[buttercode101]

Closes the pay-then-close-tab credit-loss gap: credits are now granted server-side from Paystack webhooks, not only via the browser callback.

What

• POST /api/paystack-webhook with a raw-body parser mounted before express.json() for this route only.
• HMAC-SHA512 of the raw body vs x-paystack-signature, timing-safe compare via server/secretCompare.js; missing/invalid signature 400, unconfigured secret 503.
• On charge.success / invoice.payment_succeeded: extracts CC reference, re-verifies server-side via existing verifyPaystack(), requires status success + amount == PRICES[product] + ZAR (else 402), then store.saveGrant (existing write-once idempotency handles replay).
• Other events / non-CC references acknowledged 200 ignored; transient verify/storage failures 502/503 so Paystack retries.
• Event-id dedupe: logs [paystack-webhook] with event/eventId/reference only; in-memory processed-event set (cap 1000) short-circuits exact replays.

Tests - server/paystackWebhook.test.js: valid signature grants, exact replay dedupe, replay past dedupe cannot refill a spent credit, invalid signature 400, missing signature 400, wrong amount 402/no grant, unsupported event ignored, invoice.payment_succeeded grants pack3. npm test: 137 pass, 0 fail (136 baseline + 1 new).

Docs - docs/paystack-webhook.md: endpoint, event types, dedupe/retry semantics, Paystack dashboard setup steps (manual), local openssl smoke test. No live dashboard or prod env touched.

Do NOT merge/deploy - review first.

[vercel]

Deployment failed for project contract-cheq with the following error:

There is no GitHub account connected to this Vercel account.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
contractcheck-sa-v3	Ready	Preview	Nov 9, 2026 2:41pm UTC