, dan klik nilai apa pun untuk trace lintas baris log yang berkaitan. Log otomatis dihapus setelah LOG_RETENTION_DAYS (default 30 hari).
  • Payment link dibuat lewat POST /api/payment-links (payload langsung order_id/nominal/customer/expire_at) atau POST /createtransaksi (payload ERP mercant_id/item[]).

Catatan Integrasi Midtrans

  • Client Key hanya digunakan di frontend (mis. tokenisasi kartu/3DS, Snap.js). Server Key tidak pernah dikirim ke frontend.
  • Order pembayaran punya dua alur: (1) link yang dibagikan ke pelanggan (dibuat lewat /createtransaksi atau /api/payment-links, di-resolve oleh halaman /pay/:token), dan (2) checkout langsung dari browser (/api/payments/charge, /api/payments/snap/token) tanpa pra-registrasi — keduanya diberi rate limit untuk mencegah abuse.
  • order_id yang mengandung karakter selain alfanumerik/- _ ~ . (mis. :) otomatis disanitasi jadi . sebelum dikirim ke Midtrans.
  • Status real-time dapat diimplementasikan via polling (TanStack Query) atau webhook (POST /api/payments/notification) yang meneruskan notifikasi ke ERP.

Struktur Env di Kode Frontend

Akses env melalui modul src/lib/env.ts:

  • Env.API_BASE_URL
  • Env.MIDTRANS_CLIENT_KEY
  • Env.MIDTRANS_ENV

Lisensi

Internal project — CIFO Group.