feat(integrations): WooCommerce gateway with integer-paise amounts and signed webhooks

.coderabbit.yaml

@@ -0,0 +1,117 @@
+# CodeRabbit review rules for Kaasu. Source of truth for review behaviour; AGENTS.md holds the project rules.
+language: en-GB
+early_access: false
+
+reviews:
+  profile: assertive
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: "@coderabbitai summary"
+  review_status: true
+  commit_status: true
+  collapse_walkthrough: false
+  poem: false
+  auto_review:
+    enabled: true
+    drafts: false
+    auto_incremental_review: true
+    auto_pause_after_reviewed_commits: 0
+    base_branches:
+      - ".*"
+
+  path_filters:
+    - "!**/*.golden"
+    - "!**/*.lock"
+    - "!**/package-lock.json"
+    - "!**/go.sum"
+    - "!**/*.png"
+    - "!**/*.webp"
+
+  path_instructions:
+    - path: "internal/match/**"
+      instructions: >-
+        MONEY PATH. Only this package may confirm a payment. Check: amounts are int64 paise (never float),
+        an auto-confirm needs an exact amount AND an authentic source AND score >= 80 AND an order under the
+        account limit, late or closed orders go to review, and Process is idempotent. Flag any new code path
+        that can reach confirmed without these checks. Every behaviour change needs a test.
+    - path: "internal/states/**"
+      instructions: >-
+        MONEY PATH. The transition table is the only place order state changes. Check every new edge against the
+        table in the card, that each transition writes a ledger row in the same transaction, and that refunds are
+        the only release of a held amount.
+    - path: "internal/ledger/**"
+      instructions: >-
+        MONEY PATH. The ledger is append-only and hash-chained. Flag anything that updates or deletes rows,
+        changes the hash inputs, or stores raw alert text or full payer identifiers.
+    - path: "internal/ingest/**"
+      instructions: >-
+        SECURITY. Every request is signed over the body hash, timestamp and nonce; the window is 60 seconds;
+        replays get 409; every failure is the same 401 with no detail. Flag any path that accepts an unsigned
+        or stale request, and any use of == on secrets.
+    - path: "internal/parsers/**"
+      instructions: >-
+        MONEY PATH. Amounts are integer paise parsed from the digit string. Flag ParseFloat or any float
+        arithmetic on money, any parser that accepts a debit, and any fixture with real customer data.
+    - path: "internal/email/**"
+      instructions: >-
+        SECURITY. DKIM is verified on the raw bytes; the signing domain must be an allow-listed bank domain
+        (exact or subdomain); the From address must align. Flag any path that trusts a message without DKIM.
+    - path: "internal/secrets/**"
+      instructions: >-
+        SECURITY. Secrets are envelope-encrypted (XChaCha20-Poly1305); the master key never lives in the
+        database; API keys are stored as SHA-256 hashes and shown once. Flag plaintext storage or logging.
+    - path: "internal/adminauth/**"
+      instructions: >-
+        SECURITY. Sessions are stored as hashes, cookies are HttpOnly, SameSite=Strict and Secure outside local
+        http; TOTP codes are single-use; lockout and the same reply for unknown names must hold. Flag any change
+        that weakens these.
+    - path: "internal/web/**"
+      instructions: >-
+        CUSTOMER PAGES. No third-party scripts, no inline scripts, no 'failed' copy while an outcome is
+        unknown, and no Paisu on customer pages. Text comes from the i18n catalogue, never hard-coded.
+    - path: "i18n/**"
+      instructions: >-
+        Every key must exist in every language with the same placeholders. Machine drafts must stay listed in
+        i18n/REVIEW.md. Do not mark a translation reviewed.
+    - path: "**/*.md"
+      instructions: >-
+        Documentation. Flag em dashes (U+2014) and claims the code does not back up. Keep copy plain.
+    - path: "web/**"
+      instructions: >-
+        Website. No em dashes. No emoji used as icons. No tech-stack wording on the landing page; talk about impact.
+    - path: "**/*.go"
+      instructions: >-
+        Go: stdlib first. Wrap errors with context. No package-level mutable globals. Table-driven tests. Money is
+        int64 paise. Flag any network call in tests.
+
+  tools:
+    golangci-lint:
+      enabled: false
+    gitleaks:
+      enabled: true
+    semgrep:
+      enabled: true
+    ast-grep:
+      enabled: false
+
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+
+chat:
+  auto_reply: true
+
+knowledge_base:
+  opt_out: false
+  learnings:
+    scope: auto
+  code_guidelines:
+    enabled: true
+    filePatterns:
+      - "AGENTS.md"
+      - "CONTRIBUTING.md"
+      - "architecture.md"
+      - "design.md"
+      - "SECURITY.md"

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.agents
+*.db
+.kaasu-dev
+bin
+web
+node_modules
+secrets

.github/labeler.yml

@@ -0,0 +1,18 @@
+area:server:
+  - changed-files:
+      - any-glob-to-any-file: ["internal/**", "cmd/**"]
+area:web:
+  - changed-files:
+      - any-glob-to-any-file: ["web/**", "internal/web/**"]
+area:docs:
+  - changed-files:
+      - any-glob-to-any-file: ["**/*.md", "docs/**"]
+area:security:
+  - changed-files:
+      - any-glob-to-any-file: ["internal/secrets/**", "internal/adminauth/**", "internal/ingest/**", "SECURITY.md"]
+area:i18n:
+  - changed-files:
+      - any-glob-to-any-file: ["i18n/**"]
+area:infra:
+  - changed-files:
+      - any-glob-to-any-file: [".github/**", "deploy/**", "Dockerfile", "compose.yaml", "install.sh"]

.github/workflows/codeql.yml

@@ -17,8 +17,8 @@ jobs:
         language: [javascript-typescript, actions]
         # Add `go`, `java-kotlin` and `swift` when those code trees land.
     steps:
-      - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
         with: { languages: '${{ matrix.language }}' }
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
         with: { category: '/language:${{ matrix.language }}' }

.github/workflows/go.yml

@@ -0,0 +1,63 @@
+name: go
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+concurrency:
+  group: go-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - name: gofmt
+        run: test -z "$(gofmt -l .)" || (gofmt -l . && exit 1)
+      - run: go vet ./...
+      - run: go run honnef.co/go/tools/cmd/staticcheck@2026.2.2 ./...
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - run: make test-cover
+      - run: |
+          go tool cover -func=coverage.out | tail -1 | sed 's/^/Total coverage: /' >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with: { name: coverage, path: coverage.out, retention-days: 7 }
+  fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - run: scripts/fuzz.sh 30s
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - { goos: linux, goarch: amd64 }
+          - { goos: linux, goarch: arm64 }
+          - { goos: darwin, goarch: amd64 }
+          - { goos: darwin, goarch: arm64 }
+          - { goos: windows, goarch: amd64 }
+          - { goos: windows, goarch: arm64 }
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - run: go build -trimpath -ldflags "-s -w" -o kaasu-${{ matrix.goos }}-${{ matrix.goarch }} ./cmd/kaasu
+        env: { CGO_ENABLED: '0', GOOS: '${{ matrix.goos }}', GOARCH: '${{ matrix.goarch }}' }
+  repro:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - run: scripts/repro-check.sh

.github/workflows/labeler.yml

@@ -0,0 +1,15 @@
+name: labeler
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          sync-labels: true

.github/workflows/pr-title.yml

@@ -0,0 +1,15 @@
+name: pr-title
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+permissions:
+  contents: read
+jobs:
+  title:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - run: scripts/check-pr-title_test.sh
+      - run: scripts/check-pr-title.sh "$PR_TITLE"
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}

.github/workflows/release.yml

@@ -0,0 +1,60 @@
+name: release
+on:
+  push:
+    tags: ['v*']
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - { goos: linux, goarch: amd64 }
+          - { goos: linux, goarch: arm64 }
+          - { goos: darwin, goarch: amd64 }
+          - { goos: darwin, goarch: arm64 }
+          - { goos: windows, goarch: amd64 }
+          - { goos: windows, goarch: arm64 }
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - name: Build
+        env:
+          CGO_ENABLED: '0'
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          VERSION: ${{ github.ref_name }}
+        run: |
+          ext=""; [ "$GOOS" = windows ] && ext=".exe"
+          go build -trimpath -buildvcs=false -ldflags "-s -w -X main.version=$VERSION" -o "kaasu-$GOOS-$GOARCH$ext" ./cmd/kaasu
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: bin-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: kaasu-*
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write   # keyless cosign signing
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with: { path: dist, merge-multiple: true }
+      - uses: anchore/sbom-action@55dc4ee22412511ee8c3142cbea40418e6cec693 # v0.17.8
+        with: { path: dist, format: spdx-json, output-file: dist/kaasu.spdx.json }
+      # The SBOM is listed in SHA256SUMS, and SHA256SUMS is signed, so the SBOM is authenticated too.
+      - name: Checksums
+        working-directory: dist
+        run: sha256sum kaasu-* kaasu.spdx.json > SHA256SUMS
+      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+      - name: Sign
+        working-directory: dist
+        run: |
+          for f in kaasu-* SHA256SUMS; do cosign sign-blob --yes --output-signature "$f.sig" --output-certificate "$f.pem" "$f"; done
+      - uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
+        with:
+          draft: true   # a person publishes the draft after checking it
+          generate_release_notes: true
+          files: dist/*

.github/workflows/security.yml

@@ -0,0 +1,22 @@
+name: security
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+permissions:
+  contents: read
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with: { go-version-file: go.mod }
+      - run: go run golang.org/x/vuln/cmd/govulncheck@v1.2.0 ./...
+  pins:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: scripts/check-pins.sh

.github/workflows/web.yml

@@ -16,24 +16,24 @@ jobs:
     runs-on: ubuntu-latest
     defaults: { run: { working-directory: web } }
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with: { node-version: 24, cache: npm, cache-dependency-path: web/package-lock.json }
       - run: npm ci
       - run: npm test
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: { name: site, path: web/dist, retention-days: 7 }
   deploy:
     needs: test
     # Secrets are not available to pull requests from forks.
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with: { name: site, path: web/dist }
       - name: Deploy to Cloudflare
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/woocommerce.yml

@@ -0,0 +1,18 @@
+name: woocommerce
+on:
+  pull_request:
+    paths: ['integrations/woocommerce/**']
+  push:
+    branches: [main]
+    paths: ['integrations/woocommerce/**']
+permissions:
+  contents: read
+jobs:
+  php:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
+        with: { php-version: '8.2' }
+      - run: find integrations/woocommerce -name '*.php' -print0 | xargs -0 -n1 php -l
+      - run: php integrations/woocommerce/tests/run.php

.gitignore

@@ -0,0 +1,10 @@
+bin/
+*.db
+*.db-wal
+*.db-shm
+.agents/plans/
+coverage.out
+
+# Terraform local state and providers
+**/.terraform/
+*.tfstate*