
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
github.com/jeffgrover/payment-api
Advanced tools
A lightweight payment processing API built with Go, Huma, and SQLite, inspired by Stripe and Square but with a more focused feature set.
The API is designed with a clean, modular architecture:
graph TD
A[Client] -->|HTTP Requests| B[API Server]
B -->|Responses| A
B -->|API Documentation| C[SwaggerUI]
B -->|Database Operations| D[SQLite Database]
subgraph "API Server Components"
E[Huma API Framework]
F[Request Handlers]
G[Data Models]
H[Validation]
end
B --- E
E --- F
F --- G
F --- H
The typical payment workflow looks like this:
sequenceDiagram
participant C as Client
participant A as API
participant D as Database
C->>A: Create Customer
A->>D: Store Customer
D-->>A: Confirm
A-->>C: Customer Object
C->>A: Create Payment Method
A->>D: Store Payment Method
D-->>A: Confirm
A-->>C: Payment Method Object
C->>A: Create Payment
A->>A: Validate Request
A->>D: Store Payment
D-->>A: Confirm
A-->>C: Payment Object
Note over C,A: Optional
C->>A: Create Refund
A->>A: Validate Payment
A->>D: Store Refund
D-->>A: Confirm
A-->>C: Refund Object
payment-api/
├── cmd/
│ └── server/
│ └── main.go # Application entry point
├── internal/
│ ├── api/
│ │ ├── api.go # API setup and configuration
│ │ ├── api_test.go # API unit tests
│ │ ├── customers.go # Customer endpoints
│ │ ├── payments.go # Payment endpoints
│ │ ├── methods.go # Payment method endpoints
│ │ └── refunds.go # Refund endpoints
│ ├── models/
│ │ ├── customer.go # Customer model
│ │ ├── customer_test.go # Customer model unit tests
│ │ ├── payment.go # Payment model
│ │ ├── method.go # Payment method model
│ │ └── refund.go # Refund model
│ └── db/
│ ├── db.go # Database setup and operations
│ └── db_test.go # Database unit tests
├── payments.db # SQLite database file (created at runtime)
├── go.mod # Go module definition
├── go.sum # Go module checksums
├── run.sh # Convenience script for running the application
├── e2e_test.sh # End-to-end test script
└── README.md # This documentation
git clone https://github.com/jeffgrover/payment-api.git
cd payment-api
go mod tidy
You can use the provided shell script for convenience:
# Make the script executable (if needed)
chmod +x run.sh
# Run the application
./run.sh server
Or run it directly with Go:
go run cmd/server/main.go
The server will start on port 8080, and you'll see output like:
INF Starting Payments API server
INF Starting API server addr=:8080
INF API documentation available at docs=http://localhost:8080/docs
Open your browser and navigate to http://localhost:8080/docs to explore the API using the SwaggerUI interface.
POST /v1/customers - Create a customerGET /v1/customers/{id} - Retrieve a customerGET /v1/customers - List customersPOST /v1/payment_methods - Create a payment methodGET /v1/payment_methods/{id} - Retrieve a payment methodGET /v1/payment_methods - List payment methodsPOST /v1/payments - Create a paymentGET /v1/payments/{id} - Retrieve a paymentGET /v1/payments - List paymentsPOST /v1/refunds - Create a refundGET /v1/refunds/{id} - Retrieve a refundGET /v1/refunds - List refundscurl -X POST http://localhost:8080/v1/customers \
-H "Content-Type: application/json" \
-d '{"email":"customer@example.com","name":"John Doe"}'
curl -X POST http://localhost:8080/v1/payment_methods \
-H "Content-Type: application/json" \
-d '{
"customer_id":"cus_1234567890",
"type":"card",
"card_number":"4242424242424242",
"exp_month":12,
"exp_year":2025,
"cvc":"123"
}'
curl -X POST http://localhost:8080/v1/payments \
-H "Content-Type: application/json" \
-d '{
"amount":2000,
"currency":"usd",
"customer_id":"cus_1234567890",
"payment_method_id":"pm_1234567890",
"description":"Payment for order #1234"
}'
The run.sh script provides several commands to make development easier:
# Run the application
./run.sh server
# Build the application
./run.sh build
# Run unit tests
./run.sh test
# Run end-to-end tests (handles setup/teardown automatically)
./run.sh e2e
# Reset the database (delete payments.db)
./run.sh reset-db
# Clean build artifacts
./run.sh clean
# Run with hot reload (using Air)
./run.sh dev
# Show help
./run.sh help
For a better development experience, you can use Air for hot reloading:
# Install Air
go install github.com/cosmtrek/air@latest
# Run with Air directly
air
# Or use the run script
./run.sh dev
# Using the run script
./run.sh build
# Or directly with Go
go build -o payment-api ./cmd/server
The project includes both unit tests and end-to-end tests.
Unit tests cover the core functionality of the API, models, and database operations:
# Using the run script
./run.sh test
# Or directly with Go
go test ./...
The end-to-end tests simulate a complete user flow, from creating a customer to processing a refund:
# Using the run script
./run.sh e2e
# Or directly
./e2e_test.sh
The e2e test script will:
Automatically handle setup and teardown:
Test the complete payment workflow:
This provides a comprehensive test of the entire API workflow without requiring a test framework.
If you need to start with a clean database manually, you can use the reset-db command:
./run.sh reset-db
This will delete the payments.db file, which will be recreated the next time you start the application.
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.