8.19-bob: To'lov tizimlari (Payment) — Click, Payme, Stripe (to'liq)

  TO'LOV ZANJIRI (kim ishtirok etadi):

  Mijoz (xaridor)  karta (UzCard/Humo/Visa)
       
  Sizning ilovangiz (MERCHANT — savdogar)
       
  To'lov tizimi / Gateway (Payme, Click, Stripe — PSP)
       
  Bank (acquirer — pulni qabul qiluvchi bank)
       
  Karta tarmog'i (UzCard/Humo, Visa/Mastercard)
       
  Mijozning banki (issuer — pulni yechuvchi)

  Siz faqat MERCHANT'siz — gateway qolganini hal qiladi (siz bank emassiz)

  ┌──────────┬────────────────────────────────────────────────┐
  │ Payme    │ Eng keng. JSON-RPC protokol. Gateway SIZNI      │
  │ (Paycom) │ chaqiradi (Merchant API). UzCard/Humo/Visa.     │
  ├──────────┼────────────────────────────────────────────────┤
  │ Click    │ Keng. Prepare/Complete (2 bosqich). Gateway     │
  │          │ sizning endpoint'ni chaqiradi. SHOP API.        │
  ├──────────┼────────────────────────────────────────────────┤
  │ Uzum     │ O'sib borayotgan. Webhook asosli.               │
  │ (Apelsin)│                                                  │
  ├──────────┼────────────────────────────────────────────────┤
  │ Octo     │ Karta to'lovi (acquiring). Token asosli.        │
  │ Stripe   │ XALQARO (Visa/MC global) — O'zbekistonda cheklov │
  └──────────┴────────────────────────────────────────────────┘
   Mahalliy loyiha: Payme + Click (+ Uzum); xalqaro: Stripe

  MODEL A — Gateway SIZNI chaqiradi (Merchant API — Payme, Click):
  - Mijoz gateway sahifasida to'laydi
  - Gateway SIZNING endpoint'laringizni chaqiradi (CheckPerform, Perform...)
  - Siz javob berasiz (mumkinmi, bajarildimi)
  - Sizda PUBLIC endpoint kerak (gateway chaqiradi)

  MODEL B — Siz gateway'ni chaqirasiz + webhook (Stripe, Uzum):
  - Siz PaymentIntent/invoice yaratasiz (API chaqirish)
  - Mijoz to'laydi
  - Gateway sizga WEBHOOK yuboradi (to'landi)

   Payme/Click — Model A (sizning endpoint'ni chaqiradi)
   Stripe — Model B (siz chaqirasiz + webhook)

  HAR QANDAY TO'LOV (universal naqsh):

  1. Mijoz buyurtma beradi  ORDER yaratiladi (holat: pending)
  2. To'lov havolasi/hisob yaratiladi (transaction: pending)
  3. Mijoz to'lov sahifasida to'laydi (gateway)
  4. Gateway TASDIQ yuboradi (callback/webhook)
  5. Siz TEKSHIRASIZ: imzo to'g'rimi? summa to'g'rimi? takror emasmi?
  6. To'g'ri bo'lsa  transaction: paid  ORDER bajariladi (mahsulot beriladi)
  7. Mijozga chek/email (8.10)

   Eng muhim: 5-qadam (TEKSHIRISH) — bu xavfsizlik

  TRANSACTIONS jadvali (har to'lov yozuvi):
  ┌────────────────┬──────────────────────────────────────┐
  │ id             │ ichki ID                              │
  │ orderId        │ qaysi buyurtma (FK)                   │
  │ provider       │ "payme" | "click" | "stripe"         │
  │ providerTxId   │ gateway'dagi tranzaksiya ID (noyob)   │
  │ amount         │ summa (TIYINDA — ×100, butun son!)    │
  │ currency       │ "UZS"                                 │
  │ state          │ holat (2.6 — state machine)          │
  │ createdAt      │ yaratilgan vaqt                       │
  │ paidAt         │ to'langan vaqt                        │
  │ cancelledAt    │ bekor qilingan vaqt                   │
  │ reason         │ bekor sababi                          │
  └────────────────┴──────────────────────────────────────┘
   amount — TIYINDA (butun son): 50000 so'm = 5000000 tiyin
   providerTxId — UNIQUE (idempotency — 2.8)

  TRANSACTION HOLATLARI (state machine):

  pending (yaratildi, kutilmoqda)
     ├── paid (muvaffaqiyatli to'landi) ── refunded (qaytarildi)
     ├── cancelled (bekor qilindi)
     └── failed (xato/muddat tugadi)

   HOLAT O'TISHLARI nazorat qilinadi:
  - paid  pending QAYTA bo'lmaydi (faqat oldinga)
  - cancelled tranzaksiyani perform qilib bo'lmaydi
  - faqat paid'ni refund qilish mumkin

  Payme holatlari: 1 (yaratildi), 2 (to'landi), -1 (bekor, to'lovsiz), -2 (bekor, to'lovdan keyin)

  HAR GATEWAY o'z kalitlari (merchant kabinetdan olinadi):

  PAYME:   PAYME_MERCHANT_ID (kassa ID), PAYME_KEY (maxfiy kalit — webhook auth)
  CLICK:   CLICK_SERVICE_ID, CLICK_MERCHANT_ID, CLICK_SECRET_KEY
  STRIPE:  STRIPE_SECRET_KEY (sk_...), STRIPE_WEBHOOK_SECRET (whsec_...)

   XAVFSIZLIK (14):
  - Kalitlar .env'da (kodda EMAS — 8.14, 14)
  - .gitignore (git'ga tushmasin — eng muhim)
  - Test (sandbox) va Production kalitlari ALOHIDA
  - Kalit oshkor bo'lsa — DARROV almashtirish (kabinetdan)

  MUAMMO: bir to'lov IKKI marta bajarilishi mumkin:
  - Tarmoq xatosi  gateway webhook'ni QAYTA yuboradi (retry)
  - Mijoz tugmani 2 marta bosadi
   buyurtma 2 marta bajariladi / pul 2 marta hisoblanadi (XATO!)

  YECHIM — IDEMPOTENCY (takror = bir marta):
  - providerTxId UNIQUE (DB)  ikkinchi marta kelsa, eski natijani qaytar
  - Webhook: event ID saqlash (qayta ishlov bermaslik)
  - Stripe: Idempotency-Key header (POST so'rovlarda)

  if (await txRepo.findByProviderTxId(id)) return mavjudNatija;  // takror  eski

  WEBHOOK — gateway sizning endpoint'ga to'lov haqida xabar yuboradi

   MUAMMO: har kim sizning webhook URL'ga soxta so'rov yuborishi mumkin
   "to'landi" deb yolg'on  buyurtmani tekin olib ketadi!

  YECHIM — IMZO (signature) tekshirish:
  - Payme: Basic Auth (Paycom:KEY — Authorization header)
  - Click: MD5 imzo (sign_string — kalit bilan hash)
  - Stripe: constructEvent (whsec bilan imzo tekshirish)

   Imzo NOTO'G'RI  rad et (401). FAQAT haqiqiy gateway o'tadi.
   Stripe: RAW body kerak (imzo uchun — JSON parse'dan oldin)

  PAYME — JSON-RPC (gateway sizning bitta endpoint'ni chaqiradi: POST /payme)
  Authorization: Basic base64("Paycom:PAYME_KEY")   auth 2.11-bob

  5 ASOSIY METOD (gateway chaqiradi, siz javob berasiz):
  1. CheckPerformTransaction — to'lov mumkinmi? (buyurtma bor, summa to'g'ri?)
  2. CreateTransaction       — tranzaksiya yarat (state: pending)
  3. PerformTransaction      — to'lovni tasdiqla (state: paid  buyurtma bajariladi)
  4. CancelTransaction       — bekor qil (state: cancelled, refund)
  5. CheckTransaction        — tranzaksiya holatini so'ra
  (+ GetStatement — davr hisoboti — reconciliation 2.15)

// Payme — Basic Auth (har so'rovda tekshiriladi)
// Authorization: Basic base64("Paycom:PAYME_KEY")
function paymeAuthTekshir(authHeader: string, key: string): boolean {
  const [, b64] = (authHeader || "").split(" ");
  const [login, parol] = Buffer.from(b64 || "", "base64").toString().split(":");
  return login === "Paycom" && parol === key;        // kalit mos kelishi kerak
}

// Payme xato kodlari (spetsifikatsiya bo'yicha — JSON-RPC error)
// -32504 — auth xato; -31050..-31099 — buyurtma topilmadi/summa xato
// -31008 — amalni bajarib bo'lmaydi; -31003 — tranzaksiya topilmadi

  CLICK — 2 bosqichli (gateway sizning 2 endpoint'ni chaqiradi):

  1. PREPARE (/click/prepare):
     - Click "to'lovga tayyormisiz?" deb so'raydi
     - Siz: buyurtma bor? summa to'g'ri?  tranzaksiya yarat (pending)
     - merchant_prepare_id qaytarasiz

  2. COMPLETE (/click/complete):
     - Click "to'lov bajarildi, tasdiqlang" deydi
     - Siz: imzo tekshir  tranzaksiya paid  buyurtma bajariladi

  IMZO (sign_string) — MD5:
  md5(click_trans_id + service_id + SECRET_KEY + merchant_trans_id + amount + action + sign_time)

// Stripe — Model B (siz chaqirasiz + webhook)
import Stripe from "stripe";
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

// 1. PaymentIntent yaratish (frontend uchun client_secret)
const intent = await stripe.paymentIntents.create(
  { amount: 5000, currency: "usd", metadata: { orderId: "123" } },
  { idempotencyKey: `order_123` },                   // idempotency (2.8)
);
// 2. Frontend client_secret bilan to'laydi (Stripe.js)
// 3. Stripe WEBHOOK yuboradi (payment_intent.succeeded)  2.9 verify

// MUQOBIL: Stripe Checkout (hosted — Stripe'ning tayyor to'lov sahifasiga
// yo'naltirish; frontend forma yozish shart emas — Payme/Click redirect'iga o'xshash):
const session = await stripe.checkout.sessions.create(
  {
    mode: "payment",
    line_items: [{                                     // nima sotilyapti
      price_data: {
        currency: "usd",
        product_data: { name: "Buyurtma #123" },
        unit_amount: 5000,                             // TIYINDA (cent — butun son, 2.5)
      },
      quantity: 1,
    }],
    metadata: { orderId: "123" },                      // webhook'da kerak
    success_url: "https://shop.uz/ok?session_id={CHECKOUT_SESSION_ID}",
    cancel_url: "https://shop.uz/bekor",               // to'lamay chiqsa
  },
  { idempotencyKey: `checkout_123` },                  // idempotency (2.8)
);
//  session.url ga mijozni yo'naltirasiz (redirect); to'lagach Stripe
//   webhook yuboradi: "checkout.session.completed" (2.9 verify)

  REFUND — to'langan pulni qaytarish (qisman yoki to'liq):

  - Faqat PAID tranzaksiyani refund qilish mumkin (2.6 state machine)
  - To'liq yoki qisman (partial)
  - Payme: CancelTransaction (state -2 — to'lovdan keyin bekor)
  - Click: refund API / merchant kabinet
  - Stripe: stripe.refunds.create({ payment_intent })

   Refund'ni BEKOR qilib bo'lmaydi (qaytarib olinmaydi)
   Idempotency (ikki marta refund = ikki marta pul qaytarish!)

  RECONCILIATION — sizning DB va gateway hisobotini solishtirish:

  Nega: tarmoq xatosi, webhook yetmasligi  DB va gateway mos kelmasligi mumkin
  - Sizda "pending" lekin gateway'da "paid" (webhook yetmadi)
  - Davriy (cron — 8.18) gateway hisobotini olib, solishtirish
  - Payme: GetStatement (davr tranzaksiyalari)
  - Stripe: balance transactions / events

   Nomutanosiblikni aniqlab tuzatish (moliyaviy aniqlik)

  TO'LOV INTEGRATSIYASI JARAYONI:
  1. Merchant kabinetda ro'yxat (Payme/Click biznes)
  2. TEST (sandbox) kalitlari olish  test rejimda ishlab chiqish
  3. Test kartalari bilan sinash (gateway beradi)
  4. Gateway integratsiyani TEKSHIRADI (Payme test scenariy yuboradi)
  5. Tasdiqlangach  PRODUCTION kalitlari  jonli

   HECH QACHON production'da haqiqiy pul bilan "sinab ko'rmang"
   Webhook'ni lokal test: ngrok (lokal URL'ni public qilish)

   Imzo (signature) HAR webhook'da tekshir (soxta himoyasi — 2.9)
   Summa SERVER'da tekshir (mijoz yuborgan summaga ishonma — 2.4)
   Idempotency (takror himoyasi — 2.8)
   Kalitlar .env (git'ga emas — 2.7, 14)
   HTTPS majburiy (webhook — shifrlangan)
   Karta ma'lumotini SAQLAMA (PCI DSS — gateway hal qiladi — 2.1)
   Audit log (har to'lov harakati — kim, qachon, qancha)
   State machine (noto'g'ri o'tish bloklanadi — 2.6)
   Buyurtma summasi = to'lov summasi (server tekshiruvi)

// Transaction holatlari (2.6)
type TxState = "pending" | "paid" | "cancelled" | "failed" | "refunded";

// Payme 2.10-bob: POST /payme — { method, params }  JSON-RPC javob
//   CheckPerformTransaction, CreateTransaction, PerformTransaction, CancelTransaction, CheckTransaction

// Click 2.12-bob: POST /click/prepare + /click/complete (sign_string MD5 tekshir)

// Stripe (2.13)
stripe.paymentIntents.create({ amount, currency }, { idempotencyKey }); // custom forma
stripe.checkout.sessions.create({ line_items, success_url, cancel_url }); // hosted redirect
stripe.webhooks.constructEvent(rawBody, sig, whsec);   // imzo tekshir (2.9)
stripe.refunds.create({ payment_intent });             // refund (2.14)

// Idempotency 2.8-bob: if (await findByProviderTxId(id)) return mavjud;

// transaction.entity.ts (TypeORM — 8.3)
export enum TxState {
  PENDING = "pending",
  PAID = "paid",
  CANCELLED = "cancelled",
  FAILED = "failed",
  REFUNDED = "refunded",
}

@Entity("transactions")
export class Transaction {
  @PrimaryGeneratedColumn("uuid") id: string;

  @Column() orderId: string;
  @ManyToOne(() => Order) order: Order;               // (8.4)

  @Column() provider: "payme" | "click" | "stripe";

  @Column({ unique: true, nullable: true })          // UNIQUE — idempotency (2.8)
  providerTxId: string;

  @Column("bigint") amount: number;                   // TIYINDA (butun — 2.5)
  @Column({ default: "UZS" }) currency: string;

  @Column({ type: "enum", enum: TxState, default: TxState.PENDING })
  state: TxState;                                      // state machine (2.6)

  @Column({ nullable: true }) paidAt: Date;
  @Column({ nullable: true }) cancelledAt: Date;
  @Column({ nullable: true }) reason: number;         // bekor sababi
  @CreateDateColumn() createdAt: Date;
}

// payme.controller.ts — gateway BITTA endpoint'ni chaqiradi (Model A)
@Controller("payme")
export class PaymeController {
  constructor(private paymeService: PaymeService) {}

  @Post()
  @UseGuards(PaymeAuthGuard)                          // Basic Auth (2.11)
  @HttpCode(200)
  async handle(@Body() dto: PaymeRequestDto) {
    // method bo'yicha yo'naltirish (5 metod — 2.10)
    switch (dto.method) {
      case "CheckPerformTransaction": return this.paymeService.checkPerform(dto.params);
      case "CreateTransaction":       return this.paymeService.create(dto.params);
      case "PerformTransaction":      return this.paymeService.perform(dto.params);
      case "CancelTransaction":       return this.paymeService.cancel(dto.params);
      case "CheckTransaction":        return this.paymeService.check(dto.params);
      case "GetStatement":            return this.paymeService.statement(dto.params);
      default:
        return { error: { code: -32601, message: "Method topilmadi" } };
    }
  }
}

// payme-auth.guard.ts
@Injectable()
export class PaymeAuthGuard implements CanActivate {
  constructor(private config: ConfigService) {}

  canActivate(context: ExecutionContext): boolean {
    const req = context.switchToHttp().getRequest();
    const auth = req.headers["authorization"] || "";
    const [type, b64] = auth.split(" ");
    if (type !== "Basic") throw new PaymeError(-32504, "Auth yo'q");

    const [login, key] = Buffer.from(b64 || "", "base64").toString().split(":");
    if (login !== "Paycom" || key !== this.config.get("PAYME_KEY")) {   // kalit (2.7)
      throw new PaymeError(-32504, "Avtorizatsiya xatosi");
    }
    return true;
  }
}

@Injectable()
export class PaymeService {
  constructor(
    @InjectRepository(Transaction) private txRepo: Repository<Transaction>,
    @InjectRepository(Order) private orderRepo: Repository<Order>,
  ) {}

  // 1. To'lov mumkinmi? (buyurtma bor, summa to'g'ri — 2.4)
  async checkPerform(params: any) {
    const order = await this.orderRepo.findOneBy({ id: params.account.order_id });
    if (!order) throw new PaymeError(-31050, "Buyurtma topilmadi");
    if (order.amount * 100 !== params.amount) {        // SUMMA tekshir (tiyinda — 2.5, 2.17)
      throw new PaymeError(-31001, "Summa noto'g'ri");
    }
    if (order.state !== "pending") throw new PaymeError(-31008, "Buyurtma to'langan");
    return { result: { allow: true } };
  }

  // 2. Tranzaksiya yaratish (idempotency — 2.8)
  async create(params: any) {
    const mavjud = await this.txRepo.findOneBy({ providerTxId: params.id });
    if (mavjud) {                                       // TAKROR  eski natija (2.8)
      return { result: { create_time: mavjud.createdAt.getTime(), transaction: mavjud.id, state: 1 } };
    }
    await this.checkPerform(params);                   // qayta tekshir
    const tx = await this.txRepo.save({
      providerTxId: params.id, provider: "payme",
      orderId: params.account.order_id, amount: params.amount, state: TxState.PENDING,
    });
    return { result: { create_time: tx.createdAt.getTime(), transaction: tx.id, state: 1 } };
  }
}

// 3. To'lovni tasdiqlash (paid  buyurtma bajariladi)
async perform(params: any) {
  const tx = await this.txRepo.findOneBy({ providerTxId: params.id });
  if (!tx) throw new PaymeError(-31003, "Tranzaksiya topilmadi");

  if (tx.state === TxState.PAID) {                     // ALLAQACHON to'langan (idempotency — 2.8)
    return { result: { transaction: tx.id, perform_time: tx.paidAt.getTime(), state: 2 } };
  }
  if (tx.state !== TxState.PENDING) throw new PaymeError(-31008, "Holat noto'g'ri");

  tx.state = TxState.PAID;                             // state machine (2.6)
  tx.paidAt = new Date();
  await this.txRepo.save(tx);

  // BUYURTMANI BAJARISH (eng muhim — pul keldi  mahsulot/xizmat)
  await this.orderRepo.update(tx.orderId, { state: "paid" });
  //  bu yerda: email/chek 8.10-bob, mahsulot berish, navbat (8.22)

  return { result: { transaction: tx.id, perform_time: tx.paidAt.getTime(), state: 2 } };
}

@Controller("click")
export class ClickController {
  constructor(private clickService: ClickService) {}

  @Post("prepare")
  @HttpCode(200)
  prepare(@Body() dto: ClickPrepareDto) {
    return this.clickService.prepare(dto);
  }
  @Post("complete")
  @HttpCode(200)
  complete(@Body() dto: ClickCompleteDto) {
    return this.clickService.complete(dto);
  }
}

@Injectable()
export class ClickService {
  // Imzo tekshirish (MD5 — 2.9, 2.12)
  private imzoTekshir(dto: any, secret: string): boolean {
    const signString = createHash("md5").update(
      `${dto.click_trans_id}${dto.service_id}${secret}${dto.merchant_trans_id}` +
      `${dto.amount}${dto.action}${dto.sign_time}`,
    ).digest("hex");
    return signString === dto.sign_string;            // mos kelishi kerak
  }

  async prepare(dto: ClickPrepareDto) {
    if (!this.imzoTekshir(dto, this.config.get("CLICK_SECRET"))) {
      return { error: -1, error_note: "Imzo xato" };  // soxta  rad (2.9)
    }
    const order = await this.orderRepo.findOneBy({ id: dto.merchant_trans_id });
    if (!order) return { error: -5, error_note: "Buyurtma topilmadi" };
    if (order.amount * 100 !== dto.amount) return { error: -2, error_note: "Summa xato" };

    const tx = await this.txRepo.save({
      providerTxId: dto.click_trans_id, provider: "click",
      orderId: order.id, amount: dto.amount, state: TxState.PENDING,
    });
    return { error: 0, error_note: "Success", merchant_prepare_id: tx.id };
  }

  async complete(dto: ClickCompleteDto) {
    if (!this.imzoTekshir(dto, this.config.get("CLICK_SECRET"))) {
      return { error: -1, error_note: "Imzo xato" };
    }
    const tx = await this.txRepo.findOneBy({ providerTxId: dto.click_trans_id });
    if (!tx) return { error: -6, error_note: "Tranzaksiya topilmadi" };
    if (tx.state === TxState.PAID) return { error: 0, error_note: "Already paid" };   // idempotency

    if (dto.error < 0) {                               // Click tomonda xato
      tx.state = TxState.CANCELLED; await this.txRepo.save(tx);
      return { error: dto.error, error_note: "Cancelled" };
    }
    tx.state = TxState.PAID; tx.paidAt = new Date();
    await this.txRepo.save(tx);
    await this.orderRepo.update(tx.orderId, { state: "paid" });   // buyurtma bajariladi
    return { error: 0, error_note: "Success", merchant_confirm_id: tx.id };
  }
}

@Controller("stripe")
export class StripeController {
  private stripe = new Stripe(this.config.get("STRIPE_SECRET_KEY"));
  constructor(private config: ConfigService, private orderRepo: OrderRepository) {}

  // 1. PaymentIntent yaratish (frontend uchun)
  @Post("intent")
  @UseGuards(JwtAuthGuard)                            // (8.9)
  async createIntent(@Body() dto: { orderId: string }) {
    const order = await this.orderRepo.findById(dto.orderId);
    const intent = await this.stripe.paymentIntents.create(
      { amount: order.amount, currency: "usd", metadata: { orderId: order.id } },
      { idempotencyKey: `order_${order.id}` },        // idempotency (2.8)
    );
    return { clientSecret: intent.client_secret };
  }

  // 2. Webhook (Stripe yuboradi — RAW body kerak! 2.9)
  @Post("webhook")
  @HttpCode(200)
  async webhook(@Req() req: RawBodyRequest<Request>, @Headers("stripe-signature") sig: string) {
    let event: Stripe.Event;
    try {
      event = this.stripe.webhooks.constructEvent(    // IMZO tekshir (2.9)
        req.rawBody, sig, this.config.get("STRIPE_WEBHOOK_SECRET"),
      );
    } catch {
      throw new BadRequestException("Imzo xato");      // soxta  rad
    }

    if (event.type === "payment_intent.succeeded") {
      const intent = event.data.object as Stripe.PaymentIntent;
      await this.tolovTasdiqla(intent.metadata.orderId, intent.id, event.id);
    }
    return { received: true };
  }

  private async tolovTasdiqla(orderId: string, txId: string, eventId: string) {
    // idempotency — event ID saqlash (qayta ishlov bermaslik — 2.8)
    // state machine  paid  buyurtma bajariladi (2.6)
  }
}
// main.ts: app = NestFactory.create(AppModule, { rawBody: true });   RAW body (2.9)

// Idempotency — webhook event'ni bir marta ishlash
@Entity("processed_events")
export class ProcessedEvent {
  @PrimaryColumn() eventId: string;                   // UNIQUE (provider event ID)
  @CreateDateColumn() processedAt: Date;
}

@Injectable()
export class IdempotencyService {
  constructor(@InjectRepository(ProcessedEvent) private repo: Repository<ProcessedEvent>) {}

  async birMartaIshla(eventId: string, ish: () => Promise<void>): Promise<void> {
    const mavjud = await this.repo.findOneBy({ eventId });
    if (mavjud) return;                                // ALLAQACHON ishlangan  o'tkazib yubor
    await ish();                                       // birinchi marta  bajar
    await this.repo.save({ eventId });                // belgilash
  }
}
// Webhook'da: await idempotency.birMartaIshla(event.id, () => this.tolovTasdiqla(...));

// Unified payment — gateway'lar ustida abstraksiya (Strategy — 9.2: 2.9, DIP — 9.1)
interface PaymentProvider {
  refund(txId: string, amount?: number): Promise<void>;
}
class StripeProvider implements PaymentProvider {
  async refund(txId: string, amount?: number) {
    await this.stripe.refunds.create({ payment_intent: txId, amount });   // (2.14)
  }
}
class PaymeProvider implements PaymentProvider {
  async refund(txId: string) { /* CancelTransaction — state -2 */ }
}

@Injectable()
export class PaymentService {
  constructor(private providers: Map<string, PaymentProvider>) {}

  async refund(txId: string, amount?: number) {
    const tx = await this.txRepo.findOneBy({ id: txId });
    if (tx.state !== TxState.PAID) throw new BadRequestException("Faqat to'langanni qaytarish mumkin");   // state machine (2.6)
    const provider = this.providers.get(tx.provider);  // qaysi gateway (Strategy)
    await provider.refund(tx.providerTxId, amount);
    tx.state = TxState.REFUNDED;                        // (2.6)
    await this.txRepo.save(tx);
  }
}

// 1. Buyurtma yaratish (to'lovdan oldin — pending)
@Post("orders")
@UseGuards(JwtAuthGuard)
async buyurtmaYarat(@Body() dto: CreateOrderDto, @CurrentUser() user) {
  const order = await this.ordersService.yarat({ ...dto, userId: user.id, state: "pending" });
  // To'lov havolasi (Payme/Click — checkout URL yoki invoice)
  const tolovUrl = this.paymentService.tolovHavolasi("payme", order);
  return { order, tolovUrl };                          // frontend  to'lov sahifasi
}

// 2. Mijoz to'laydi  gateway webhook (Misol 2-7)  state: paid
// 3. paid bo'lganda buyurtma bajariladi (perform ichida — Misol 5):
async buyurtmaBajar(orderId: string) {
  await this.ordersService.holatYangila(orderId, "paid");
  await this.inventoryService.zaxiraKamaytir(orderId);    // ombor (8.13 transaction)
  await this.emailQueue.add("chek", { orderId });         // chek email (8.10, navbat 8.22)
  await this.notificationsGateway.yubor(orderId);         // real-time (8.18)
}

// Payme JSON-RPC xato formati (exception filter bilan — 8.6)
export class PaymeError extends Error {
  constructor(public code: number, message: string, public data?: any) {
    super(message);
  }
}

@Catch(PaymeError)
export class PaymeExceptionFilter implements ExceptionFilter {
  catch(exception: PaymeError, host: ArgumentsHost) {
    const res = host.switchToHttp().getResponse();
    res.status(200).json({                             // Payme — har doim 200 + error obyekt
      error: { code: exception.code, message: { uz: exception.message, ru: exception.message, en: exception.message } },
    });
  }
}

// Davriy solishtirish (8.18 cron)
@Injectable()
export class ReconciliationService {
  @Cron(CronExpression.EVERY_HOUR)
  async solishtir() {
    // Pending lekin eski tranzaksiyalar (webhook yetmagan bo'lishi mumkin)
    const eskiPending = await this.txRepo.find({
      where: { state: TxState.PENDING, createdAt: LessThan(new Date(Date.now() - 3600000)) },
    });
    for (const tx of eskiPending) {
      // Gateway'dan haqiqiy holatni so'rash (Payme CheckTransaction / Stripe retrieve)
      const haqiqiy = await this.gatewaydanHolatSora(tx);
      if (haqiqiy === "paid" && tx.state !== TxState.PAID) {
        // DB va gateway mos emas  tuzatish (2.15)
        await this.tolovTasdiqla(tx.orderId, tx.providerTxId, `recon_${tx.id}`);
        this.logger.warn(`Reconciliation: ${tx.id}  paid (webhook yetmagan)`);
      }
    }
  }
}

 frontend "summa: 100"  shunga ishonish (firibgar 1 so'm to'laydi)
 SERVER'da buyurtma summasi bilan solishtir (2.4, 2.17)

 webhook keldi  darrov "to'landi" (soxta — tekin mahsulot — 2.9)
 imzo (signature) tekshir  faqat haqiqiy gateway

 webhook 2 marta  buyurtma 2 marta bajariladi (2.8)
 providerTxId unique / event ID  takror = bir marta

 amount: 50000.50 (float — 0.1+0.2≠0.3 xatosi — 2.5)
 tiyinda butun son (5000050)

 const KEY = "secret123" (git'ga  pul o'g'irlanadi — 2.7)
 .env + .gitignore