# Game Top-Up Automation System

Manual payment flow for KBZPay / AYA Pay:

1. User places an order.
2. The system creates an `ORD...` order ID and adds random digits to the product price.
3. User pays the exact amount and uploads a screenshot.
4. Telegram sends you the order, amount, method, screenshot, and action buttons.
5. You verify the payment inside KBZPay / AYA Pay.
6. Confirm, reject, or mark completed from Telegram or the admin panel.
7. Confirmed orders are added to the automation queue.

## Project Structure

```text
frontend/          Customer and admin HTML/CSS/JS
backend/           Queue, database, uploads, and automation worker foundation
bot/               Telegram bot expansion area
notification/      Email alert system
live-checking/     Health, balance, queue, browser, and session monitoring
logs/              Runtime logs
```

## Run

```bash
python3 server.py
```

Open `http://127.0.0.1:8000`.

## Environment

Set these before running in production:

```bash
export PAYMENT_ACCOUNT_NAME="Your Name"
export KBZPAY_NUMBER="09..."
export AYAPAY_NUMBER="09..."
export AYAPAY_QR_PATH="/aya-pay-qr.png"
export ADMIN_TOKEN="use-a-long-random-token"
export TELEGRAM_BOT_TOKEN="123456:ABC..."
export TELEGRAM_CHAT_ID="123456789"
```

Optional:

```bash
export ORDER_EXPIRY_SECONDS=600
export PORT=8000
```

## Automation Worker

The worker is dry-run by default. It reads confirmed orders from the queue and marks them completed without touching Smile.one until real browser automation is connected.

```bash
cd backend
npm run worker:once
npm run worker
```

Set `AUTOMATION_DRY_RUN=false` in `backend/.env` only after the Smile.one browser automation adapter is implemented and tested.

## Telegram Webhook

Point your Telegram bot webhook to:

```text
https://your-domain.com/api/telegram/webhook
```

The bot buttons use callback data:

- `confirm:ORDER_ID` marks the order `paid`
- `reject:ORDER_ID` marks the order `rejected`
- `complete:ORDER_ID` marks the order `completed`

## Database

The app stores SQLite data at `backend/database/orders.db` with:

- `orders`
- `transaction_logs`
- `order_queue`
- `smile_accounts`

Uploads are stored in `backend/uploads/` and served from `/uploads/...`.

Put the AYA Pay banking QR image at `frontend/aya-pay-qr.png`, or set `AYAPAY_QR_PATH` to the public URL/path for your QR image.

## Live Checking

```bash
cd live-checking
npm run check
npm start
```

Dry-run mode is enabled by default so checks log alerts before real email credentials are configured.

## Important Fraud Rules

- Never trust screenshots alone.
- Always verify inside your KBZPay / AYA Pay wallet app.
- Reject unclear screenshots, edited screenshots, wrong amounts, stale payments, or mismatched payment methods.
- Use the transaction log when reviewing disputes.
