Skip to content

feat: close 12 production readiness gaps — locales, legal pages, email templates, multi-region, webhooks, rate limiting#17

Merged
munisp merged 10 commits into
devin/1779302835-typescript-strict-fixesfrom
devin/1781972173-production-readiness-gaps
Jun 20, 2026
Merged

feat: close 12 production readiness gaps — locales, legal pages, email templates, multi-region, webhooks, rate limiting#17
munisp merged 10 commits into
devin/1779302835-typescript-strict-fixesfrom
devin/1781972173-production-readiness-gaps

Conversation

@devin-ai-integration

@devin-ai-integration devin-ai-integration Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Summary

Closes 12 production readiness gaps identified during full platform audit (4 CRITICAL, 4 HIGH, 4 MEDIUM). 2,209 lines across 19 files, 0 TypeScript errors.

CRITICAL

  1. Chinese (zh) + Hindi (hi) locales — client/src/locales/zh.json (338 keys), hi.json (316 keys) covering all 13 UI sections
  2. Legal pages — TermsOfService.tsx, PrivacyPolicy.tsx, CookiePolicy.tsx wired into App.tsx with lazy-loaded routes (/terms-of-service, /privacy-policy, /cookie-policy)
  3. HTML email templates — server/email-templates/{transaction-receipt,kyc-status,security-alert}.html + server/lib/emailTemplates.ts renderer with {{VAR}} substitution: 
    renderTransactionReceipt({ status, reference, fromAmount, ... }) → HTML string
  4. Multi-region Terraform — DR region af-south-1 (Cape Town) with VPC, EKS standby cluster (min 2 nodes), cross-region RDS read replica, ElastiCache Redis, S3 replication, Global Accelerator. Gated by var.enable_multi_region.

HIGH

  1. pt.json expanded — 101 → 340+ keys (8% → 80%+ coverage across common, nav, dashboard, wallet, sendMoney, transactions, kyc, profile, security, notifications, settings, legal, errors)
  2. Mojaloop webhook forwarding — Go connector (services/mojaloop-connector/main.go) now calls forwardToCore(cfg, transferId, body) → POST /api/webhooks/mojaloop on Node.js core. New TS handler advances partner_sent → completed/failed.
  3. Corridor kill switches — featureFlags.disableCorridor({ from: "CAD", to: "CNY", reason }) / enableCorridor / corridorStates / isCorridorActive endpoints. In-memory Map<string, CorridorState> for instant toggling without DB writes.
  4. SWIFT gpi webhook — POST /api/webhooks/swift handles camt.054 notifications with ACSC/ACCC → completed, RJCT → failed, ACSP → partner_sent mapping.

MEDIUM

  1. OpenAPI docs — GET /api/docs serves Swagger UI, GET /api/docs.json serves OpenAPI 3.1 spec (dynamic import of generateOpenApiSpec())
  2. Offline queue wired into mobile SendMoney — RN: NetInfo connectivity check → enqueue() from offlineQueue.ts. Flutter: InternetAddress.lookup → OfflineQueue.enqueue() from offline_queue.dart.
  3. K8s HPA tuning — 2 → 4 HPAs (API, transfer-engine, webhook-processor, fraud-scorer). Custom metrics (http_requests_per_second, webhook_queue_depth, fraud_score_latency_p95). API: CPU 70→65%, min 2→3, max 20→25. Transfer: CPU 60→55%, min 2→3.
  4. Webhook rate limiting — webhookRateLimiter middleware (100 req/min per IP, sliding window) applied to all /api/webhooks/* endpoints via app.use(). Stale entry cleanup every 5 min.

Link to Devin session: https://app.devin.ai/sessions/64d054ae77da41e9a2b74d8593fa635c
Requested by: @munisp

devin-ai-integration Bot and others added 10 commits June 20, 2026 14:39
@devin-ai-integration @munisp
fix: close all 14 audit gaps in $35K CAD→NGN transfer flow
56ad23d 
HIGH severity (4 gaps closed):
- State machine AML check: CTR_REQUIRED and TRAVEL_RULE are now
  informational (non-blocking). Only SAR_REVIEW/EDD_REQUIRED block
  transfers ≥$10K. Previously ALL $10K+ transfers were auto-failed.
- Payment rail failure: now fatal — transfer marked 'failed' with
  refund note if Mojaloop/PIX/UPI/SWIFT disbursement fails.
  Previously errors were swallowed and transfer marked 'partner_sent'.
- TigerBeetle ledger: write is now awaited with critical audit log
  on failure, not fire-and-forget. Reconciliation alerts created.
- Compliance auto-filing: new complianceAutoFiling module auto-triggers
  FINTRAC CTR, FATF Travel Rule (IVMS101), and NFIU inbound reports
  during transfer flow. Creates compliance_filings DB table.

MEDIUM severity (6 gaps closed):
- 2FA check: fail-closed when DB unavailable (was: skip 2FA entirely)
- KYC tier limits: fail-closed when DB unavailable (was: skip limits)
- Velocity check: fail-closed when DB unavailable (was: allow all)
- Auto-completion removed: transfers stay in partner_sent until webhook
  confirmation from payment partner (was: auto-advance after delay)
- Mark Lane FX bridge: CAD→African currencies now route through Mark
  Lane instead of generic Mojaloop for better FX rates + settlement
- Reconciliation scheduler: automated daily reconciliation checks
  wallet balances, stuck transfers, failed transfers, ledger sync

LOW severity (4 gaps closed):
- Fee corridor: uses sender's actual country from currency mapping
  instead of hardcoded 'NG' (was: always NG regardless of sender)
- FX rate locking: quote timestamp captured for audit trail
- Idempotency guard: duplicate transfers rejected within 24h window
  when idempotencyKey provided
- 2FA enrollment: required for transfers ≥$10K USD if user hasn't
  enabled TOTP yet

0 TypeScript errors. No test regressions.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
@munisp @devin-ai-integration
Merge pull request #12 from munisp/devin/1781965882-fix-all-audit-gaps
d726690 
HIGH severity (4 gaps closed):
- State machine AML check: CTR_REQUIRED and TRAVEL_RULE are now
  informational (non-blocking). Only SAR_REVIEW/EDD_REQUIRED block
  transfers ≥$10K. Previously ALL $10K+ transfers were auto-failed.
- Payment rail failure: now fatal — transfer marked 'failed' with
  refund note if Mojaloop/PIX/UPI/SWIFT disbursement fails.
  Previously errors were swallowed and transfer marked 'partner_sent'.
- TigerBeetle ledger: write is now awaited with critical audit log
  on failure, not fire-and-forget. Reconciliation alerts created.
- Compliance auto-filing: new complianceAutoFiling module auto-triggers
  FINTRAC CTR, FATF Travel Rule (IVMS101), and NFIU inbound reports
  during transfer flow. Creates compliance_filings DB table.

MEDIUM severity (6 gaps closed):
- 2FA check: fail-closed when DB unavailable (was: skip 2FA entirely)
- KYC tier limits: fail-closed when DB unavailable (was: skip limits)
- Velocity check: fail-closed when DB unavailable (was: allow all)
- Auto-completion removed: transfers stay in partner_sent until webhook
  confirmation from payment partner (was: auto-advance after delay)
- Mark Lane FX bridge: CAD→African currencies now route through Mark
  Lane instead of generic Mojaloop for better FX rates + settlement
- Reconciliation scheduler: automated daily reconciliation checks
  wallet balances, stuck transfers, failed transfers, ledger sync

LOW severity (4 gaps closed):
- Fee corridor: uses sender's actual country from currency mapping
  instead of hardcoded 'NG' (was: always NG regardless of sender)
- FX rate locking: quote timestamp captured for audit trail
- Idempotency guard: duplicate transfers rejected within 24h window
  when idempotencyKey provided
- 2FA enrollment: required for transfers ≥$10K USD if user hasn't
  enabled TOTP yet

0 TypeScript errors. No test regressions.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Patrick Munis <pmunis@gmail.com>
@devin-ai-integration @munisp
fix: close 8 audit gaps across 20 transfer scenarios
5479055 
CRITICAL:
- Fix from_amount column reference in all raw SQL queries (SUM(from_amount) → SUM("fromAmount"))
- Fix ML fraud scorer hardcoded source_country: "NG" → derive from sender currency

HIGH:
- Add PIX webhook handler for Brazil corridor settlement completion
- Add UPI webhook handler for India corridor settlement completion
- Add advanceTransferState call to Mojaloop webhook on COMMITTED

MEDIUM:
- Add 8 missing jurisdictions to compliance auto-filing (BRL, INR, TZS, UGX, XOF, XAF, MWK, ZMW)
- Add inbound reporting for KE (CBK), GH (BoG), ZA (FIC), TZ (BoT), BR (COAF), IN (RBI)
- Add travel rule thresholds for 8 new jurisdictions

LOW:
- Add 18 missing corridor fee configs (CA, US, UK, EU diaspora corridors + PIX/UPI)
- Fix velocity check catch-block fail-open → fail-closed on DB query errors

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
@munisp @devin-ai-integration
Merge pull request #13 from munisp/devin/1781967721-fix-scenario-gaps
2529902 
CRITICAL:
- Fix from_amount column reference in all raw SQL queries (SUM(from_amount) → SUM("fromAmount"))
- Fix ML fraud scorer hardcoded source_country: "NG" → derive from sender currency

HIGH:
- Add PIX webhook handler for Brazil corridor settlement completion
- Add UPI webhook handler for India corridor settlement completion
- Add advanceTransferState call to Mojaloop webhook on COMMITTED

MEDIUM:
- Add 8 missing jurisdictions to compliance auto-filing (BRL, INR, TZS, UGX, XOF, XAF, MWK, ZMW)
- Add inbound reporting for KE (CBK), GH (BoG), ZA (FIC), TZ (BoT), BR (COAF), IN (RBI)
- Add travel rule thresholds for 8 new jurisdictions

LOW:
- Add 18 missing corridor fee configs (CA, US, UK, EU diaspora corridors + PIX/UPI)
- Fix velocity check catch-block fail-open → fail-closed on DB query errors

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Patrick Munis <pmunis@gmail.com>
@devin-ai-integration @munisp
feat: add CIPS rail support + enforce bi-directional corridors across…
f1d8524 
… all rails

CIPS (China Cross-Border Interbank Payment System):
- Go: Enhanced go-cips-adapter to forward pacs.002 settlement callbacks to Node.js core
- Rust: New rust-cips-crypto service for SM2/SM3 cryptographic signing (PBOC standard)
- Python: New python-pboc-compliance engine (LTR/STR reporting, SAFE quota checks)
- TypeScript: CIPS webhook handler (POST /api/webhooks/cips) with ACSC/RJCT handling
- 16 CIPS corridor configs (US/CA/UK/EU/NG/KE/ZA/GH ↔ CN, all bi-directional)
- CNY/CNH added to jurisdiction mapping, ML fraud scorer, fee calculator
- PBoC inbound reporting (CNY >200K) + SAFE cross-border declaration

Bi-directional corridors:
- Added 24 missing reverse corridors (was 28 configs → now 64)
- All 6 rails (Mojaloop, Mark Lane, PIX, UPI, SWIFT, CIPS) are fully bi-directional
- Every A→B corridor now has a matching B→A corridor

0 TypeScript errors, 0 lint errors.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
@devin-ai-integration @munisp
fix: eliminate hardcoded country values from ML fraud scorer + add gr…
98c540f 
…aduated risk tiers

Fixes 7 issues in the ML fraud scoring pipeline:

1. Temporal fraud activity: source_country derived from input.fromCurrency
   (was hardcoded "NG" — every sender scored as Nigerian)
2. Temporal gRPC fraud call: fromCountry derived dynamically (was "NG")
3. Temporal fraud activity: user_kyc_level looked up from DB (was hardcoded 1)
4. P2P instant: receiverCountry initialized to "XX" (was "NG")
5. detectCountryFromPhone(): expanded from 9 to 30 prefixes, default "XX"
   (added CN, TZ, UG, ZM, MW, SN, CM, CI, RW, JP, KR, DE, FR, ES, IT,
    NL, SE, NO, AU, NZ, AE, SA, EG)
6. buildFeatures(): corridor_fraud_rate_30d + corridor_avg_amount now
   accepted as optional params (were static 0.02/800)
7. Country risk scoring: 4-tier graduated system replaces binary 85/20:
   HIGH_RISK=85, ELEVATED_RISK=60, MODERATE_RISK=40, LOW_RISK=15

0 TypeScript errors, 0 lint errors.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
@munisp @devin-ai-integration
Merge pull request #15 from munisp/devin/1781970121-fix-ml-fraud-hard…
675f618 
…coding

Fixes 7 issues in the ML fraud scoring pipeline:

1. Temporal fraud activity: source_country derived from input.fromCurrency
   (was hardcoded "NG" — every sender scored as Nigerian)
2. Temporal gRPC fraud call: fromCountry derived dynamically (was "NG")
3. Temporal fraud activity: user_kyc_level looked up from DB (was hardcoded 1)
4. P2P instant: receiverCountry initialized to "XX" (was "NG")
5. detectCountryFromPhone(): expanded from 9 to 30 prefixes, default "XX"
   (added CN, TZ, UG, ZM, MW, SN, CM, CI, RW, JP, KR, DE, FR, ES, IT,
    NL, SE, NO, AU, NZ, AE, SA, EG)
6. buildFeatures(): corridor_fraud_rate_30d + corridor_avg_amount now
   accepted as optional params (were static 0.02/800)
7. Country risk scoring: 4-tier graduated system replaces binary 85/20:
   HIGH_RISK=85, ELEVATED_RISK=60, MODERATE_RISK=40, LOW_RISK=15

0 TypeScript errors, 0 lint errors.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Patrick Munis <pmunis@gmail.com>
@devin-ai-integration @munisp
feat: close 10 UI/UX parity gaps — SendTo pages for China/Brazil/Indi…
0aee74a 
…a, graduated risk tiers, PBoC/SAFE compliance, currency support

PWA (Web):
- New SendToChina.tsx (CIPS corridor landing page)
- New SendToBrazil.tsx (PIX corridor landing page)
- New SendToIndia.tsx (UPI corridor landing page)
- Routes wired in App.tsx (/send-to-china, /send-to-brazil, /send-to-india)
- currency.ts: added CNY/CNH/BRL/INR/CAD/AUD/JPY symbols + locales
- FraudDetectionV2: 4-tier graduated country risk reference card
- ComplianceReporting: PBoC LTR, SAFE, NFIU STR, FINTRAC CTR report types + jurisdiction threshold table
- Updated relatedCorridors on SendToNigeria, SendToKenya, SendToSouthAfrica

React Native:
- New SendToChinaScreen, SendToBrazilScreen, SendToIndiaScreen
- All 15 SendTo screens registered in RootNavigator.tsx (was missing)

Flutter:
- New send_to_china_screen.dart, send_to_brazil_screen.dart, send_to_india_screen.dart
- Country-specific content (CIPS/PIX/UPI info, payment methods, conversion)

Backend:
- productionV84.ts: expanded compliance report enum with PBOC_LTR, SAFE_CROSS_BORDER, NFIU_STR, FINTRAC_CTR

0 TypeScript errors.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
@munisp @devin-ai-integration
Merge pull request #16 from munisp/devin/1781970796-ui-parity-gaps
a3baa07 
PWA (Web):
- New SendToChina.tsx (CIPS corridor landing page)
- New SendToBrazil.tsx (PIX corridor landing page)
- New SendToIndia.tsx (UPI corridor landing page)
- Routes wired in App.tsx (/send-to-china, /send-to-brazil, /send-to-india)
- currency.ts: added CNY/CNH/BRL/INR/CAD/AUD/JPY symbols + locales
- FraudDetectionV2: 4-tier graduated country risk reference card
- ComplianceReporting: PBoC LTR, SAFE, NFIU STR, FINTRAC CTR report types + jurisdiction threshold table
- Updated relatedCorridors on SendToNigeria, SendToKenya, SendToSouthAfrica

React Native:
- New SendToChinaScreen, SendToBrazilScreen, SendToIndiaScreen
- All 15 SendTo screens registered in RootNavigator.tsx (was missing)

Flutter:
- New send_to_china_screen.dart, send_to_brazil_screen.dart, send_to_india_screen.dart
- Country-specific content (CIPS/PIX/UPI info, payment methods, conversion)

Backend:
- productionV84.ts: expanded compliance report enum with PBOC_LTR, SAFE_CROSS_BORDER, NFIU_STR, FINTRAC_CTR

0 TypeScript errors.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Patrick Munis <pmunis@gmail.com>
@devin-ai-integration @munisp
feat: close 12 production readiness gaps — locales, legal pages, emai…
5eb1e78 
…l templates, multi-region, webhooks, rate limiting

CRITICAL:
- Gap 1: Add Chinese (zh) and Hindi (hi) locale files (338/316 keys)
- Gap 2: Create Terms of Service, Privacy Policy, Cookie Policy pages with routes
- Gap 3: Create HTML email templates (transaction receipt, KYC status, security alert) with renderer
- Gap 4: Add multi-region Terraform config (af-south-1 DR: VPC, EKS, RDS replica, Redis, S3, Global Accelerator)

HIGH:
- Gap 5: Expand pt.json from 101 to 340+ keys (8% → 80%+ coverage)
- Gap 6: Add Mojaloop webhook forwarding from Go connector to Node.js core + TS handler
- Gap 7: Add corridor kill switch API (disableCorridor/enableCorridor/corridorStates)
- Gap 8: Add SWIFT gpi webhook handler (camt.054 ACSC/RJCT/ACSP notifications)

MEDIUM:
- Gap 9: Serve OpenAPI/Swagger docs at /api/docs and /api/docs.json
- Gap 10: Wire offline queue into mobile SendMoney (RN: NetInfo+AsyncStorage, Flutter: SQLite)
- Gap 11: Tune K8s HPA — 4 HPAs (API/transfer/webhook/fraud), custom metrics, load-test-derived thresholds
- Gap 12: Add per-IP rate limiting (100/min) on all webhook endpoints with cleanup interval

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
@devin-ai-integration

devin-ai-integration Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor Author
Original prompt from Patrick

https://drive.google.com/file/d/14K-94cZoOVgiYCUA-VympU-4_8IBqv2d/view?usp=sharing
extract the contents of the archive. List all the features of the platform

@devin-ai-integration

devin-ai-integration Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment, CI, and merge conflict monitoring

@munisp munisp merged commit a964cd3 into devin/1779302835-typescript-strict-fixes Jun 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@munisp