feat(payments): per-channel Robokassa shops on the direct rail #266

Merged

developer merged 1 commits from feature/robokassa-multishop into development 2026-07-14 13:16:35 +00:00

Conversation 1 Commits 1 Files Changed 26

+448 -42

developer commented 2026-07-14 12:58:24 +00:00

Owner

Copy Link

Copy Source

What

Split the single Robokassa direct rail into one merchant shop per channel (web / android; ios later), chosen by the trusted X-Platform subtype, while every shop still credits the one direct wallet. Merchant-account separation for accounting / receipts — not a new wallet.

Changes

• config — a channel-keyed robokassa.Shops registry: web seeds from the legacy BACKEND_ROBOKASSA_* (or _WEB_*), android from _ANDROID_*; an empty shop leaves the rail dormant; per-shop validation.
• intake — the order picks its shop by X-Platform subtype (unknown → web fallback); the per-shop Result callback is verified by that shop's own Password2 at /pay/robokassa/result/<channel>. The gateway extracts the channel from the path suffix; Caddy's /pay/* glob already forwards it — no Caddyfile change.
• persistence — an additive shop column on the order (migration 00015), recorded from the payment context and surfaced per entry in the admin financial report.
• identity — standalone apps (Android/iOS) sign in by email only, so a direct purchase always has its email anchor (D36).
• docs — PAYMENTS.md (+ _ru) topology, deploy env vars + compose mapping, the decisions log (D41 revised for the ИП / 54-ФЗ move; D42-D44), the plan.

Safety

• Contour-safe / dormant until shops are configured (empty creds = rail off, unchanged from today).
• Migration is additive (shop text NOT NULL DEFAULT '') — applies forward via goose, no contour wipe, image-rollback ignores it.
• No client wire change.

Verification

• go build/vet ./backend/... ./gateway/..., gofmt clean; all backend + gateway unit tests green; payments integration green (migration 00015 + intake on real Postgres).

Follow-ups (out of scope here)

• Fiscalization (send Receipt + Email, 54-ФЗ) — when the owner's ИП / ОФД / СНО are live.
• Confirm the gateway emits direct/android for the native build — only matters once android payments are un-hidden.
• Owner-side: create the web/android shops in the Robokassa cabinet + set the CI secrets/vars.

## What Split the single Robokassa **direct** rail into one merchant shop **per channel** (`web` / `android`; `ios` later), chosen by the trusted `X-Platform` subtype, while every shop still credits the one `direct` wallet. Merchant-account separation for accounting / receipts — **not** a new wallet. ## Changes - **config** — a channel-keyed `robokassa.Shops` registry: `web` seeds from the legacy `BACKEND_ROBOKASSA_*` (or `_WEB_*`), `android` from `_ANDROID_*`; an empty shop leaves the rail dormant; per-shop validation. - **intake** — the order picks its shop by `X-Platform` subtype (unknown → web fallback); the per-shop Result callback is verified by that shop's own Password2 at `/pay/robokassa/result/<channel>`. The gateway extracts the channel from the path suffix; Caddy's `/pay/*` glob already forwards it — **no Caddyfile change**. - **persistence** — an additive `shop` column on the order (migration `00015`), recorded from the payment context and surfaced per entry in the admin financial report. - **identity** — standalone apps (Android/iOS) sign in by email only, so a direct purchase always has its email anchor (D36). - **docs** — `PAYMENTS.md` (+ `_ru`) topology, deploy env vars + compose mapping, the decisions log (D41 revised for the ИП / 54-ФЗ move; D42-D44), the plan. ## Safety - **Contour-safe / dormant** until shops are configured (empty creds = rail off, unchanged from today). - Migration is **additive** (`shop text NOT NULL DEFAULT ''`) — applies forward via goose, no contour wipe, image-rollback ignores it. - **No client wire change.** ## Verification - `go build/vet ./backend/... ./gateway/...`, `gofmt` clean; all backend + gateway **unit tests green**; **payments integration** green (migration `00015` + intake on real Postgres). ## Follow-ups (out of scope here) - **Fiscalization** (send `Receipt` + `Email`, 54-ФЗ) — when the owner's ИП / ОФД / СНО are live. - Confirm the gateway emits `direct/android` for the native build — only matters once android payments are un-hidden. - Owner-side: create the web/android shops in the Robokassa cabinet + set the CI secrets/vars.

developer added 1 commit 2026-07-14 12:58:24 +00:00

feat(payments): per-channel Robokassa shops on the direct rail ... eef90a152e

Split the single Robokassa direct rail into one merchant shop per channel
(web / android; ios later), chosen by the trusted X-Platform subtype, while
every shop still credits the one `direct` wallet — merchant-account separation
for accounting and receipts, not a new wallet.

- config: a channel-keyed shops registry (web seeds from the legacy vars or
  _WEB_*, android from _ANDROID_*); an empty shop leaves the rail dormant;
  per-shop validation.
- intake: the order picks its shop by subtype (unknown falls back to web); the
  per-shop Result callback is verified by that shop's own Password2 at
  /pay/robokassa/result/<channel> (the gateway extracts the channel; Caddy's
  /pay/* glob already forwards it — no Caddyfile change).
- persistence: an additive `shop` column on the order (migration 00015),
  recorded from the payment context, surfaced per entry in the admin report.
- standalone apps sign in by email only, so a direct purchase keeps its email
  anchor.
- docs: PAYMENTS (+ru) topology, deploy env vars + compose mapping, the
  decisions log (D41 revised for the ИП / 54-ФЗ move; D42-D44), the plan.

Contour-safe: dormant until shops are configured; the migration is additive
(no wipe); no client wire change. Fiscalization (Receipt/Email) and the gateway
`direct/android` subtype follow when the ИП / RuStore are live.

owner approved these changes 2026-07-14 13:16:02 +00:00

developer merged commit 4b3c9d4fdd into development 2026-07-14 13:16:35 +00:00

developer deleted branch feature/robokassa-multishop 2026-07-14 13:16:36 +00:00

developer referenced this pull request 2026-07-14 14:30:27 +00:00

feat(payments): live payment-availability kill switch + per-account override #267

developer referenced this pull request 2026-07-14 20:23:48 +00:00

release: promote development → master (v1.21.0) #272

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#266