bKash集成完整指南

graph TD
    A[提交申请材料] --> B[bKash初审]
    B --> C[补充材料]
    C --> D[实地核查]
    D --> E[风控评估]
    E --> F[签署协议]
    F --> G[获得API凭证]
    G --> H[技术集成测试]
    H --> I[正式上线]

┌─────────────────────────────────────────────────────────────┐
│                    bKash Payment Gateway                    │
├─────────────────────────────────────────────────────────────┤
│  Web API Layer  │  Mobile API  │  USSD Gateway │  Agent API │
├─────────────────────────────────────────────────────────────┤
│              Core Payment Processing Engine                 │
├─────────────────────────────────────────────────────────────┤
│   Risk Engine   │   KYC System   │   Notification Service  │
├─────────────────────────────────────────────────────────────┤
│              Database Cluster (MySQL/Redis)               │
├─────────────────────────────────────────────────────────────┤
│          BRAC Bank Core Banking System Integration         │
└─────────────────────────────────────────────────────────────┘

// 获取访问令牌
POST /tokenized/checkout/token/grant
Headers: {
  "Content-Type": "application/json",
  "Accept": "application/json",
  "username": "YOUR_USERNAME",
  "password": "YOUR_PASSWORD"
}
Body: {
  "app_key": "YOUR_APP_KEY",
  "app_secret": "YOUR_APP_SECRET"
}

// 响应示例
{
  "statusCode": "0000",
  "statusMessage": "Successful",
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGc...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJ0eXAiOiJKV1QiLCJhbGc..."
}

POST /tokenized/checkout/create
Headers: {
  "Content-Type": "application/json",
  "Accept": "application/json", 
  "authorization": "Bearer " + id_token,
  "x-app-key": "YOUR_APP_KEY"
}
Body: {
  "mode": "0011",  // Payment mode
  "payerReference": "CUSTOMER_ID_123",
  "callbackURL": "https://yoursite.com/callback",
  "amount": "100.50",
  "currency": "BDT",
  "intent": "sale",
  "merchantInvoiceNumber": "INV_001"
}

// 响应示例
{
  "statusCode": "0000",
  "statusMessage": "Successful",
  "paymentID": "TR0011234567890",
  "bkashURL": "https://tokenized.pay.bka.sh/checkout?paymentID=TR0011234567890",
  "callbackURL": "https://yoursite.com/callback",
  "successCallbackURL": "https://yoursite.com/success",
  "failureCallbackURL": "https://yoursite.com/failure",
  "cancelledCallbackURL": "https://yoursite.com/cancel"
}

POST /tokenized/checkout/execute
Headers: {
  "Content-Type": "application/json",
  "Accept": "application/json",
  "authorization": "Bearer " + id_token,
  "x-app-key": "YOUR_APP_KEY"
}
Body: {
  "paymentID": "TR0011234567890"
}

// 成功响应
{
  "statusCode": "0000",
  "statusMessage": "Successful",
  "paymentID": "TR0011234567890",
  "trxID": "8M2A59MID7",
  "transactionStatus": "Completed",
  "amount": "100.50",
  "currency": "BDT",
  "paymentExecuteTime": "2024-01-15T10:30:45",
  "merchantInvoiceNumber": "INV_001"
}

POST /tokenized/checkout/payment/status
Headers: {
  "Content-Type": "application/json",
  "Accept": "application/json",
  "authorization": "Bearer " + id_token,
  "x-app-key": "YOUR_APP_KEY"
}
Body: {
  "paymentID": "TR0011234567890"
}

<?php
class BkashPayment {
    private $app_key;
    private $app_secret;
    private $username;
    private $password;
    private $base_url;
    
    public function __construct($config) {
        $this->app_key = $config['app_key'];
        $this->app_secret = $config['app_secret'];
        $this->username = $config['username'];
        $this->password = $config['password'];
        $this->base_url = $config['sandbox'] ? 
            'https://tokenized.sandbox.bka.sh/v1.2.0-beta' : 
            'https://tokenized.pay.bka.sh/v1.2.0-beta';
    }
    
    // 获取Token
    public function getToken() {
        $url = $this->base_url . '/tokenized/checkout/token/grant';
        
        $headers = [
            'Content-Type: application/json',
            'Accept: application/json',
            'username: ' . $this->username,
            'password: ' . $this->password
        ];
        
        $data = [
            'app_key' => $this->app_key,
            'app_secret' => $this->app_secret
        ];
        
        $response = $this->makeRequest($url, $headers, $data);
        return json_decode($response, true);
    }
    
    // 创建支付
    public function createPayment($amount, $invoice_number, $customer_id = '') {
        $token_response = $this->getToken();
        
        if ($token_response['statusCode'] !== '0000') {
            throw new Exception('Token获取失败: ' . $token_response['statusMessage']);
        }
        
        $url = $this->base_url . '/tokenized/checkout/create';
        
        $headers = [
            'Content-Type: application/json',
            'Accept: application/json',
            'authorization: Bearer ' . $token_response['id_token'],
            'x-app-key: ' . $this->app_key
        ];
        
        $data = [
            'mode' => '0011',
            'payerReference' => $customer_id,
            'callbackURL' => 'https://yoursite.com/bkash/callback',
            'amount' => strval($amount),
            'currency' => 'BDT',
            'intent' => 'sale',
            'merchantInvoiceNumber' => $invoice_number
        ];
        
        $response = $this->makeRequest($url, $headers, $data);
        return json_decode($response, true);
    }
    
    // 执行支付
    public function executePayment($payment_id) {
        $token_response = $this->getToken();
        
        $url = $this->base_url . '/tokenized/checkout/execute';
        
        $headers = [
            'Content-Type: application/json',
            'Accept: application/json',
            'authorization: Bearer ' . $token_response['id_token'],
            'x-app-key: ' . $this->app_key
        ];
        
        $data = ['paymentID' => $payment_id];
        
        $response = $this->makeRequest($url, $headers, $data);
        return json_decode($response, true);
    }
    
    // HTTP请求方法
    private function makeRequest($url, $headers, $data) {
        $ch = curl_init();
        
        curl_setopt_array($ch, [
            CURLOPT_URL => $url,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => json_encode($data),
            CURLOPT_HTTPHEADER => $headers,
            CURLOPT_TIMEOUT => 30,
            CURLOPT_SSL_VERIFYPEER => false
        ]);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        if (curl_errno($ch)) {
            throw new Exception('cURL错误: ' . curl_error($ch));
        }
        
        curl_close($ch);
        
        if ($http_code !== 200) {
            throw new Exception('HTTP错误: ' . $http_code);
        }
        
        return $response;
    }
}

// 使用示例
$config = [
    'app_key' => 'your_app_key',
    'app_secret' => 'your_app_secret',
    'username' => 'your_username',
    'password' => 'your_password',
    'sandbox' => true  // 生产环境设为false
];

$bkash = new BkashPayment($config);

try {
    // 创建支付
    $payment = $bkash->createPayment(100.00, 'INV_001', 'CUSTOMER_123');
    
    if ($payment['statusCode'] === '0000') {
        // 重定向到bKash支付页面
        header('Location: ' . $payment['bkashURL']);
        exit;
    } else {
        echo '支付创建失败: ' . $payment['statusMessage'];
    }
} catch (Exception $e) {
    echo '错误: ' . $e->getMessage();
}
?>

const axios = require('axios');

class BkashPayment {
    constructor(config) {
        this.appKey = config.appKey;
        this.appSecret = config.appSecret;
        this.username = config.username;
        this.password = config.password;
        this.baseUrl = config.sandbox ? 
            'https://tokenized.sandbox.bka.sh/v1.2.0-beta' : 
            'https://tokenized.pay.bka.sh/v1.2.0-beta';
    }
    
    async getToken() {
        try {
            const response = await axios.post(
                `${this.baseUrl}/tokenized/checkout/token/grant`,
                {
                    app_key: this.appKey,
                    app_secret: this.appSecret
                },
                {
                    headers: {
                        'Content-Type': 'application/json',
                        'Accept': 'application/json',
                        'username': this.username,
                        'password': this.password
                    }
                }
            );
            
            return response.data;
        } catch (error) {
            throw new Error(`Token获取失败: ${error.response?.data?.statusMessage || error.message}`);
        }
    }
    
    async createPayment(amount, invoiceNumber, customerId = '') {
        const tokenResponse = await this.getToken();
        
        if (tokenResponse.statusCode !== '0000') {
            throw new Error(`Token获取失败: ${tokenResponse.statusMessage}`);
        }
        
        try {
            const response = await axios.post(
                `${this.baseUrl}/tokenized/checkout/create`,
                {
                    mode: '0011',
                    payerReference: customerId,
                    callbackURL: 'https://yoursite.com/bkash/callback',
                    amount: amount.toString(),
                    currency: 'BDT',
                    intent: 'sale',
                    merchantInvoiceNumber: invoiceNumber
                },
                {
                    headers: {
                        'Content-Type': 'application/json',
                        'Accept': 'application/json',
                        'authorization': `Bearer ${tokenResponse.id_token}`,
                        'x-app-key': this.appKey
                    }
                }
            );
            
            return response.data;
        } catch (error) {
            throw new Error(`支付创建失败: ${error.response?.data?.statusMessage || error.message}`);
        }
    }
    
    async executePayment(paymentId) {
        const tokenResponse = await this.getToken();
        
        try {
            const response = await axios.post(
                `${this.baseUrl}/tokenized/checkout/execute`,
                { paymentID: paymentId },
                {
                    headers: {
                        'Content-Type': 'application/json',
                        'Accept': 'application/json',
                        'authorization': `Bearer ${tokenResponse.id_token}`,
                        'x-app-key': this.appKey
                    }
                }
            );
            
            return response.data;
        } catch (error) {
            throw new Error(`支付执行失败: ${error.response?.data?.statusMessage || error.message}`);
        }
    }
}

// 使用示例
const config = {
    appKey: 'your_app_key',
    appSecret: 'your_app_secret',
    username: 'your_username',
    password: 'your_password',
    sandbox: true
};

const bkash = new BkashPayment(config);

// Express.js路由示例
app.post('/create-payment', async (req, res) => {
    try {
        const { amount, invoiceNumber, customerId } = req.body;
        
        const payment = await bkash.createPayment(amount, invoiceNumber, customerId);
        
        if (payment.statusCode === '0000') {
            res.json({
                success: true,
                paymentUrl: payment.bkashURL,
                paymentId: payment.paymentID
            });
        } else {
            res.status(400).json({
                success: false,
                message: payment.statusMessage
            });
        }
    } catch (error) {
        res.status(500).json({
            success: false,
            message: error.message
        });
    }
});

// Token有效期管理
class TokenManager {
    constructor() {
        this.token = null;
        this.tokenExpiry = null;
        this.refreshToken = null;
    }
    
    isTokenValid() {
        return this.token && 
               this.tokenExpiry && 
               new Date() < new Date(this.tokenExpiry);
    }
    
    async getValidToken() {
        if (!this.isTokenValid()) {
            await this.refreshAccessToken();
        }
        return this.token;
    }
    
    async refreshAccessToken() {
        // 刷新token的逻辑
        if (this.refreshToken) {
            // 使用refresh token获取新的access token
        } else {
            // 重新获取token
            const tokenResponse = await this.getToken();
            this.token = tokenResponse.id_token;
            this.tokenExpiry = new Date(Date.now() + tokenResponse.expires_in * 1000);
            this.refreshToken = tokenResponse.refresh_token;
        }
    }
}

// HTTPS配置示例（Node.js）
const https = require('https');
const fs = require('fs');

const options = {
    key: fs.readFileSync('private-key.pem'),
    cert: fs.readFileSync('certificate.pem'),
    // 强制使用TLS 1.2或更高版本
    secureProtocol: 'TLSv1_2_method',
    // 禁用不安全的密码套件
    ciphers: [
        'ECDHE-RSA-AES128-GCM-SHA256',
        'ECDHE-RSA-AES256-GCM-SHA384',
        'ECDHE-RSA-AES128-SHA256',
        'ECDHE-RSA-AES256-SHA384'
    ].join(':'),
    honorCipherOrder: true
};

https.createServer(options, app).listen(443, () => {
    console.log('HTTPS服务器运行在443端口');
});

<?php
// 回调验证示例
function verifyBkashCallback($postData, $secretKey) {
    // 1. 验证IP白名单
    $allowedIPs = ['103.106.118.10', '103.106.118.11']; // bKash服务器IP
    $clientIP = $_SERVER['REMOTE_ADDR'];
    
    if (!in_array($clientIP, $allowedIPs)) {
        return false;
    }
    
    // 2. 验证时间戳（防重放攻击）
    $timestamp = $postData['timestamp'] ?? 0;
    $currentTime = time();
    
    if (abs($currentTime - $timestamp) > 300) { // 5分钟有效期
        return false;
    }
    
    // 3. 验证签名
    $expectedSignature = hash_hmac('sha256', json_encode($postData), $secretKey);
    $receivedSignature = $_SERVER['HTTP_X_BKASH_SIGNATURE'] ?? '';
    
    return hash_equals($expectedSignature, $receivedSignature);
}

// 处理回调
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $postData = json_decode(file_get_contents('php://input'), true);
    
    if (verifyBkashCallback($postData, 'your_secret_key')) {
        // 回调验证成功，处理业务逻辑
        $paymentId = $postData['paymentID'];
        $trxId = $postData['trxID'];
        $status = $postData['transactionStatus'];
        
        // 更新订单状态
        updateOrderStatus($paymentId, $status, $trxId);
        
        // 返回成功响应
        http_response_code(200);
        echo json_encode(['status' => 'success']);
    } else {
        // 回调验证失败
        http_response_code(400);
        echo json_encode(['status' => 'invalid']);
    }
}
?>

// 防重放攻击实现
class ReplayProtection {
    constructor() {
        this.usedNonces = new Set();
        this.cleanupInterval = setInterval(() => {
            this.cleanup();
        }, 300000); // 每5分钟清理一次
    }
    
    isValidRequest(nonce, timestamp) {
        // 检查时间戳
        const currentTime = Math.floor(Date.now() / 1000);
        if (Math.abs(currentTime - timestamp) > 300) {
            return false; // 超过5分钟的请求拒绝
        }
        
        // 检查nonce是否已使用
        const nonceKey = `${nonce}_${timestamp}`;
        if (this.usedNonces.has(nonceKey)) {
            return false; // 重复请求
        }
        
        // 记录nonce
        this.usedNonces.add(nonceKey);
        return true;
    }
    
    cleanup() {
        // 清理过期的nonce记录
        const currentTime = Math.floor(Date.now() / 1000);
        const expiredTime = currentTime - 300;
        
        for (const nonceKey of this.usedNonces) {
            const timestamp = parseInt(nonceKey.split('_')[1]);
            if (timestamp < expiredTime) {
                this.usedNonces.delete(nonceKey);
            }
        }
    }
}

// 自动重试机制
async function makeRequestWithRetry(apiCall, maxRetries = 3) {
    for (let i = 0; i < maxRetries; i++) {
        try {
            return await apiCall();
        } catch (error) {
            if (error.response?.status === 401 && i < maxRetries - 1) {
                // Token过期，刷新后重试
                await tokenManager.refreshAccessToken();
                continue;
            }
            throw error;
        }
    }
}

// 超时和重试配置
const axiosConfig = {
    timeout: 30000, // 30秒超时
    retry: 3,
    retryDelay: 1000,
    retryCondition: (error) => {
        return error.code === 'ECONNABORTED' || 
               (error.response && error.response.status >= 500);
    }
};

// 指数退避重试
async function exponentialBackoffRetry(fn, maxRetries = 3) {
    for (let i = 0; i < maxRetries; i++) {
        try {
            return await fn();
        } catch (error) {
            if (i === maxRetries - 1) throw error;
            
            const delay = Math.pow(2, i) * 1000; // 1s, 2s, 4s
            await new Promise(resolve => setTimeout(resolve, delay));
        }
    }
}

<?php
// 定时对账任务
function reconcilePayments() {
    $pendingPayments = getPendingPayments(); // 获取待确认支付
    
    foreach ($pendingPayments as $payment) {
        $paymentId = $payment['payment_id'];
        
        // 查询bKash支付状态
        $bkashStatus = queryBkashPaymentStatus($paymentId);
        
        if ($bkashStatus['statusCode'] === '0000') {
            $transactionStatus = $bkashStatus['transactionStatus'];
            
            // 更新本地状态
            updateLocalPaymentStatus($paymentId, $transactionStatus);
            
            // 记录对账日志
            logReconciliation($paymentId, $transactionStatus);
        }
        
        // 避免API频率限制
        sleep(1);
    }
}

// 每30分钟执行一次对账
// 在crontab中添加: */30 * * * * php /path/to/reconcile.php
?>

// 金额处理工具类
class AmountUtils {
    static formatAmount(amount) {
        // 确保金额为两位小数
        return parseFloat(amount).toFixed(2);
    }
    
    static validateAmount(amount) {
        const numAmount = parseFloat(amount);
        
        // 检查是否为有效数字
        if (isNaN(numAmount) || numAmount <= 0) {
            throw new Error('无效金额');
        }
        
        // 检查最小金额限制（bKash最小支付1塔卡）
        if (numAmount < 1) {
            throw new Error('金额不能少于1塔卡');
        }
        
        // 检查最大金额限制
        if (numAmount > 25000) {
            throw new Error('单笔支付不能超过25000塔卡');
        }
        
        return this.formatAmount(numAmount);
    }
    
    static convertToPaisa(amount) {
        // 将塔卡转换为派沙（1塔卡=100派沙）
        return Math.round(parseFloat(amount) * 100);
    }
}

// 统一错误处理
class BkashErrorHandler {
    static handleError(error, context = '') {
        const errorInfo = {
            timestamp: new Date().toISOString(),
            context: context,
            error: {
                message: error.message,
                code: error.code || 'UNKNOWN',
                statusCode: error.response?.status,
                responseData: error.response?.data
            }
        };
        
        // 记录错误日志
        console.error('bKash API Error:', JSON.stringify(errorInfo, null, 2));
        
        // 根据错误类型返回用户友好的错误信息
        switch (error.response?.status) {
            case 400:
                return '请求参数错误，请检查支付信息';
            case 401:
                return '认证失败，请稍后重试';
            case 403:
                return '权限不足，请联系客服';
            case 429:
                return '请求过于频繁，请稍后重试';
            case 500:
                return 'bKash服务暂时不可用，请稍后重试';
            default:
                return '支付处理失败，请稍后重试或联系客服';
        }
    }
    
    static isRetryableError(error) {
        const retryableStatuses = [408, 429, 500, 502, 503, 504];
        return retryableStatuses.includes(error.response?.status) ||
               error.code === 'ECONNABORTED' ||
               error.code === 'ENOTFOUND';
    }
}

// 支付日志记录
class PaymentLogger {
    static logPaymentStart(invoiceNumber, amount, customerId) {
        const logData = {
            level: 'INFO',
            action: 'PAYMENT_START',
            timestamp: new Date().toISOString(),
            data: {
                invoiceNumber,
                amount,
                customerId,
                sessionId: this.generateSessionId()
            }
        };
        
        this.writeLog(logData);
        return logData.data.sessionId;
    }
    
    static logPaymentCreated(sessionId, paymentId, bkashUrl) {
        const logData = {
            level: 'INFO',
            action: 'PAYMENT_CREATED',
            timestamp: new Date().toISOString(),
            sessionId,
            data: {
                paymentId,
                bkashUrl
            }
        };
        
        this.writeLog(logData);
    }
    
    static logPaymentCompleted(sessionId, paymentId, trxId, amount) {
        const logData = {
            level: 'INFO',
            action: 'PAYMENT_COMPLETED',
            timestamp: new Date().toISOString(),
            sessionId,
            data: {
                paymentId,
                trxId,
                amount,
                completedAt: new Date().toISOString()
            }
        };
        
        this.writeLog(logData);
    }
    
    static logPaymentError(sessionId, error, context) {
        const logData = {
            level: 'ERROR',
            action: 'PAYMENT_ERROR',
            timestamp: new Date().toISOString(),
            sessionId,
            data: {
                error: error.message,
                context,
                stack: error.stack
            }
        };
        
        this.writeLog(logData);
    }
    
    static writeLog(logData) {
        // 写入日志文件或发送到日志服务
        console.log(JSON.stringify(logData));
        
        // 生产环境中建议使用专业的日志服务
        // 如 Winston, Bunyan 或云端日志服务
    }
    
    static generateSessionId() {
        return 'PAY_' + Date.now() + '_' + Math.random().toString(36).substr(2, 9);
    }
}

// 连接池管理
const https = require('https');

const agent = new https.Agent({
    keepAlive: true,
    keepAliveMsecs: 30000,
    maxSockets: 50,
    maxFreeSockets: 10,
    timeout: 30000
});

// API请求优化
class OptimizedBkashClient {
    constructor(config) {
        this.config = config;
        this.tokenCache = null;
        this.tokenExpiry = null;
        
        // 创建优化的axios实例
        this.httpClient = axios.create({
            httpsAgent: agent,
            timeout: 30000,
            headers: {
                'Connection': 'keep-alive',
                'Accept-Encoding': 'gzip, deflate'
            }
        });
        
        // 添加请求拦截器
        this.httpClient.interceptors.request.use(this.requestInterceptor.bind(this));
        this.httpClient.interceptors.response.use(
            this.responseInterceptor.bind(this),
            this.errorInterceptor.bind(this)
        );
    }
    
    requestInterceptor(config) {
        // 添加请求追踪ID
        config.headers['X-Request-ID'] = this.generateRequestId();
        
        // 记录请求开始时间
        config.metadata = { startTime: Date.now() };
        
        return config;
    }
    
    responseInterceptor(response) {
        // 计算响应时间
        const duration = Date.now() - response.config.metadata.startTime;
        console.log(`API请求耗时: ${duration}ms`);
        
        return response;
    }
    
    errorInterceptor(error) {
        if (error.config) {
            const duration = Date.now() - error.config.metadata.startTime;
            console.error(`API请求失败，耗时: ${duration}ms`);
        }
        
        return Promise.reject(error);
    }
    
    generateRequestId() {
        return 'req_' + Date.now() + '_' + Math.random().toString(36).substr(2, 8);
    }
}

// Redis缓存实现
const redis = require('redis');
const client = redis.createClient({
    host: 'localhost',
    port: 6379,
    db: 0
});

class BkashCache {
    static async cacheToken(token, expiresIn) {
        const key = 'bkash:token';
        const ttl = expiresIn - 60; // 提前1分钟过期，确保安全
        
        await client.setex(key, ttl, JSON.stringify(token));
    }
    
    static async getToken() {
        const key = 'bkash:token';
        const cached = await client.get(key);
        
        return cached ? JSON.parse(cached) : null;
    }
    
    static async cachePaymentStatus(paymentId, status, ttl = 300) {
        const key = `bkash:payment:${paymentId}`;
        await client.setex(key, ttl, JSON.stringify(status));
    }
    
    static async getPaymentStatus(paymentId) {
        const key = `bkash:payment:${paymentId}`;
        const cached = await client.get(key);
        
        return cached ? JSON.parse(cached) : null;
    }
    
    static async invalidatePaymentCache(paymentId) {
        const key = `bkash:payment:${paymentId}`;
        await client.del(key);
    }
}

// 监控指标收集
class PaymentMetrics {
    constructor() {
        this.metrics = {
            totalPayments: 0,
            successfulPayments: 0,
            failedPayments: 0,
            averageResponseTime: 0,
            errorRates: {},
            lastReset: Date.now()
        };
    }
    
    recordPaymentAttempt() {
        this.metrics.totalPayments++;
    }
    
    recordPaymentSuccess(responseTime) {
        this.metrics.successfulPayments++;
        this.updateAverageResponseTime(responseTime);
    }
    
    recordPaymentFailure(errorCode) {
        this.metrics.failedPayments++;
        this.metrics.errorRates[errorCode] = (this.metrics.errorRates[errorCode] || 0) + 1;
        
        // 检查是否需要发送告警
        this.checkAlerts();
    }
    
    updateAverageResponseTime(responseTime) {
        const total = this.metrics.successfulPayments;
        const current = this.metrics.averageResponseTime;
        
        this.metrics.averageResponseTime = ((current * (total - 1)) + responseTime) / total;
    }
    
    checkAlerts() {
        const failureRate = this.getFailureRate();
        
        // 失败率超过10%时发送告警
        if (failureRate > 0.1) {
            this.sendAlert({
                type: 'HIGH_FAILURE_RATE',
                rate: failureRate,
                message: `bKash支付失败率过高: ${(failureRate * 100).toFixed(2)}%`
            });
        }
        
        // 响应时间超过5秒时发送告警
        if (this.metrics.averageResponseTime > 5000) {
            this.sendAlert({
                type: 'SLOW_RESPONSE',
                responseTime: this.metrics.averageResponseTime,
                message: `bKash API响应时间过慢: ${this.metrics.averageResponseTime}ms`
            });
        }
    }
    
    getFailureRate() {
        const total = this.metrics.totalPayments;
        return total > 0 ? this.metrics.failedPayments / total : 0;
    }
    
    getSuccessRate() {
        const total = this.metrics.totalPayments;
        return total > 0 ? this.metrics.successfulPayments / total : 0;
    }
    
    sendAlert(alert) {
        // 发送告警到监控系统或通知渠道
        console.error('🚨 bKash支付告警:', alert);
        
        // 可以集成钉钉、微信、邮件等通知方式
        // this.sendDingTalkAlert(alert);
        // this.sendEmailAlert(alert);
    }
    
    getMetrics() {
        return {
            ...this.metrics,
            successRate: this.getSuccessRate(),
            failureRate: this.getFailureRate(),
            uptime: Date.now() - this.metrics.lastReset
        };
    }
    
    reset() {
        this.metrics = {
            totalPayments: 0,
            successfulPayments: 0,
            failedPayments: 0,
            averageResponseTime: 0,
            errorRates: {},
            lastReset: Date.now()
        };
    }
}

// 全局监控实例
const paymentMetrics = new PaymentMetrics();

// 定期重置统计（每小时）
setInterval(() => {
    console.log('当前支付指标:', paymentMetrics.getMetrics());
    paymentMetrics.reset();
}, 3600000);

-- 支付记录表
CREATE TABLE bkash_payments (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    invoice_number VARCHAR(50) NOT NULL UNIQUE,
    payment_id VARCHAR(50) UNIQUE,
    trx_id VARCHAR(20),
    customer_id VARCHAR(50),
    amount DECIMAL(10,2) NOT NULL,
    currency VARCHAR(3) DEFAULT 'BDT',
    status ENUM('PENDING', 'CREATED', 'COMPLETED', 'FAILED', 'CANCELLED') DEFAULT 'PENDING',
    bkash_url TEXT,
    callback_data JSON,
    error_message TEXT,
    session_id VARCHAR(50),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    completed_at TIMESTAMP NULL,
    
    INDEX idx_invoice_number (invoice_number),
    INDEX idx_payment_id (payment_id),
    INDEX idx_trx_id (trx_id),
    INDEX idx_customer_id (customer_id),
    INDEX idx_status (status),
    INDEX idx_created_at (created_at)
);

-- 支付日志表
CREATE TABLE bkash_payment_logs (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    payment_id VARCHAR(50),
    session_id VARCHAR(50),
    action VARCHAR(50) NOT NULL,
    level ENUM('INFO', 'WARN', 'ERROR') DEFAULT 'INFO',
    message TEXT,
    request_data JSON,
    response_data JSON,
    error_data JSON,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    
    INDEX idx_payment_id (payment_id),
    INDEX idx_session_id (session_id),
    INDEX idx_action (action),
    INDEX idx_level (level),
    INDEX idx_created_at (created_at)
);

-- 对账记录表
CREATE TABLE bkash_reconciliation (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    payment_id VARCHAR(50),
    local_status VARCHAR(20),
    bkash_status VARCHAR(20),
    is_matched BOOLEAN DEFAULT FALSE,
    discrepancy_reason TEXT,
    reconciled_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    
    INDEX idx_payment_id (payment_id),
    INDEX idx_is_matched (is_matched),
    INDEX idx_reconciled_at (reconciled_at)
);

# Dockerfile
FROM node:16-alpine

WORKDIR /app

# 复制package文件
COPY package*.json ./

# 安装依赖
RUN npm ci --only=production

# 复制源码
COPY . .

# 创建非root用户
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001

# 设置权限
RUN chown -R nextjs:nodejs /app
USER nextjs

# 暴露端口
EXPOSE 3000

# 健康检查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

# 启动应用
CMD ["npm", "start"]

version: '3.8'

services:
  bkash-payment-api:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - BKASH_APP_KEY=${BKASH_APP_KEY}
      - BKASH_APP_SECRET=${BKASH_APP_SECRET}
      - BKASH_USERNAME=${BKASH_USERNAME}
      - BKASH_PASSWORD=${BKASH_PASSWORD}
      - REDIS_URL=redis://redis:6379
      - DB_HOST=mysql
      - DB_USER=${DB_USER}
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_NAME=${DB_NAME}
    depends_on:
      - redis
      - mysql
    restart: unless-stopped
    
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    restart: unless-stopped
    
  mysql:
    image: mysql:8.0
    ports:
      - "3306:3306"
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=${DB_NAME}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - mysql_data:/var/lib/mysql
    restart: unless-stopped

volumes:
  redis_data:
  mysql_data:

# /etc/nginx/sites-available/bkash-payment
server {
    listen 80;
    server_name your-domain.com;
    
    # 重定向到HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name your-domain.com;
    
    # SSL配置
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # 安全头
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    
    # API路由
    location /api/ {
        proxy_pass http://localhost:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        
        # 超时设置
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
    
    # 健康检查
    location /health {
        proxy_pass http://localhost:3000/health;
        access_log off;
    }
    
    # 限流配置
    location /api/payment/ {
        limit_req zone=payment burst=10 nodelay;
        proxy_pass http://localhost:3000/api/payment/;
    }
}

# 限流配置
http {
    limit_req_zone $binary_remote_addr zone=payment:10m rate=30r/m;
}