MOXIE DIGITAL - PAYMENT & ADMIN SECURITY SETUP
==============================================

IMPORTANT: This secured package intentionally contains NO live secret keys.
The secrets found in the previous ZIP should be treated as exposed and ROTATED.

Set these environment variables in cPanel / hosting configuration:
- RAZORPAY_KEY_ID
- RAZORPAY_KEY_SECRET
- RAZORPAY_WEBHOOK_SECRET
- GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET (if Google login is used)
- GEMINI_API_KEY (if AI is used)
- FIREBASE_API_KEY
- FIREBASE_DATABASE_SECRET
- DB_ENCRYPTION_KEY (strong random 32+ byte value)
- ADMIN_BOOTSTRAP_PASSWORD_HASH (only needed to bootstrap a fresh database)

Razorpay webhook URL:
https://moxiedigital.in/api/payments/razorpay/webhook

Recommended Razorpay webhook events:
- payment.captured
- payment.failed
- order.paid
- refund.processed
- refund.failed

SECURITY ADDED
- CSRF tokens for browser state-changing requests
- Same-origin request checks
- HttpOnly/Secure/SameSite session cookie support
- HSTS + CSP + frame protection + permissions policy
- Authentication/payment/admin refund rate limiting
- Razorpay payment replay / duplicate payment protection
- Signed webhook processing + webhook event idempotency
- Server-side amount/currency checks
- Server-only paid/license issuance flow
- Admin security status APIs
- Admin audit log and payment event log
- Admin refund endpoint requiring enabled TOTP 2FA + fresh OTP
- 7-day refund backend enforcement
- License revoke after signed refund.processed webhook
- Secrets moved from source code to server environment

AFTER DEPLOYMENT
1. Rotate all old Razorpay / Google / Firebase / Gemini secrets.
2. Configure new values as environment variables.
3. Create a new Razorpay webhook secret and configure the webhook URL above.
4. Login as admin and enable TOTP 2FA before using sensitive payment actions.
5. Test one low-value payment and one refund in Razorpay test mode first.
