CoinGate migration

# Migrate CoinGate to MakePay

Use this as the working brief for an AI coding agent. Replace CoinGate order creation, callback-triggered status reconciliation, order-state handling, callback token checks, and provider SDK/API usage with MakePay payment links, signed webhooks, and the SDK that matches the codebase.

## Target MakePay SDK

Choose one install command for the stack being migrated:

```bash
npm install @makecrypto/makepay
composer require makepay/makepay-php
go get github.com/makecryptoio/makepay-go
pip install makepay
cargo add makepay
```

For JVM services use:

```kotlin
implementation("io.makecrypto:makepay:0.1.0")
```

For Swift Package Manager use:

```swift
.package(url: "https://github.com/makecryptoio/makepay-swift-sdk.git", from: "0.3.0")
```

## Migration map

- CoinGate `POST /api/v2/orders` order creation -> MakePay `POST /api/partner/v1/makepay/payment-links` or the SDK create-payment-link helper.
- CoinGate `payment_url` -> MakePay `paymentLink.publicUrl`.
- CoinGate `id` or provider order ID -> MakePay `paymentLink.uid`; keep the old CoinGate order ID in a migration alias table while orders are in flight.
- CoinGate `order_id`, `title`, and `description` -> MakePay `merchantOrderId`, `label`, and `description`.
- CoinGate `price_amount` and `price_currency` -> MakePay `payload.amount` and `payload.currency` or exact `payload.asset`.
- CoinGate `receive_currency` -> MakePay destination asset selection when the merchant must force settlement currency or chain.
- CoinGate `callback_url` and callback `token` -> MakePay webhook callback URL plus `x-makepay-signature` verification.
- CoinGate `success_url` and `cancel_url` -> MakePay success/failure redirect settings or hosted-page return handling.
- CoinGate API access token/API credentials -> MakePay `X-MakeCrypto-Key-Id` and `X-MakeCrypto-Key-Secret` headers.
- CoinGate callback plus token/IP allowlist and follow-up order fetch -> MakePay signed webhook verification over the raw request body.
- CoinGate statuses `paid`, `pending`, `expired`, `invalid`, and `canceled` -> MakePay `makepay.payment.status_changed` events and normalized order states.

## Agent prompt: inventory

You are migrating this repository from CoinGate to MakePay. Search for CoinGate API clients, `coingate.com`, `/api/v2/orders`, `payment_url`, `callback_url`, callback `token`, `success_url`, `cancel_url`, `order_id`, `price_amount`, `price_currency`, `receive_currency`, CoinGate access tokens, callback handlers, IP allowlists, follow-up order status fetches, and enum handling for `paid`, `pending`, `expired`, `invalid`, and `canceled`. Return a file-by-file migration plan with the exact functions that create orders, store provider IDs, redirect buyers, receive callbacks, fetch order status, and reconcile order status. Do not edit files yet.

## Agent prompt: replace order creation

Implement MakePay payment-link creation in the existing CoinGate order creation path. Use the official MakePay SDK for this stack when available; otherwise call `POST /api/partner/v1/makepay/payment-links`. Map CoinGate `price_amount` to `payload.amount`, `price_currency` or settlement requirements to `payload.currency` or `payload.asset`, `order_id` to `merchantOrderId`, and `title`/`description` to `label`/`description`. Store `paymentLink.uid` and `paymentLink.publicUrl`, and keep nullable legacy CoinGate order ID fields for historical records.

## Agent prompt: replace callback verification

Replace CoinGate callback-triggered reconciliation with MakePay webhook verification. For legacy CoinGate orders, keep the callback token/IP allowlist and follow-up order fetch rule before fulfillment. For new MakePay events, read the exact raw request body before JSON parsing, parse `x-makepay-signature`, verify timestamp tolerance and HMAC digest with the MakePay webhook secret, then process only trusted events. Treat `makepay.payment.status_changed` as the primary order reconciliation event and make updates idempotent by delivery ID and payment-link UID.

## Agent prompt: normalize statuses

Map legacy CoinGate statuses explicitly during cutover. `pending` should not grant goods by default. `paid` can complete the order only after the status was confirmed through the trusted CoinGate status fetch. `expired` and `canceled` should close the legacy payment without marking the order paid. `invalid` should go to manual review or the existing risk/failure path.

## Agent prompt: dual-run cutover

Add a migration flag so newly created orders use MakePay while existing CoinGate orders can still receive callbacks until they are paid, expire, become invalid, or are canceled. Route callbacks by provider, keep provider-specific IDs separate, and add logs that include provider, order ID, payment UID, delivery ID, legacy CoinGate order ID, and normalized status. Remove CoinGate credentials and callback token/IP allowlist code only after there are no open legacy orders.

## Agent prompt: tests

Add or update tests for MakePay payment-link creation, failed authentication, webhook signature rejection, successful `makepay.payment.status_changed` handling, duplicate webhook delivery idempotency, legacy CoinGate callback routing during cutover, CoinGate `pending` not granting goods, trusted `paid` handling, invalid/expired/canceled handling, callback token rejection, and buyer redirect URL generation. Use mocked MakePay SDK/API responses; do not hit production APIs in tests.

## Verification checklist

- A new order creates exactly one MakePay payment link and stores `paymentLink.uid`.
- The buyer redirect uses `paymentLink.publicUrl` instead of CoinGate `payment_url`.
- Webhook verification fails closed when `x-makepay-signature` is missing, stale, or invalid.
- Webhooks are idempotent by delivery ID and cannot regress a completed order.
- Legacy CoinGate callbacks remain trigger-only and fetch order status before fulfillment.
- Legacy `pending`, `paid`, `expired`, `invalid`, and `canceled` paths are explicitly tested.
- Existing CoinGate orders remain reconcilable until the migration flag is fully removed.