feat(router): add an api to migrate the apple pay certificates from connector metadata to connector_wallets_details column in merchant connector account

crates/api_models/src/apple_pay_certificates_migration.rs

@@ -0,0 +1,12 @@
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct ApplePayCertificatesMigrationResponse {
+    pub migration_successful: Vec<String>,
+    pub migration_failed: Vec<String>,
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
+pub struct ApplePayCertificatesMigrationRequest {
+    pub merchant_ids: Vec<String>,
+}
+
+impl common_utils::events::ApiEventMetric for ApplePayCertificatesMigrationRequest {}

crates/api_models/src/events.rs

@@ -1,3 +1,4 @@
+pub mod apple_pay_certificates_migration;
 pub mod connector_onboarding;
 pub mod customer;
 pub mod dispute;

crates/api_models/src/events/apple_pay_certificates_migration.rs

@@ -0,0 +1,9 @@
+use common_utils::events::ApiEventMetric;
+
+use crate::apple_pay_certificates_migration::ApplePayCertificatesMigrationResponse;
+
+impl ApiEventMetric for ApplePayCertificatesMigrationResponse {
+    fn get_api_event_type(&self) -> Option<common_utils::events::ApiEventsType> {
+        Some(common_utils::events::ApiEventsType::ApplePayCertificatesMigration)
+    }
+}

crates/api_models/src/lib.rs

@@ -2,6 +2,7 @@
 pub mod admin;
 pub mod analytics;
 pub mod api_keys;
+pub mod apple_pay_certificates_migration;
 pub mod blocklist;
 pub mod cards_info;
 pub mod conditional_configs;

crates/api_models/src/payments.rs

@@ -4208,6 +4208,23 @@ pub struct SessionTokenInfo {
     pub initiative_context: String,
     #[schema(value_type = Option<CountryAlpha2>)]
     pub merchant_business_country: Option<api_enums::CountryAlpha2>,
+    #[serde(flatten)]
+    pub payment_processing_details_at: Option<PaymentProcessingDetailsAt>,
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, ToSchema)]
+#[serde(tag = "payment_processing_details_at")]
+pub enum PaymentProcessingDetailsAt {
+    Hyperswitch(PaymentProcessingDetails),
+    Connector,
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq, ToSchema)]
+pub struct PaymentProcessingDetails {
+    #[schema(value_type = String)]
+    pub payment_processing_certificate: Secret<String>,
+    #[schema(value_type = String)]
+    pub payment_processing_certificate_key: Secret<String>,
 }
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize, ToSchema)]

crates/common_enums/src/enums.rs

@@ -2284,11 +2284,6 @@ pub enum ReconStatus {
     Active,
     Disabled,
 }
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum ApplePayFlow {
-    Simplified,
-    Manual,
-}
 
 #[derive(
     Clone,

crates/common_utils/src/events.rs

@@ -50,6 +50,7 @@ pub enum ApiEventsType {
     // TODO: This has to be removed once the corresponding apiEventTypes are created
     Miscellaneous,
     RustLocker,
+    ApplePayCertificatesMigration,
     FraudCheck,
     Recon,
     Dispute {

crates/connector_configs/src/connector.rs

@@ -67,7 +67,7 @@ pub enum ConnectorAuthType {
 #[derive(Debug, Deserialize, serde::Serialize, Clone)]
 #[serde(untagged)]
 pub enum ApplePayTomlConfig {
-    Standard(payments::ApplePayMetadata),
+    Standard(Box<payments::ApplePayMetadata>),
     Zen(ZenApplePay),
 }
 

crates/diesel_models/src/merchant_connector_account.rs

@@ -43,6 +43,7 @@ pub struct MerchantConnectorAccount {
     pub applepay_verified_domains: Option<Vec<String>>,
     pub pm_auth_config: Option<serde_json::Value>,
     pub status: storage_enums::ConnectorStatus,
+    pub connector_wallets_details: Option<Encryption>,
 }
 
 #[derive(Clone, Debug, Insertable, router_derive::DebugAsDisplay)]
@@ -72,6 +73,7 @@ pub struct MerchantConnectorAccountNew {
     pub applepay_verified_domains: Option<Vec<String>>,
     pub pm_auth_config: Option<serde_json::Value>,
     pub status: storage_enums::ConnectorStatus,
+    pub connector_wallets_details: Option<Encryption>,
 }
 
 #[derive(Clone, Debug, AsChangeset, router_derive::DebugAsDisplay)]
@@ -96,6 +98,7 @@ pub struct MerchantConnectorAccountUpdateInternal {
     pub applepay_verified_domains: Option<Vec<String>>,
     pub pm_auth_config: Option<serde_json::Value>,
     pub status: Option<storage_enums::ConnectorStatus>,
+    pub connector_wallets_details: Option<Encryption>,
 }
 
 impl MerchantConnectorAccountUpdateInternal {

crates/diesel_models/src/query/generics.rs

@@ -166,7 +166,8 @@ where
         }
         Err(DieselError::NotFound) => Err(report!(errors::DatabaseError::NotFound))
             .attach_printable_lazy(|| format!("Error while updating {debug_values}")),
-        _ => Err(report!(errors::DatabaseError::Others))
+        Err(error) => Err(error)
+            .change_context(errors::DatabaseError::Others)
             .attach_printable_lazy(|| format!("Error while updating {debug_values}")),
     }
 }
@@ -252,7 +253,8 @@ where
         }
         Err(DieselError::NotFound) => Err(report!(errors::DatabaseError::NotFound))
             .attach_printable_lazy(|| format!("Error while updating by ID {debug_values}")),
-        _ => Err(report!(errors::DatabaseError::Others))
+        Err(error) => Err(error)
+            .change_context(errors::DatabaseError::Others)
             .attach_printable_lazy(|| format!("Error while updating by ID {debug_values}")),
     }
 }

crates/diesel_models/src/schema.rs

@@ -679,6 +679,7 @@ diesel::table! {
         applepay_verified_domains -> Nullable<Array<Nullable<Text>>>,
         pm_auth_config -> Nullable<Jsonb>,
         status -> ConnectorStatus,
+        connector_wallets_details -> Nullable<Bytea>,
     }
 }
 

crates/hyperswitch_domain_models/src/payment_method_data.rs

@@ -22,6 +22,12 @@ pub enum PaymentMethodData {
     CardToken(CardToken),
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ApplePayFlow {
+    Simplified(api_models::payments::PaymentProcessingDetails),
+    Manual,
+}
+
 impl PaymentMethodData {
     pub fn get_payment_method(&self) -> Option<common_enums::PaymentMethod> {
         match self {

crates/hyperswitch_domain_models/src/router_data.rs

@@ -3,7 +3,7 @@ use std::{collections::HashMap, marker::PhantomData};
 use common_utils::id_type;
 use masking::Secret;
 
-use crate::payment_address::PaymentAddress;
+use crate::{payment_address::PaymentAddress, payment_method_data};
 
 #[derive(Debug, Clone)]
 pub struct RouterData<Flow, Request, Response> {
@@ -22,6 +22,7 @@ pub struct RouterData<Flow, Request, Response> {
     pub address: PaymentAddress,
     pub auth_type: common_enums::enums::AuthenticationType,
     pub connector_meta_data: Option<common_utils::pii::SecretSerdeValue>,
+    pub connector_wallets_details: Option<common_utils::pii::SecretSerdeValue>,
     pub amount_captured: Option<i64>,
     pub access_token: Option<AccessToken>,
     pub session_token: Option<String>,
@@ -56,7 +57,7 @@ pub struct RouterData<Flow, Request, Response> {
     pub connector_http_status_code: Option<u16>,
     pub external_latency: Option<u128>,
     /// Contains apple pay flow type simplified or manual
-    pub apple_pay_flow: Option<common_enums::enums::ApplePayFlow>,
+    pub apple_pay_flow: Option<payment_method_data::ApplePayFlow>,
 
     pub frm_metadata: Option<common_utils::pii::SecretSerdeValue>,
 

crates/openapi/src/openapi.rs

@@ -309,6 +309,8 @@ Never share your secret api keys. Keep them guarded and secure.
         api_models::payments::FeatureMetadata,
         api_models::payments::ApplepayConnectorMetadataRequest,
         api_models::payments::SessionTokenInfo,
+        api_models::payments::PaymentProcessingDetailsAt,
+        api_models::payments::PaymentProcessingDetails,
         api_models::payments::SwishQrData,
         api_models::payments::AirwallexData,
         api_models::payments::NoonData,

crates/router/src/core.rs

@@ -1,6 +1,7 @@
 pub mod admin;
 pub mod api_keys;
 pub mod api_locking;
+pub mod apple_pay_certificates_migration;
 pub mod authentication;
 pub mod blocklist;
 pub mod cache;

crates/router/src/core/admin.rs

@@ -937,7 +937,7 @@ pub async fn create_payment_connector(
         payment_methods_enabled,
         test_mode: req.test_mode,
         disabled,
-        metadata: req.metadata,
+        metadata: req.metadata.clone(),
         frm_configs,
         connector_label: Some(connector_label.clone()),
         business_country: req.business_country,
@@ -961,6 +961,7 @@ pub async fn create_payment_connector(
         applepay_verified_domains: None,
         pm_auth_config: req.pm_auth_config.clone(),
         status: connector_status,
+        connector_wallets_details: helpers::get_encrypted_apple_pay_connector_wallets_details(&key_store, &req.metadata).await?,
     };
 
     let transaction_type = match req.connector_type {
@@ -1200,6 +1201,7 @@ pub async fn update_payment_connector(
             expected_format: "auth_type and api_key".to_string(),
         })?;
     let metadata = req.metadata.clone().or(mca.metadata.clone());
+
     let connector_name = mca.connector_name.as_ref();
     let connector_enum = api_models::enums::Connector::from_str(connector_name)
         .change_context(errors::ApiErrorResponse::InvalidDataValue {
@@ -1275,6 +1277,10 @@ pub async fn update_payment_connector(
         applepay_verified_domains: None,
         pm_auth_config: req.pm_auth_config,
         status: Some(connector_status),
+        connector_wallets_details: helpers::get_encrypted_apple_pay_connector_wallets_details(
+            &key_store, &metadata,
+        )
+        .await?,
     };
 
     // Profile id should always be present

crates/router/src/core/apple_pay_certificates_migration.rs

@@ -0,0 +1,109 @@
+use api_models::apple_pay_certificates_migration;
+use common_utils::errors::CustomResult;
+use error_stack::ResultExt;
+use masking::{PeekInterface, Secret};
+
+use super::{
+    errors::{self, StorageErrorExt},
+    payments::helpers,
+};
+use crate::{
+    routes::SessionState,
+    services::{self, logger},
+    types::{domain::types as domain_types, storage},
+};
+
+pub async fn apple_pay_certificates_migration(
+    state: SessionState,
+    req: &apple_pay_certificates_migration::ApplePayCertificatesMigrationRequest,
+) -> CustomResult<
+    services::ApplicationResponse<
+        apple_pay_certificates_migration::ApplePayCertificatesMigrationResponse,
+    >,
+    errors::ApiErrorResponse,
+> {
+    let db = state.store.as_ref();
+
+    let merchant_id_list = &req.merchant_ids;
+
+    let mut migration_successful_merchant_ids = vec![];
+    let mut migration_failed_merchant_ids = vec![];
+
+    for merchant_id in merchant_id_list {
+        let key_store = state
+            .store
+            .get_merchant_key_store_by_merchant_id(
+                merchant_id,
+                &state.store.get_master_key().to_vec().into(),
+            )
+            .await
+            .change_context(errors::ApiErrorResponse::InternalServerError)?;
+
+        let merchant_connector_accounts = db
+            .find_merchant_connector_account_by_merchant_id_and_disabled_list(
+                merchant_id,
+                true,
+                &key_store,
+            )
+            .await
+            .to_not_found_response(errors::ApiErrorResponse::InternalServerError)?;
+
+        let mut mca_to_update = vec![];
+
+        for connector_account in merchant_connector_accounts {
+            let connector_apple_pay_metadata =
+                helpers::get_applepay_metadata(connector_account.clone().metadata)
+                    .map_err(|error| {
+                        logger::error!(
+                "Apple pay metadata parsing failed for {:?} in certificates migrations api {:?}",
+                connector_account.clone().connector_name,
+                error
+            )
+                    })
+                    .ok();
+            if let Some(apple_pay_metadata) = connector_apple_pay_metadata {
+                let encrypted_apple_pay_metadata = domain_types::encrypt(
+                    Secret::new(
+                        serde_json::to_value(apple_pay_metadata)
+                            .change_context(errors::ApiErrorResponse::InternalServerError)
+                            .attach_printable("Failed to serialize apple pay metadata as JSON")?,
+                    ),
+                    key_store.key.get_inner().peek(),
+                )
+                .await
+                .change_context(errors::ApiErrorResponse::InternalServerError)
+                .attach_printable("Unable to encrypt connector apple pay metadata")?;
+
+                let updated_mca =
+                    storage::MerchantConnectorAccountUpdate::ConnectorWalletDetailsUpdate {
+                        connector_wallets_details: encrypted_apple_pay_metadata,
+                    };
+
+                mca_to_update.push((connector_account, updated_mca.into()));
+            }
+        }
+
+        let merchant_connector_accounts_update = db
+            .update_multiple_merchant_connector_accounts(mca_to_update)
+            .await;
+
+        match merchant_connector_accounts_update {
+            Ok(_) => {
+                logger::debug!("Merchant connector accounts updated for merchant id {merchant_id}");
+                migration_successful_merchant_ids.push(merchant_id.to_string());
+            }
+            Err(error) => {
+                logger::debug!(
+                    "Merchant connector accounts update failed with error {error} for merchant id {merchant_id}");
+                migration_failed_merchant_ids.push(merchant_id.to_string());
+            }
+        };
+    }
+
+    Ok(services::api::ApplicationResponse::Json(
+        apple_pay_certificates_migration::ApplePayCertificatesMigrationResponse {
+            migration_successful: migration_successful_merchant_ids,
+            migration_failed: migration_failed_merchant_ids,
+        },
+    ))
+}

crates/router/src/core/authentication/transformers.rs

@@ -153,6 +153,7 @@ pub fn construct_router_data<F: Clone, Req, Res>(
         address,
         auth_type: common_enums::AuthenticationType::NoThreeDs,
         connector_meta_data: merchant_connector_account.get_metadata(),
+        connector_wallets_details: merchant_connector_account.get_connector_wallets_details(),
         amount_captured: None,
         access_token: None,
         session_token: None,

crates/router/src/core/fraud_check/flows/checkout_flow.rs

@@ -67,6 +67,7 @@ impl ConstructFlowSpecificData<frm_api::Checkout, FraudCheckCheckoutData, FraudC
             address: self.address.clone(),
             auth_type: storage_enums::AuthenticationType::NoThreeDs,
             connector_meta_data: None,
+            connector_wallets_details: None,
             amount_captured: None,
             request: FraudCheckCheckoutData {
                 amount: self.payment_attempt.amount.get_amount_as_i64(),

crates/router/src/core/fraud_check/flows/fulfillment_flow.rs

@@ -72,6 +72,7 @@ pub async fn construct_fulfillment_router_data<'a>(
         address: PaymentAddress::default(),
         auth_type: payment_attempt.authentication_type.unwrap_or_default(),
         connector_meta_data: merchant_connector_account.get_metadata(),
+        connector_wallets_details: merchant_connector_account.get_connector_wallets_details(),
         amount_captured: payment_intent
             .amount_captured
             .map(|amt| amt.get_amount_as_i64()),

crates/router/src/core/fraud_check/flows/record_return.rs

@@ -65,6 +65,7 @@ impl ConstructFlowSpecificData<RecordReturn, FraudCheckRecordReturnData, FraudCh
             address: self.address.clone(),
             auth_type: storage_enums::AuthenticationType::NoThreeDs,
             connector_meta_data: None,
+            connector_wallets_details: None,
             amount_captured: None,
             request: FraudCheckRecordReturnData {
                 amount: self.payment_attempt.amount.get_amount_as_i64(),

crates/router/src/core/fraud_check/flows/sale_flow.rs

@@ -62,6 +62,7 @@ impl ConstructFlowSpecificData<frm_api::Sale, FraudCheckSaleData, FraudCheckResp
             address: self.address.clone(),
             auth_type: storage_enums::AuthenticationType::NoThreeDs,
             connector_meta_data: None,
+            connector_wallets_details: None,
             amount_captured: None,
             request: FraudCheckSaleData {
                 amount: self.payment_attempt.amount.get_amount_as_i64(),

crates/router/src/core/fraud_check/flows/transaction_flow.rs

@@ -72,6 +72,7 @@ impl
             address: self.address.clone(),
             auth_type: storage_enums::AuthenticationType::NoThreeDs,
             connector_meta_data: None,
+            connector_wallets_details: None,
             amount_captured: None,
             request: FraudCheckTransactionData {
                 amount: self.payment_attempt.amount.get_amount_as_i64(),

crates/router/src/core/mandate/utils.rs

@@ -44,6 +44,7 @@ pub async fn construct_mandate_revoke_router_data(
         address: PaymentAddress::default(),
         auth_type: diesel_models::enums::AuthenticationType::default(),
         connector_meta_data: None,
+        connector_wallets_details: None,
         amount_captured: None,
         access_token: None,
         session_token: None,