feat(router): add an api to migrate the apple pay certificates from connector metadata to connector_wallets_details column in merchant connector account

crates/api_models/src/apple_pay_certificates_migration.rs

@@ -0,0 +1,6 @@
+#[derive(Debug, Clone, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApplePayCertificatesMigrationResponse {
+    pub status_message: String,
+    pub status_code: String,
+}

crates/api_models/src/events.rs

@@ -1,3 +1,4 @@
+pub mod apple_pay_certificates_migration;
 pub mod connector_onboarding;
 pub mod customer;
 pub mod dispute;

crates/api_models/src/events/apple_pay_certificates_migration.rs

@@ -0,0 +1,9 @@
+use common_utils::events::ApiEventMetric;
+
+use crate::apple_pay_certificates_migration::ApplePayCertificatesMigrationResponse;
+
+impl ApiEventMetric for ApplePayCertificatesMigrationResponse {
+    fn get_api_event_type(&self) -> Option<common_utils::events::ApiEventsType> {
+        Some(common_utils::events::ApiEventsType::ApplePayCertificatesMigration)
+    }
+}

crates/api_models/src/lib.rs

@@ -2,6 +2,7 @@
 pub mod admin;
 pub mod analytics;
 pub mod api_keys;
+pub mod apple_pay_certificates_migration;
 pub mod blocklist;
 pub mod cards_info;
 pub mod conditional_configs;

crates/api_models/src/payments.rs

@@ -4172,6 +4172,23 @@ pub struct SessionTokenInfo {
     pub initiative_context: String,
     #[schema(value_type = Option<CountryAlpha2>)]
     pub merchant_business_country: Option<api_enums::CountryAlpha2>,
+    #[serde(flatten)]
+    pub payment_processing_details_at: Option<PaymentProcessingDetailsAt>,
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, ToSchema)]
+#[serde(tag = "payment_processing_details_at")]
+pub enum PaymentProcessingDetailsAt {
+    Hyperswitch(PaymentProcessingDetails),
+    Connector,
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq, ToSchema)]
+pub struct PaymentProcessingDetails {
+    #[schema(value_type = String)]
+    pub payment_processing_certificate: Secret<String>,
+    #[schema(value_type = String)]
+    pub payment_processing_certificate_key: Secret<String>,
 }
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize, ToSchema)]

crates/common_enums/src/enums.rs

@@ -2284,11 +2284,6 @@ pub enum ReconStatus {
     Active,
     Disabled,
 }
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum ApplePayFlow {
-    Simplified,
-    Manual,
-}
 
 #[derive(
     Clone,

crates/common_utils/src/events.rs

@@ -48,6 +48,7 @@ pub enum ApiEventsType {
     // TODO: This has to be removed once the corresponding apiEventTypes are created
     Miscellaneous,
     RustLocker,
+    ApplePayCertificatesMigration,
     FraudCheck,
     Recon,
     Dispute {

crates/connector_configs/src/connector.rs

@@ -67,7 +67,7 @@ pub enum ConnectorAuthType {
 #[derive(Debug, Deserialize, serde::Serialize, Clone)]
 #[serde(untagged)]
 pub enum ApplePayTomlConfig {
-    Standard(payments::ApplePayMetadata),
+    Standard(Box<payments::ApplePayMetadata>),
     Zen(ZenApplePay),
 }
 

crates/diesel_models/src/merchant_connector_account.rs

@@ -43,6 +43,7 @@ pub struct MerchantConnectorAccount {
     pub applepay_verified_domains: Option<Vec<String>>,
     pub pm_auth_config: Option<serde_json::Value>,
     pub status: storage_enums::ConnectorStatus,
+    pub connector_wallets_details: Option<Encryption>,
 }
 
 #[derive(Clone, Debug, Insertable, router_derive::DebugAsDisplay)]
@@ -72,6 +73,7 @@ pub struct MerchantConnectorAccountNew {
     pub applepay_verified_domains: Option<Vec<String>>,
     pub pm_auth_config: Option<serde_json::Value>,
     pub status: storage_enums::ConnectorStatus,
+    pub connector_wallets_details: Option<Encryption>,
 }
 
 #[derive(Clone, Debug, AsChangeset, router_derive::DebugAsDisplay)]
@@ -96,6 +98,7 @@ pub struct MerchantConnectorAccountUpdateInternal {
     pub applepay_verified_domains: Option<Vec<String>>,
     pub pm_auth_config: Option<serde_json::Value>,
     pub status: Option<storage_enums::ConnectorStatus>,
+    pub connector_wallets_details: Option<Encryption>,
 }
 
 impl MerchantConnectorAccountUpdateInternal {

crates/diesel_models/src/schema.rs

@@ -677,6 +677,7 @@ diesel::table! {
         applepay_verified_domains -> Nullable<Array<Nullable<Text>>>,
         pm_auth_config -> Nullable<Jsonb>,
         status -> ConnectorStatus,
+        connector_wallets_details -> Nullable<Bytea>,
     }
 }
 

crates/hyperswitch_domain_models/src/payment_method_data.rs

@@ -1,3 +1,4 @@
+use api_models::payments;
 use common_utils::pii::{self, Email};
 use masking::Secret;
 use serde::{Deserialize, Serialize};
@@ -22,6 +23,12 @@ pub enum PaymentMethodData {
     CardToken(CardToken),
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ApplePayFlow {
+    Simplified(payments::PaymentProcessingDetails),
+    Manual,
+}
+
 impl PaymentMethodData {
     pub fn get_payment_method(&self) -> Option<common_enums::PaymentMethod> {
         match self {

crates/hyperswitch_domain_models/src/router_data.rs

@@ -2,7 +2,7 @@ use std::{collections::HashMap, marker::PhantomData};
 
 use masking::Secret;
 
-use crate::payment_address::PaymentAddress;
+use crate::{payment_address::PaymentAddress, payment_method_data};
 
 #[derive(Debug, Clone)]
 pub struct RouterData<Flow, Request, Response> {
@@ -21,6 +21,7 @@ pub struct RouterData<Flow, Request, Response> {
     pub address: PaymentAddress,
     pub auth_type: common_enums::enums::AuthenticationType,
     pub connector_meta_data: Option<common_utils::pii::SecretSerdeValue>,
+    pub connector_wallets_details: Option<common_utils::pii::SecretSerdeValue>,
     pub amount_captured: Option<i64>,
     pub access_token: Option<AccessToken>,
     pub session_token: Option<String>,
@@ -55,7 +56,7 @@ pub struct RouterData<Flow, Request, Response> {
     pub connector_http_status_code: Option<u16>,
     pub external_latency: Option<u128>,
     /// Contains apple pay flow type simplified or manual
-    pub apple_pay_flow: Option<common_enums::enums::ApplePayFlow>,
+    pub apple_pay_flow: Option<payment_method_data::ApplePayFlow>,
 
     pub frm_metadata: Option<common_utils::pii::SecretSerdeValue>,
 

crates/openapi/src/openapi.rs

@@ -309,6 +309,8 @@ Never share your secret api keys. Keep them guarded and secure.
         api_models::payments::FeatureMetadata,
         api_models::payments::ApplepayConnectorMetadataRequest,
         api_models::payments::SessionTokenInfo,
+        api_models::payments::PaymentProcessingDetailsAt,
+        api_models::payments::PaymentProcessingDetails,
         api_models::payments::SwishQrData,
         api_models::payments::AirwallexData,
         api_models::payments::NoonData,

crates/router/src/core.rs

@@ -1,6 +1,7 @@
 pub mod admin;
 pub mod api_keys;
 pub mod api_locking;
+pub mod apple_pay_certificates_migration;
 pub mod authentication;
 pub mod blocklist;
 pub mod cache;

crates/router/src/core/admin.rs

@@ -27,7 +27,7 @@ use crate::{
     },
     db::StorageInterface,
     routes::{metrics, AppState},
-    services::{self, api as service_api},
+    services::{self, api as service_api, logger},
     types::{
         self, api,
         domain::{
@@ -918,6 +918,24 @@ pub async fn create_payment_connector(
         }
     }
 
+    let apple_pay_metadata = helpers::get_applepay_metadata(req.metadata.clone())
+        .map_err(|error| {
+            logger::info!(
+                "Apple pay metadata parsing failed for while creating merchant connector account in create_payment_connector {:?}",
+                error
+            )
+        })
+        .ok();
+
+    let connector_apple_pay_details = apple_pay_metadata
+        .map(|metadata| {
+            serde_json::to_value(metadata)
+                .change_context(errors::ApiErrorResponse::InternalServerError)
+                .attach_printable("Failed to serialize apple pay metadata as JSON")
+        })
+        .transpose()?
+        .map(masking::Secret::new);
+
     let merchant_connector_account = domain::MerchantConnectorAccount {
         merchant_id: merchant_id.to_string(),
         connector_type: req.connector_type,
@@ -961,6 +979,13 @@ pub async fn create_payment_connector(
         applepay_verified_domains: None,
         pm_auth_config: req.pm_auth_config.clone(),
         status: connector_status,
+        connector_wallets_details: connector_apple_pay_details.async_map(|wallets_details| async { domain_types::encrypt(
+            wallets_details,
+            key_store.key.peek(),
+        )
+        .await
+        .change_context(errors::ApiErrorResponse::InternalServerError)
+        .attach_printable("Unable to encrypt connector wallets details")}).await.transpose()?
     };
 
     let transaction_type = match req.connector_type {
@@ -1200,6 +1225,25 @@ pub async fn update_payment_connector(
             expected_format: "auth_type and api_key".to_string(),
         })?;
     let metadata = req.metadata.clone().or(mca.metadata.clone());
+
+    let apple_pay_metadata = helpers::get_applepay_metadata(metadata.clone())
+        .map_err(|error| {
+            logger::info!(
+                "Apple pay metadata parsing failed for while update merchant connector account in update_payment_connector {:?}",
+                error
+            )
+        })
+        .ok();
+
+    let connector_apple_pay_details = apple_pay_metadata
+        .map(|metadata| {
+            serde_json::to_value(metadata)
+                .change_context(errors::ApiErrorResponse::InternalServerError)
+                .attach_printable("Failed to serialize apple pay metadata as JSON")
+        })
+        .transpose()?
+        .map(masking::Secret::new);
+
     let connector_name = mca.connector_name.as_ref();
     let connector_enum = api_models::enums::Connector::from_str(connector_name)
         .change_context(errors::ApiErrorResponse::InvalidDataValue {
@@ -1275,6 +1319,13 @@ pub async fn update_payment_connector(
         applepay_verified_domains: None,
         pm_auth_config: req.pm_auth_config,
         status: Some(connector_status),
+        connector_wallets_details: connector_apple_pay_details
+            .async_lift(|wallets_details| {
+                domain_types::encrypt_optional(wallets_details, key_store.key.get_inner().peek())
+            })
+            .await
+            .change_context(errors::ApiErrorResponse::InternalServerError)
+            .attach_printable("Failed while encrypting connector wallets details")?,
     };
 
     // Profile id should always be present

crates/router/src/core/apple_pay_certificates_migration.rs

@@ -0,0 +1,108 @@
+use api_models::apple_pay_certificates_migration::ApplePayCertificatesMigrationResponse;
+use common_utils::errors::CustomResult;
+use error_stack::ResultExt;
+use masking::{PeekInterface, Secret};
+
+use super::{
+    errors::{self, StorageErrorExt},
+    payments::helpers,
+};
+use crate::{
+    routes::AppState,
+    services::{self, logger},
+    types::{domain::types as domain_types, storage},
+};
+
+pub async fn apple_pay_certificates_migration(
+    state: AppState,
+    merchant_id: &str,
+) -> CustomResult<
+    services::ApplicationResponse<ApplePayCertificatesMigrationResponse>,
+    errors::ApiErrorResponse,
+> {
+    let db = state.store.as_ref();
+
+    let key_store = state
+        .store
+        .get_merchant_key_store_by_merchant_id(
+            merchant_id,
+            &state.store.get_master_key().to_vec().into(),
+        )
+        .await
+        .change_context(errors::ApiErrorResponse::InternalServerError)?;
+
+    let merchant_connector_accounts = db
+        .find_merchant_connector_account_by_merchant_id_and_disabled_list(
+            merchant_id,
+            true,
+            &key_store,
+        )
+        .await
+        .to_not_found_response(errors::ApiErrorResponse::InternalServerError)?;
+
+    for connector_account in merchant_connector_accounts {
+        let connector_apple_pay_metadata =
+            helpers::get_applepay_metadata(connector_account.clone().metadata)
+                .map_err(|error| {
+                    logger::info!(
+                "Apple pay metadata parsing failed for {:?} in certificates migrations api {:?}",
+                connector_account.clone().connector_name,
+                error
+            )
+                })
+                .ok();
+
+        if let Some(apple_pay_metadata) = connector_apple_pay_metadata {
+            let encrypted_apple_pay_metadata = domain_types::encrypt(
+                Secret::new(
+                    serde_json::to_value(apple_pay_metadata)
+                        .change_context(errors::ApiErrorResponse::InternalServerError)
+                        .attach_printable("Failed to serialize apple pay metadata as JSON")?,
+                ),
+                key_store.key.get_inner().peek(),
+            )
+            .await
+            .change_context(errors::ApiErrorResponse::InternalServerError)
+            .attach_printable("Unable to encrypt connector apple pay metadata")?;
+
+            let updated_mca = storage::MerchantConnectorAccountUpdate::Update {
+                merchant_id: None,
+                connector_type: None,
+                connector_name: None,
+                connector_account_details: None,
+                test_mode: None,
+                disabled: None,
+                merchant_connector_id: None,
+                payment_methods_enabled: None,
+                metadata: None,
+                frm_configs: None,
+                connector_webhook_details: None,
+                applepay_verified_domains: None,
+                pm_auth_config: None,
+                connector_label: None,
+                status: None,
+                connector_wallets_details: Some(encrypted_apple_pay_metadata),
+            };
+            db.update_merchant_connector_account(
+                connector_account.clone(),
+                updated_mca.into(),
+                &key_store,
+            )
+            .await
+            .change_context(errors::ApiErrorResponse::InternalServerError)
+            .attach_printable_lazy(|| {
+                format!(
+                    "Failed while updating MerchantConnectorAccount: id: {:?}",
+                    connector_account.merchant_connector_id
+                )
+            })?;
+        }
+    }
+
+    Ok(services::api::ApplicationResponse::Json(
+        ApplePayCertificatesMigrationResponse {
+            status_code: "200".to_string(),
+            status_message: "Apple pay certificate migration completed".to_string(),
+        },
+    ))
+}

crates/router/src/core/authentication/transformers.rs

@@ -163,6 +163,7 @@ pub fn construct_router_data<F: Clone, Req, Res>(
         address,
         auth_type: common_enums::AuthenticationType::NoThreeDs,
         connector_meta_data: merchant_connector_account.get_metadata(),
+        connector_wallets_details: merchant_connector_account.get_connector_wallets_details(),
         amount_captured: None,
         access_token: None,
         session_token: None,

crates/router/src/core/fraud_check/flows/checkout_flow.rs

@@ -67,6 +67,7 @@ impl ConstructFlowSpecificData<frm_api::Checkout, FraudCheckCheckoutData, FraudC
             address: self.address.clone(),
             auth_type: storage_enums::AuthenticationType::NoThreeDs,
             connector_meta_data: None,
+            connector_wallets_details: None,
             amount_captured: None,
             request: FraudCheckCheckoutData {
                 amount: self.payment_attempt.amount.get_amount_as_i64(),

crates/router/src/core/fraud_check/flows/fulfillment_flow.rs

@@ -72,6 +72,7 @@ pub async fn construct_fulfillment_router_data<'a>(
         address: PaymentAddress::default(),
         auth_type: payment_attempt.authentication_type.unwrap_or_default(),
         connector_meta_data: merchant_connector_account.get_metadata(),
+        connector_wallets_details: merchant_connector_account.get_connector_wallets_details(),
         amount_captured: payment_intent
             .amount_captured
             .map(|amt| amt.get_amount_as_i64()),