Changelog

All notable changes to the 505pay platform APIs are documented here. Versions follow Semantic Versioning. The frontend and backend are versioned together.

Subscribe to the RSS feed for automated notifications.

---

v0.12.6 — 2026-05-11

Added

• SNAP-BI Gateway — new snap-gateway-service with 10 Bank Indonesia SNAP-compliant endpoints:
  • POST /v1.0/access-token/b2b (RSA asymmetric partner auth)
  • POST /v1.0/transfer-va/{inquiry,payment,status} (HMAC → Payments service)
  • POST /v1.0/transfer-credit/{partner_route} (HMAC → Payments service)
  • POST /v1.0/balance-inquiry, /v1.0/transaction-status-inquiry, /v1.0/transaction-history-list
  • POST /v1.0/qr/qr-mpm-generate, /v1.0/qr/qr-mpm-notify-payment
• Cryptographic signature verification: RSA asymmetric for access-token, HMAC-SHA512 for all other endpoints.
• Replay protection via X-EXTERNAL-ID uniqueness enforcement per partner per UTC day.
• 7-year audit retention (snap_audit_log) per PBI No.23/6/PBI/2021 §12.
• Per-request structured logging: partner_id, service_code, downstream_service, latency_ms.

Fixed

• E2E TRUNCATE+seed atomicity race (permissions_pkey) fixed via single-transaction seeding.
• make test-e2e-isolated serialized with -p 1 to prevent fixture race conditions.

---

v0.12.5 — 2026-05-11

Added

• Public developer docs relaunched at docs.505pay.link — Fumadocs + Next.js 16, replacing the Redocly static bundle.
• Full OpenAPI reference for all four services (Auth, Payments, POS, Recon) with 259 auto-generated endpoint pages.
• 10 cross-cutting guide pages: Quickstart, Authentication, Webhooks, Errors, Idempotency, Pagination, Rate Limits, Versioning, Sandbox, Going Live.
• 15 per-method payment guides with Mermaid sequence diagrams and webhook event tables: QRIS Dynamic/Static, VA (BCA/BNI/BRI/Mandiri/Permata), GoPay, OVO, DANA, ShopeePay, Kredivo, Akulaku, Card 3DS.
• x-codeSamples (curl / TypeScript / Python / PHP / Go) across all four service specs.
• IBM Plex Sans + JetBrains Mono self-hosted variable fonts; full CSS design token system.

Changed

• docs-console Drone pipeline now runs pnpm lint && pnpm build instead of legacy scripts/build.sh.

Removed

• scripts/add-code-samples.py one-shot Wave 1 utility.

---

v0.12.4 — 2026-05-11

Added

• make doctor / scripts/doctor.sh — preflight check for tool versions with copy-paste install commands.
• make first-run — end-to-end first-time setup (doctor → .env → JWT keys → dev stack → bootstrap admin).
• make hooks-install / lefthook.yml — opt-in git hooks (pre-commit: gofmt; pre-push: make ci).
• make version-lockstep — CI guard asserting VERSION, web/auth-console/package.json, and CHANGELOG.md stay on the same version.
• make env-drift — CI guard asserting every docker-compose.yml env var is declared in .env.example.
• scripts/README.md — reference table for every script with make target and purpose.
• Four new golangci-lint linters: errorlint, bodyclose, noctx, contextcheck.

Fixed

• Replaced all direct err == pgx.ErrNoRows and err == io.EOF sentinel comparisons with errors.Is(...) across all services.

---