Marketplace/PaymentServer

Motivation

Marketplace and AMO has an integrated payments system. This does the interaction with our payments system in the same process as the rest of the Marketplace and stores the data in the same database for several reasons this is undesirable.

This server will act as an independent server that will have it's own code base, servers and so on. Initially this will support Paypal, but if we support multiple sources, it will do that. If we ever move to PCI compliance, hopefully this will be the only piece that will need to be PCI compliant, sheltering the rest of Marketplace.

Overview

The app will be a playdoh Django app. It won't have any admin interface, it will just have an API, possibly using django-tastypie.

Netops

The server should only be accessible from the webheads. The server should be able to make requests out to Paypal, but not receive responses.

IPNs

Paypal sends a response to every transaction called an IPN. We need to handle the IPN and process that in both the marketplace and the payment server. For example on a refund, we need to process that in the payment server and if its all correct, process the refund and make sure that the receipt is invalidated (for example).

Marketplace

Marketplace will talk to the Payment Server using a REST HTTPS interface. Requests will be signed using two legged OAuth similar to the external API. A token and secret is generated on the payment server and then is propagated out to the webheads.

Logging

We'll log to the CEF log and to syslog in a similar fashion to the marketplace, however they'll be seperate logs. All logging should obfuscate key values so that we don't leak any confidential data into our logs. We will need to log the correlation ID. This is the key that Paypal needs to know in case of support questions.

statsd

Yeah let's do that so we can see how the server is running.

Data

Data will be divided in the following ways.

Marketplace

The marketplace will know:

- what an app costs or what recommended donations - what app a user has installed - what app a user has purchased and how much it cost - what refunds have been processed for which user and app - what inapp payments have been made for user and app - the notifications that the marketplace has made with an app supporting in-app payments

The marketplace will not know how to communicate with Paypal at all. It will know how to communicate with the payment server, so each web head will have the appropriate keys, stored on the file system, to access the payment server.

Payment Server

The payment server will know:

- the paypal_ids of sellers - any personal PayPal specific data of sellers or buyers - the pre-approval keys of buyers - the detailed PayPal transaction log of each purchase or each inapp purchase

The payment server will know how to communicate with Paypal. It won't send any messages to the marketplace at all, it will be marketplaces responsibility to query the server and find out what's going on.

Retention

We need to see how long we can retain data for.

Keys to victory

• Removal of the Paypal ID's from the Marketplace webheads
• No key paypal data in the Marketplace