Feat/sslcommerz integration by tenbytecloud · Pull Request #2 · vidinfra/flexprice-v1

tenbytecloud · 2026-01-21T08:01:51Z

Configuration - Added SSLCommerz config with session API, validation API, IPN URL, and redirect URLs
Client - SSLCommerz API client for creating payment sessions and validating payments
Payment Service - Creates payment links via SSLCommerz API
Webhook Handler - Handles IPN callbacks from SSLCommerz
Connection Metadata - SSLCommerz credentials (store_id, store_password) stored encrypted in connections table
Integration Factory - SSLCommerz integration wired into the factory pattern

Disclaimer: This comment was generated by Greptile AI CTO

Greptile Summary

Adds SSLCommerz payment gateway for Bangladesh market with session-based payment links, IPN webhook validation, and encrypted credential storage. Implementation follows existing payment gateway patterns (Stripe, Razorpay) with proper separation of concerns.

Key Changes:

SSLCommerz client with session creation and order validation APIs
Payment link generation with invoice validation and customer fallbacks
IPN webhook with background processing and panic recovery
Connection metadata stored encrypted in database (not config)
CORS middleware fixed to use origin whitelist instead of echo-all
Wallet transaction balance tracking fields added

Critical Issues:

Webhook goroutine race condition: duplicate IPNs can process same payment concurrently
Background context timeout could cause silent failures after 200 OK response

Architecture Decisions:

Using payment ID as transaction ID eliminates collision risks
Risk level 1 payments blocked by default (needs business decision on fraud tolerance)
Customer service failures handled gracefully with defaults

Confidence Score: 3/5

Safe for tight-deadline launch but has race condition risk from concurrent webhook processing
Score reflects solid architecture and security (encrypted credentials, validation API) but webhook race condition and context timeout are deployment risks. For MVP launch, acceptable if you monitor failed webhooks and can reprocess manually. For production scale, fix race condition with payment locking or idempotency.
Pay close attention to internal/integration/sslcommerz/webhook/handler.go and internal/api/v1/webhook.go for race conditions and timeout handling

Important Files Changed

Filename	Overview
internal/integration/sslcommerz/client.go	SSLCommerz API client for session creation and validation - clean implementation with proper encryption handling
internal/integration/sslcommerz/payment.go	Payment link creation and reconciliation logic - solid validations and fallback handling for customer data
internal/integration/sslcommerz/webhook/handler.go	IPN webhook handler with validation API call - handles async processing correctly but has timeout context concerns
internal/api/v1/webhook.go	Added SSLCommerz webhook endpoint with goroutine processing and panic recovery - follows existing patterns
internal/service/payment_processor.go	Integrated SSLCommerz payment link creation into payment processor - follows existing gateway pattern

- fix cors issue - fix wallet tx issue - fix field missing issue

- Add SSLCommerz client with session API and validation API support - Add payment service for creating SSLCommerz payment links - Add webhook handler for IPN callbacks - Add SSLCommerz configuration in config.go and config.yaml - Add SSLCommerz connection metadata types - Add SSLCommerz case in connection repository for metadata conversion - Add SSLCommerz payment gateway type and secret provider - Integrate SSLCommerz in payment processor service

tenbytecloud · 2026-01-21T08:05:22Z

@greptileai review

tenbytecloud · 2026-01-21T09:58:24Z

@greptileai review

tenbytecloud · 2026-01-21T11:25:24Z

@greptileai review all the files of this PR only, stop the previous work of yours

greptile-apps

Additional Comments (3)

internal/domain/subscription/model.go, line 147-220 (link)

logic: Missing InvoiceCadence field in conversion function. This will cause data loss when converting from database entities.
internal/domain/wallet/transaction.go, line 57-84 (link)

logic: Missing BalanceBefore and BalanceAfter fields in ToEnt() conversion. These should be mapped to maintain data consistency between domain and entity layers.
internal/domain/wallet/transaction.go, line 88-122 (link)

logic: Missing BalanceBefore and BalanceAfter fields in FromEnt() conversion. Add mappings for these fields to prevent data loss during entity-to-domain conversion.

_{39 files reviewed, 16 comments}

_{Edit Code Review Agent Settings | Greptile}

scripts/main.go

internal/rest/middleware/cors.go

internal/config/config.go

scripts/internal/seed_sslcommerz_connection.go

internal/integration/sslcommerz/webhook/handler.go

internal/service/payment_processor.go

internal/integration/sslcommerz/client.go

internal/repository/ent/wallet.go

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

SSLCommerz improvements: - Use PaymentID as TranID for unique transaction identification - Update webhook handler to lookup payments by PaymentID - Remove redundant GatewayPageURL field from response DTO - Fix BaseFair -> BaseFare spelling in validation response Security enhancements: - Add CORS origin whitelisting with configurable allowed_origins - Remove store credentials from config (use Connection API instead) - Remove seed script in favor of POST /connections endpoint Code cleanup: - Separate error handling for service errors vs empty results - Remove unused SSLCommerz flags from scripts/main.go

- Add InvoiceCadence field mapping in GetSubscriptionFromEnt() - Add balance_before and balance_after fields to wallet transaction: - Update ent schema with new decimal fields - Update ToEnt() and FromEnt() conversion functions - Add V5 migration files (up/down) for new columns

tenbytecloud · 2026-01-22T12:41:13Z

@greptileai review last 3 commits

greptile-apps

_{46 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

internal/api/v1/webhook.go

internal/integration/sslcommerz/webhook/handler.go

greptile-apps · 2026-01-22T12:44:24Z

internal/integration/sslcommerz/webhook/handler.go

+	if ipnData.RiskLevel == "1" && ipnData.Status == "VALID" {
+		h.logger.Warnw("SSLCommerz payment is VALID but risk_level=1, holding for manual verification",
+			"tran_id", ipnData.TranID,
+			"val_id", ipnData.ValID,
+			"risk_level", ipnData.RiskLevel)
+
+		err = h.updatePaymentStatus(ctx, ipnData, "PENDING_VERIFICATION",
+			lo.ToPtr("Payment is valid but risk level is high; manual verification required."),
+			services)
+		if err != nil {
+			h.logger.Errorw("failed to update payment status for high-risk transaction",
+				"error", err,
+				"tran_id", ipnData.TranID)
+		}
+		return nil


style: Risk_level=1 with VALID status means "high risk but payment cleared." SSLCommerz docs say you CAN accept these after manual review. Current logic blocks ALL risk_level=1 automatically.

For tight deadlines, consider: if business accepts the fraud risk, remove this block and log warning only. If manual review required, ensure someone monitors these PENDING_VERIFICATION payments.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

Prompt To Fix With AI

This is a comment left during a code review. Path: internal/integration/sslcommerz/webhook/handler.go Line: 85:99 Comment: **style:** Risk_level=1 with VALID status means "high risk but payment cleared." SSLCommerz docs say you CAN accept these after manual review. Current logic blocks ALL risk_level=1 automatically. For tight deadlines, consider: if business accepts the fraud risk, remove this block and log warning only. If manual review required, ensure someone monitors these PENDING_VERIFICATION payments. <sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub> How can I resolve this? If you propose a fix, please make it concise.

saagoor · 2026-01-26T12:59:36Z

internal/config/config.yaml

+  # Redirect URLs after payment
+  success_url: "https://seedless-garishly-ahmed.ngrok-free.dev/payment/success"
+  fail_url: "https://seedless-garishly-ahmed.ngrok-free.dev/payment/fail"
+  cancel_url: "https://seedless-garishly-ahmed.ngrok-free.dev/payment/cancel"


Do we need these here?

srtenbyte and others added 4 commits January 7, 2026 02:00

Fix signup issue for mising field in subscription schema

2f8d50b

Fix startup issue by changing config.yaml rbac.json path

ab74419

fix: fix signup issue

c2eeaa0

- fix cors issue - fix wallet tx issue - fix field missing issue

chore: add sslcommerz seeder script at server startup

85a0fe0

fix: fix webhook context timeout issue with panic recovery

7fd0b63

greptile-apps bot reviewed Jan 21, 2026

View reviewed changes

srtenbyte and others added 4 commits January 22, 2026 14:11

Update internal/integration/sslcommerz/client.go

05cdb31

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

fix: allow account service as allowed origin

d2f4ba3

greptile-apps bot reviewed Jan 22, 2026

View reviewed changes

chore: add context cancelling insside webhook goroutine

b2dbb76

saagoor approved these changes Jan 26, 2026

View reviewed changes

Conversation

tenbytecloud commented Jan 21, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

tenbytecloud commented Jan 21, 2026

Uh oh!

tenbytecloud commented Jan 21, 2026

Uh oh!

tenbytecloud commented Jan 21, 2026

Uh oh!

greptile-apps bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Additional Comments (3)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tenbytecloud commented Jan 22, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

saagoor Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tenbytecloud commented Jan 21, 2026 •

edited by greptile-apps bot

Loading

greptile-apps bot left a comment •

edited

Loading