mena-payment-guardian

MENA Payment Guardian

Mission

Use this skill for Arab/MENA payment and BNPL integrations where redirects, webhook delivery, signature validation, capture timing, local currencies, and duplicate events can break production. Provider references are source-linked field notes; official provider docs and merchant agreements remain the authority for endpoint-level details.

Decision Path

Always follow this order:

1. Identify the provider, country, integration path, payment method, and environment.
2. Load the matching provider reference and shared pattern.
3. Confirm the server boundary and list secret env var names only.
4. Verify the authenticity signal: HMAC, signature, SecureHash, webhook secret, encrypted webhook payload, static auth header, or documented server-side inquiry.
5. Compare order reference, provider reference, amount, currency, country/account context, and status.
6. Store provider events and provider transaction references idempotently before fulfillment.
7. Fulfill only from verified server-side state.
8. Add tests or manual QA for duplicate events, invalid signatures, delayed callbacks, stale failures, capture/refund/void misuse, and frontend secret exposure.

Non-Negotiables

• Treat all money movement as high risk.
• Never fulfill from a browser redirect, hosted checkout result, SDK callback, BNPL approval page, or frontend-only status alone.
• Verify provider signatures, HMACs, SecureHash values, webhook secrets, encrypted payloads, or documented server-side inquiry exactly as documented.
• Keep merchant credentials, HMAC secrets, server keys, secret API keys, access codes, terminal secrets, SHA phrases, and service role keys server-side only.
• Compare provider amount, currency, country/account context, local order reference, and provider transaction/reference before creating paid state.
• Make callbacks, webhooks, retries, inquiry responses, capture calls, refunds, voids, and page refreshes idempotent.
• Store provider event/reference uniqueness before activating subscriptions, enrollments, bookings, credits, shipments, or invoices.
• Do not overwrite a stronger final paid/captured state with older pending, failed, cancelled, expired, rejected, or duplicate signals.
• Log safe identifiers only: local order id, provider reference, status, event id, timestamp. Never log tokens, card data, signatures, HMAC secrets, API keys, access codes, SHA phrases, or raw credentials.