Architecting Twaicy: How We Built a Zero-Commission Restaurant Commerce Monolith with NestJS, WhatsApp Bots, and UPI Webhooks

twicy/
├── src/
│   ├── app/                # Next.js 16 App Router (Storefront, Merchant KDS, Admin)
│   ├── features/           # Modular domain UI (Cart, FoodFlex, Dynamic Website Builder)
│   ├── services/           # Shared client utilities & TwaicySoundEngine audio chime
│   └── server/             # NestJS 11 Core Enterprise Backend
│       ├── modules/        # Auth, Store, Product, Order, Payment, WhatsApp, Loyalty
│       └── main.ts         # NestJS bootstrap & internal HTTP listener (port 3001)
├── prisma/                 # Authoritative PostgreSQL schema & migrations
└── e2e/                    # Playwright end-to-end regression suites

                       ┌──────────────────────┐
                       │   CUSTOMER CHECKOUT  │
                       └──────────┬───────────┘
                                  │
                 ┌────────────────┴────────────────┐
                 │                                 │
                 ▼                                 ▼
      [Mode A: PhonePe PG]             [Mode B: Counter UPI QR]
      Instant UPI Redirect             Zero Setup Soundbox Standee
                 │                                 │
      Webhook SHA-256 HMAC Callback    12-Digit Bank UTR Input
                 │                                 │
                 └────────────────┬────────────────┘
                                  │
                                  ▼
                   ┌──────────────────────────────┐
                   │  ORDER CONFIRMED & KITCHEN   │
                   │    AUDIO CHIME DISPATCHED    │
                   └──────────────────────────────┘

// payment-webhook.service.ts
import crypto from 'crypto';
import { Injectable, UnauthorizedException } from '@nestjs/common';

@Injectable()
export class PaymentWebhookService {
  verifyPhonePeChecksum(
    payloadBase64: string,
    checksumHeader: string,
    saltKey: string,
    saltIndex: string
  ): boolean {
    const stringToHash = `${payloadBase64}/v3/transaction/callback${saltKey}`;
    const calculatedHash = crypto.createHash('sha256').update(stringToHash).digest('hex');
    const expectedChecksum = `${calculatedHash}###${saltIndex}`;

    const isValid = crypto.timingSafeEqual(
      Buffer.from(checksumHeader),
      Buffer.from(expectedChecksum)
    );

    if (!isValid) {
      throw new UnauthorizedException('PhonePe signature mismatch');
    }
    return true;
  }
}

// orders.service.ts
export async function getStoreOrder(storeId: string, orderId: string) {
  // BANNED: findUnique({ where: { id: orderId } })
  // ENFORCED: Strict compound key check with storeId
  const order = await prisma.order.findFirst({
    where: {
      id: orderId,
      storeId: storeId, // Guaranteed zero cross-tenant IDOR leakage
    },
    include: { items: true },
  });

  if (!order) {
    throw new NotFoundException('Order not found for this store');
  }
  return order;
}

// twaicy-sound-engine.ts
export class TwaicySoundEngine {
  private ctx: AudioContext | null = null;

  public playNewOrderChime() {
    if (!this.ctx) {
      this.ctx = new (window.AudioContext || (window as any).webkitAudioContext)();
    }
    
    // Polyphonic dual-tone chime (587.33 Hz D5 -> 880.00 Hz A5)
    const osc1 = this.ctx.createOscillator();
    const gain = this.ctx.createGain();

    osc1.type = 'sine';
    osc1.frequency.setValueAtTime(587.33, this.ctx.currentTime);
    osc1.frequency.exponentialRampToValueAtTime(880.00, this.ctx.currentTime + 0.35);

    gain.gain.setValueAtTime(0.8, this.ctx.currentTime);
    gain.gain.exponentialRampToValueAtTime(0.01, this.ctx.currentTime + 0.8);

    osc1.connect(gain);
    gain.connect(this.ctx.destination);

    osc1.start();
    osc1.stop(this.ctx.currentTime + 0.85);
  }
}