D
Module

Wallet & Payment

The money path. Wallet balance, PIN, withdraw via DOKU, payment webhooks, and 4 payment gateway integrations.

The Wallet & Payment module is the money path — requires extra caution. Key points (see Indonesian version for details):

  • DOKU is the primary gateway (checkout + withdraw); Duitku for subscription; Aspire is sandbox experiment; Midtrans has no registered webhook
  • DOKU sub-account per store = multi-tenant balance separation
  • OrderObserver deposits to wallet only when payment_method === 'instant_payment'
  • Withdraw is request-only — WalletController::withdraw() creates PENDING transaction; actual processing (DOKU payout, bank transfer) happens in the separate admin-dazo application
  • WalletService::requestWithdrawal() has full logic (DOKU payout, rollback, PIN lock) but is not route-connected — unused
  • PIN lock bypass in WalletController::withdraw() — uses Hash::check directly, not WalletService::verifyPin()
  • Inconsistent type/status values between service constants and controller literals
  • available_balance accessor makes live HTTP call to DOKU on every read
  • 7 webhook endpoints in routes/api.php