PROTEX · Payment Gateway

Secure Online Payment Gateway

An educational payment platform that behaves like a real gateway hosted checkout, issuer authentication, signed notifications, explainable fraud decisions without touching real banking networks or real cardholder data.

Sandbox only. No real funds TLS · AES-256-GCM · HMAC-SHA-256 Keycloak MFA + RBAC
0
team modules
0
week schedule
0
fraud decision states
0
human actor roles
REF/00

Motivation

Online payments combine identity, money and cross-organisation trust in one workflow which makes them a high-value attack surface. A successful-looking return page is not proof a payment occurred. Values can be tampered with client-side, callbacks can be forged or replayed, and stolen credentials can be reused for carding or account takeover.

Most student payment demos hide the hard part behind a UI or a recorded video. This project makes the full trust chain observable: how the merchant calculates a trusted amount, how the gateway issues an expiring payment state, how the pseudo-bank authenticates the payer, how messages are signed and verified, and how fraud signals shape the outcome.

REF/01

System Architecture

A modular monolith for the FYP window, with the pseudo-bank kept as a genuinely separate service to preserve a realistic trust boundary.

Merchant
Invoice, checkout session, webhook verification
Payment Gateway
Validation, state machine, signed notifications
Pseudo-bank
Virtual cards, OTP/passkey challenge, authorisation
Fraud & Security Engine
Risk scoring, rule evaluation, review queue
Identity (Keycloak)
MFA + RBAC for Customer / Merchant / Admin
Postgres + Redis
Ledger, audit trail · OTP/rate-limit/idempotency
REF/02

Security Controls

Every simulated decision traces back to a rule, a signature, a state transition, or an audit event. Nothing is an unexplained black box.

TransportTLS 1.2+ / HTTPS on every service connection
At restAES-256-GCM for sensitive synthetic fields
IntegrityHMAC-SHA-256 signed webhooks and issuer messages
PasswordsArgon2id hashing
IdentityKeycloak MFA + RBAC for Customer, Merchant, Gateway Administrator
Anti-replayNonces, timestamps, idempotency keys, explicit state transitions
REF/03

Fraud Decisioning

Explainable risk score from amount, velocity, device, IP, prior declines and card status. Not a black-box ML model.

Low riskHigh risk

Allow
Proceeds directly to authorisation
Challenge
Routed to step-up MFA
Hold
Queued for administrator review
Reject
Declined, logged, auditable
REF/04

Requirement Prioritisation

Five members, 20 weeks. The Base / Additional / Stretch split protects a working demonstrable core.

Base
Core customer journey
Register/MFA, review order, pay via card token, view receipt.
Base
Merchant invoice → verified fulfilment
Create order, checkout session, verify signed webhook before fulfilling.
Base
Fraud rule configuration
Administrator-defined thresholds applied automatically.
Base
Clinic scenario
Primary demonstration business.
Additional
QR payment flow
Alternative to the card-token checkout.
Additional
Card freeze, transaction report, refund request
Customer-side protection actions.
Additional
Partial refunds + reconciliation dashboard
Beyond a single full-refund path.
Additional
Security alert review queue
Administrator action on flagged transactions.
Stretch
Supermarket scenario
Higher volume, velocity-based fraud controls.
Stretch
Hash-chain audit evidence + incident export
Tamper-evident logging, redacted evidence export.
Stretch
Key rotation and break-glass access
Advanced credential lifecycle controls.
REF/05

Tech Stack

Front-end

  • TypeScript + Next.js + React
  • Figma for shared design review
  • Checkout, merchant portal, admin dashboard

Back-end

  • NestJS on Node.js
  • REST with OpenAPI contracts
  • Gateway, Fraud Engine, Pseudo-bank as separate modules/services

Data

  • PostgreSQL ledger, accounts, audit
  • Redis — OTP expiry, rate limits, idempotency

Testing

  • Jest, Supertest, Playwright
  • Postman / Newman
  • OWASP ZAP · k6 load testing
REF/06

Delivery Method

ScrumIterative delivery
2 wkSprint cadence
WeeklyInternal review
20 wkTotal schedule
REF/07

Team

Lee Wen Xuan
Pseudo-bank & Testing Developer
Virtual cards, OTP verification, refunds, integration & security testing
Chua Jing Hong Jay
Project Lead · Gateway Backend
Core payment processing, duplicate-transaction prevention
Tan Si Yu
Fraud, Security & Admin Developer
Accounts, virtual cards, OTP/passkey, issuer API
Foyshal
Customer Checkout & Merchant Portal
Checkout flow, merchant onboarding, orders, refunds
Fasil
Gateway Backend Developer
Payment validation, status management, signed webhooks

Supervisor: Mr. Lim Min Han