feat: Payment gateway — PalmPay manual transfer + Gmail IMAP verification

DATABASE:
- payment_orders table: order_id, buyer info, expected_amount (with unique
decimal suffix), status (pending → awaiting_verification → matched/expired),
matched_email_id (prevents reuse)
- payment_rate_limits table: 1 confirm per order, 3 per IP per 10 min

EDGE FUNCTION (payment):
- create_order: generates unique order_id + unique expected_amount (base + 0.01-0.99 suffix)
- confirm_sent: validates + rate-limits, then triggers background Gmail IMAP polling
that runs every 30s for up to 10 minutes, searching for PalmPay alert emails
that match the exact amount
- check_status: returns only status + message (no email/transaction details)

GMAIL IMAP:
- Connects to imap.gmail.com:993 via TLS
- Searches INBOX for unread emails FROM 'palmpay' in last 24h
- Parses amount from email body (₦5,000.23 format)
- Matches against expected_amount (exact match including decimal suffix)
- Marks matched email as read (SEEN flag)
- Checks matched_email_id to prevent reusing the same email for two orders

SECURITY:
- GMAIL_EMAIL, GMAIL_APP_PASSWORD read from env vars only — never returned or logged
- check_status returns only status, no transaction details
- Rate limiting on confirm_sent (1 per order, 3 per IP per 10 min)
- Input validation on all endpoints

FRONTEND (payment.html):
- 3-step flow: Create order → Transfer to PalmPay → Auto-verify
- Step 1: buyer enters name/email/phone, sees order summary
- Step 2: shows exact amount (with unique decimal), PalmPay account details, copy button
- Step 3: polls check_status every 5s, shows spinner + status messages
- Success: green checkmark + link to orders
- Timeout: shows WhatsApp support fallback link
- 30-minute countdown timer

ENV VARS NEEDED (set as placeholders — user must update in Supabase dashboard):
- GMAIL_EMAIL: the Gmail address that receives PalmPay alerts
- GMAIL_APP_PASSWORD: Gmail app password (Settings → Security → 2FA → App passwords)
- PALMPAY_ACCOUNT_NAME: the name on the PalmPay account
- PALMPAY_ACCOUNT_NUMBER: the PalmPay account number

js/config/edge-functions.js

@@ -331,6 +331,13 @@
             unlinkPhone:      (phone)      => call('cross-platform', { op: 'unlink_phone', phone }),
         },
 
+        // ---- Payment Gateway (PalmPay verification) ----
+        payment: {
+            createOrder: (data)  => call('payment', { op: 'create_order', ...data }),
+            confirmSent: (orderId) => call('payment', { op: 'confirm_sent', orderId }),
+            checkStatus: (orderId) => call('payment', { op: 'check_status', orderId }),
+        },
+
         telegram: {
             channelInfo: ()                => call('telegram', { op: 'channel_info' }),
             recent:     ()                 => call('telegram', { op: 'recent' }),

payment.html

@@ -0,0 +1,338 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Payment · Cellex</title>
+  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+  <script src="https://cdn.tailwindcss.com"></script>
+  <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&family=Sora:wght@600;700;800&display=swap" rel="stylesheet">
+  <script src="js/config/edge-functions.js?v=2"></script>
+  <style>
+    * { margin:0; padding:0; box-sizing:border-box; font-family:'Plus Jakarta Sans',sans-serif; }
+    body { background:#f8fafc; color:#0f172a; }
+    .pay-card { background:#fff; border-radius:20px; box-shadow:0 4px 20px rgba(0,212,255,0.08); padding:2rem; border:1px solid rgba(0,212,255,0.1); }
+    .btn-cyan { background:linear-gradient(135deg,#00d4ff,#0891b2); color:#0f172a; font-weight:700; transition:all 0.3s; }
+    .btn-cyan:hover { box-shadow:0 0 30px rgba(0,212,255,0.4); transform:translateY(-1px); }
+    .btn-cyan:disabled { opacity:0.5; cursor:not-allowed; transform:none; box-shadow:none; }
+    .amount-box { background:linear-gradient(135deg,#0f172a,#1e293b); border-radius:16px; padding:1.5rem; text-align:center; }
+    .amount-big { font-size:2.5rem; font-weight:800; color:#00d4ff; font-family:'Sora',sans-serif; }
+    .step-circle { width:32px; height:32px; border-radius:50%; background:#e2e8f0; color:#64748b; display:flex; align-items:center; justify-content:center; font-weight:700; font-size:0.85rem; flex-shrink:0; }
+    .step-circle.active { background:linear-gradient(135deg,#00d4ff,#0891b2); color:#0f172a; }
+    .step-circle.done { background:#22c55e; color:#fff; }
+    .spinner { width:20px; height:20px; border:3px solid rgba(0,212,255,0.2); border-top-color:#00d4ff; border-radius:50%; animation:spin 0.8s linear infinite; }
+    @keyframes spin { to { transform:rotate(360deg); } }
+    .logo-text { background:linear-gradient(135deg,#00d4ff,#0891b2); -webkit-background-clip:text; -webkit-text-fill-color:transparent; background-clip:text; }
+    .copy-btn { background:#f1f5f9; border:none; padding:0.4rem 0.8rem; border-radius:8px; cursor:pointer; font-size:0.8rem; color:#0891b2; transition:all 0.2s; }
+    .copy-btn:hover { background:#e0f2fe; }
+    .status-pending { color:#f59e0b; }
+    .status-checking { color:#00d4ff; }
+    .status-matched { color:#22c55e; }
+    .status-expired { color:#ef4444; }
+  </style>
+</head>
+<body>
+  <div id="nav-mount"></div>
+  <script src="js/load-navbar.js"></script>
+
+  <main class="max-w-lg mx-auto px-4 py-6 pb-24 md:pb-6">
+    <!-- Step indicator -->
+    <div class="flex items-center justify-center gap-2 mb-6">
+      <div id="step1" class="step-circle active">1</div>
+      <div class="w-8 h-0.5 bg-gray-200"></div>
+      <div id="step2" class="step-circle">2</div>
+      <div class="w-8 h-0.5 bg-gray-200"></div>
+      <div id="step3" class="step-circle">3</div>
+    </div>
+
+    <!-- Step 1: Create order -->
+    <div id="step-create" class="pay-card">
+      <h2 class="text-xl font-bold mb-1">Complete your payment</h2>
+      <p class="text-gray-500 text-sm mb-4">Enter your details to generate a payment order</p>
+
+      <div class="space-y-3">
+        <div>
+          <label class="block text-sm font-medium mb-1">Full name</label>
+          <input type="text" id="name" class="w-full px-3 py-2 border border-gray-300 rounded-xl focus:border-cyan-500 focus:outline-none" placeholder="John Doe">
+        </div>
+        <div>
+          <label class="block text-sm font-medium mb-1">Email</label>
+          <input type="email" id="email" class="w-full px-3 py-2 border border-gray-300 rounded-xl focus:border-cyan-500 focus:outline-none" placeholder="john@example.com">
+        </div>
+        <div>
+          <label class="block text-sm font-medium mb-1">Phone (optional)</label>
+          <input type="tel" id="phone" class="w-full px-3 py-2 border border-gray-300 rounded-xl focus:border-cyan-500 focus:outline-none" placeholder="+234 801 234 5678">
+        </div>
+      </div>
+
+      <!-- Order summary -->
+      <div class="mt-4 bg-gray-50 rounded-xl p-3">
+        <div class="text-xs font-bold uppercase tracking-wide text-gray-500 mb-1">Order Summary</div>
+        <div id="items-summary" class="text-sm text-gray-700">—</div>
+        <div class="flex justify-between mt-2 pt-2 border-t border-gray-200">
+          <span class="font-bold">Total</span>
+          <span class="font-bold text-cyan-600" id="total-amount">₦—</span>
+        </div>
+      </div>
+
+      <button id="create-btn" class="btn-cyan w-full py-3 rounded-xl mt-4 flex items-center justify-center gap-2">
+        <span>Generate Payment Order</span>
+      </button>
+    </div>
+
+    <!-- Step 2: Transfer + confirm -->
+    <div id="step-transfer" class="pay-card hidden">
+      <h2 class="text-xl font-bold mb-1">Transfer to PalmPay</h2>
+      <p class="text-gray-500 text-sm mb-4">Transfer the EXACT amount below (including decimals)</p>
+
+      <!-- Amount box -->
+      <div class="amount-box mb-4">
+        <div class="text-xs text-gray-400 uppercase tracking-wide mb-1">Amount to transfer</div>
+        <div class="amount-big" id="display-amount">₦—</div>
+        <div class="text-xs text-gray-400 mt-1">The decimal (.XX) is unique to your order</div>
+      </div>
+
+      <!-- Bank details -->
+      <div class="bg-gray-50 rounded-xl p-3 space-y-2">
+        <div class="flex justify-between items-center">
+          <span class="text-sm text-gray-500">Account Name</span>
+          <span class="font-medium text-sm" id="acct-name">—</span>
+        </div>
+        <div class="flex justify-between items-center">
+          <span class="text-sm text-gray-500">Account Number</span>
+          <div class="flex items-center gap-2">
+            <span class="font-bold text-sm font-mono" id="acct-number">—</span>
+            <button class="copy-btn" onclick="copyText(document.getElementById('acct-number').textContent, this)">Copy</button>
+          </div>
+        </div>
+        <div class="flex justify-between items-center">
+          <span class="text-sm text-gray-500">Bank</span>
+          <span class="font-medium text-sm" id="acct-bank">—</span>
+        </div>
+      </div>
+
+      <div class="mt-4 bg-cyan-50 border border-cyan-200 rounded-xl p-3 text-sm text-cyan-800">
+        <i class="fas fa-info-circle mr-1"></i>
+        Transfer <strong>exactly</strong> the amount shown (including the decimal). This is how we auto-verify your payment.
+      </div>
+
+      <button id="confirm-btn" class="btn-cyan w-full py-3 rounded-xl mt-4 flex items-center justify-center gap-2">
+        <i class="fas fa-check"></i>
+        <span>I've sent it</span>
+      </button>
+
+      <p class="text-xs text-gray-400 text-center mt-2">Order expires in <span id="countdown">30:00</span></p>
+    </div>
+
+    <!-- Step 3: Verifying -->
+    <div id="step-verifying" class="pay-card hidden text-center">
+      <div class="flex justify-center mb-4">
+        <div class="spinner" style="width:48px;height:48px;border-width:4px;"></div>
+      </div>
+      <h2 class="text-xl font-bold mb-1">Checking for your payment…</h2>
+      <p class="text-gray-500 text-sm mb-4">We're monitoring our PalmPay account for your transfer. This usually takes 1-3 minutes.</p>
+      
+      <div class="bg-gray-50 rounded-xl p-3">
+        <div class="text-xs text-gray-500 uppercase tracking-wide">Status</div>
+        <div id="verify-status" class="font-bold text-cyan-600 text-lg mt-1">Checking…</div>
+        <div id="verify-message" class="text-sm text-gray-500 mt-1"></div>
+      </div>
+
+      <div id="support-fallback" class="hidden mt-4 bg-red-50 border border-red-200 rounded-xl p-3 text-sm text-red-700">
+        <p class="font-bold mb-1">Verification timed out</p>
+        <p>If you've already sent the payment, please contact support:</p>
+        <a href="https://wa.me/2348012345678?text=Payment%20issue%20-%20Order%20" id="support-link" class="text-cyan-600 underline mt-1 inline-block">WhatsApp Support</a>
+      </div>
+    </div>
+
+    <!-- Success -->
+    <div id="step-success" class="pay-card hidden text-center">
+      <div class="w-16 h-16 mx-auto rounded-full bg-green-100 flex items-center justify-center mb-3">
+        <i class="fas fa-check text-3xl text-green-500"></i>
+      </div>
+      <h2 class="text-xl font-bold mb-1 text-green-600">Payment Verified!</h2>
+      <p class="text-gray-500 text-sm mb-4">Your order has been confirmed. You'll receive an email shortly.</p>
+      <a href="orders.html" class="btn-cyan inline-block px-6 py-3 rounded-xl">View Orders</a>
+    </div>
+  </main>
+
+  <script>
+    let currentOrderId = null;
+    let statusPollTimer = null;
+    let countdownTimer = null;
+
+    // Parse cart/order info from URL params or use defaults
+    const params = new URLSearchParams(location.search);
+    const cartTotal = parseFloat(params.get('total') || '0');
+    const cartItems = params.get('items') || 'Items from cart';
+    const cartCount = parseInt(params.get('count') || '1');
+
+    // Pre-fill
+    if (cartTotal > 0) {
+      document.getElementById('total-amount').textContent = `₦${cartTotal.toLocaleString('en-US', {minimumFractionDigits: 2})}`;
+      document.getElementById('items-summary').textContent = cartItems;
+    }
+
+    // Pre-fill user info if logged in
+    (async () => {
+      const sess = await window.EdgeFunctions.auth.checkSession();
+      if (sess.success && sess.user) {
+        document.getElementById('email').value = sess.user.email || '';
+        document.getElementById('name').value = sess.user.email?.split('@')[0] || '';
+      }
+    })();
+
+    // Step 1: Create order
+    document.getElementById('create-btn').addEventListener('click', async () => {
+      const name = document.getElementById('name').value.trim();
+      const email = document.getElementById('email').value.trim();
+      const phone = document.getElementById('phone').value.trim();
+
+      if (!name || !email) {
+        alert('Please enter your name and email');
+        return;
+      }
+      if (cartTotal <= 0) {
+        alert('No items to pay for. Go to your cart first.');
+        return;
+      }
+
+      const btn = document.getElementById('create-btn');
+      btn.disabled = true;
+      btn.innerHTML = '<div class="spinner"></div> Creating order…';
+
+      try {
+        const r = await window.EdgeFunctions.payment.createOrder({
+          buyerName: name,
+          buyerEmail: email,
+          buyerPhone: phone || null,
+          itemsSummary: cartItems,
+          itemCount: cartCount,
+          total: cartTotal,
+        });
+
+        if (r.success) {
+          currentOrderId = r.orderId;
+          // Show transfer step
+          document.getElementById('step-create').classList.add('hidden');
+          document.getElementById('step-transfer').classList.remove('hidden');
+          document.getElementById('step1').classList.add('done');
+          document.getElementById('step2').classList.add('active');
+          
+          // Display payment info
+          document.getElementById('display-amount').textContent = `₦${r.expectedAmount.toLocaleString('en-US', {minimumFractionDigits: 2})}`;
+          document.getElementById('acct-name').textContent = r.palmpayAccount.name;
+          document.getElementById('acct-number').textContent = r.palmpayAccount.number;
+          document.getElementById('acct-bank').textContent = r.palmpayAccount.bank;
+          
+          // Start countdown
+          startCountdown(r.expiresAt);
+        } else {
+          alert('Failed: ' + (r.error || 'Unknown error'));
+          btn.disabled = false;
+          btn.innerHTML = '<span>Generate Payment Order</span>';
+        }
+      } catch (e) {
+        alert('Error: ' + e.message);
+        btn.disabled = false;
+        btn.innerHTML = '<span>Generate Payment Order</span>';
+      }
+    });
+
+    // Step 2: Confirm sent
+    document.getElementById('confirm-btn').addEventListener('click', async () => {
+      if (!currentOrderId) return;
+      
+      const btn = document.getElementById('confirm-btn');
+      btn.disabled = true;
+      btn.innerHTML = '<div class="spinner"></div> Starting verification…';
+
+      try {
+        const r = await window.EdgeFunctions.payment.confirmSent(currentOrderId);
+        if (r.success) {
+          // Show verifying step
+          document.getElementById('step-transfer').classList.add('hidden');
+          document.getElementById('step-verifying').classList.remove('hidden');
+          document.getElementById('step2').classList.add('done');
+          document.getElementById('step3').classList.add('active');
+          
+          // Start polling for status
+          startStatusPolling();
+        } else {
+          alert('Failed: ' + (r.error || 'Unknown error'));
+          btn.disabled = false;
+          btn.innerHTML = '<i class="fas fa-check"></i> <span>I\'ve sent it</span>';
+        }
+      } catch (e) {
+        alert('Error: ' + e.message);
+        btn.disabled = false;
+        btn.innerHTML = '<i class="fas fa-check"></i> <span>I\'ve sent it</span>';
+      }
+    });
+
+    // Poll for status
+    function startStatusPolling() {
+      statusPollTimer = setInterval(async () => {
+        if (!currentOrderId) return;
+        try {
+          const r = await window.EdgeFunctions.payment.checkStatus(currentOrderId);
+          if (!r.success) return;
+
+          const statusEl = document.getElementById('verify-status');
+          const msgEl = document.getElementById('verify-message');
+
+          if (r.status === 'matched') {
+            clearInterval(statusPollTimer);
+            clearInterval(countdownTimer);
+            statusEl.textContent = '✓ Verified';
+            statusEl.className = 'font-bold text-green-600 text-lg mt-1';
+            msgEl.textContent = r.message;
+            // Show success after 2s
+            setTimeout(() => {
+              document.getElementById('step-verifying').classList.add('hidden');
+              document.getElementById('step-success').classList.remove('hidden');
+              document.getElementById('step3').classList.add('done');
+            }, 2000);
+          } else if (r.status === 'expired') {
+            clearInterval(statusPollTimer);
+            clearInterval(countdownTimer);
+            statusEl.textContent = 'Timed out';
+            statusEl.className = 'font-bold text-red-500 text-lg mt-1';
+            msgEl.textContent = r.message;
+            document.getElementById('support-fallback').classList.remove('hidden');
+            document.getElementById('support-link').href += currentOrderId;
+          } else {
+            statusEl.textContent = 'Checking…';
+            msgEl.textContent = r.message || 'Looking for your payment…';
+          }
+        } catch (e) {}
+      }, 5000); // Poll every 5 seconds
+    }
+
+    // Countdown timer
+    function startCountdown(expiresAt) {
+      const expiry = new Date(expiresAt).getTime();
+      countdownTimer = setInterval(() => {
+        const remaining = expiry - Date.now();
+        if (remaining <= 0) {
+          clearInterval(countdownTimer);
+          document.getElementById('countdown').textContent = '00:00';
+          return;
+        }
+        const mins = Math.floor(remaining / 60000);
+        const secs = Math.floor((remaining % 60000) / 1000);
+        document.getElementById('countdown').textContent = `${mins}:${secs.toString().padStart(2, '0')}`;
+      }, 1000);
+    }
+
+    // Copy to clipboard
+    function copyText(text, btn) {
+      navigator.clipboard.writeText(text).then(() => {
+        const orig = btn.textContent;
+        btn.textContent = '✓ Copied';
+        setTimeout(() => btn.textContent = orig, 1500);
+      });
+    }
+  </script>
+</body>
+</html>

supabase/functions/payment/index.ts

@@ -0,0 +1,459 @@
+/// <reference lib="deno.ns" />
+// Cellex Payment Gateway — PalmPay manual transfer verification
+// ====================================================================
+// Customers transfer money to PalmPay, we verify by checking Gmail for
+// the PalmPay transaction alert email that matches the order amount.
+//
+// API:
+//   op=create_order    body: { buyerName, buyerEmail, buyerPhone?, itemsSummary, itemCount, total }
+//                        → { orderId, expectedAmount, palmpayAccount, expiresAt }
+//   op=confirm_sent    body: { orderId }
+//                        → { success, message } (starts Gmail IMAP polling in background)
+//   op=check_status    body: { orderId }
+//                        → { status, expectedAmount, expiresAt }
+//
+// SECURITY:
+//   - Gmail credentials are read from env vars, never returned or logged
+//   - Rate limiting: 1 confirm_sent per order, 3 per IP per 10 min
+//   - check_status only returns status, no email/transaction details
+//   - IMAP connection uses TLS
+
+import {
+  corsHeaders, jsonResponse, errorResponse, getUser,
+} from '../_shared/cors.ts';
+
+const SUPABASE_URL = Deno.env.get('SUPABASE_URL')!;
+const SERVICE_KEY = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!;
+const GMAIL_EMAIL = Deno.env.get('GMAIL_EMAIL') || '';
+const GMAIL_APP_PASSWORD = Deno.env.get('GMAIL_APP_PASSWORD') || '';
+const PALMPAY_ACCOUNT_NAME = Deno.env.get('PALMPAY_ACCOUNT_NAME') || 'Cellex Store';
+const PALMPAY_ACCOUNT_NUMBER = Deno.env.get('PALMPAY_ACCOUNT_NUMBER') || '0000000000';
+const PALMPAY_BANK = Deno.env.get('PALMPAY_BANK') || 'PalmPay';
+
+const adminHeaders = {
+  'apikey': SERVICE_KEY,
+  'Authorization': `Bearer ${SERVICE_KEY}`,
+  'Content-Type': 'application/json',
+};
+
+// Amount suffix counter — generates unique decimal suffixes (0.01 - 0.99)
+let suffixCounter = Math.floor(Math.random() * 99) + 1;
+
+function generateOrderId(): string {
+  const ts = Date.now().toString(36).toUpperCase();
+  const rand = Math.random().toString(36).substring(2, 6).toUpperCase();
+  return `CELLEX-${ts}${rand}`;
+}
+
+function generateUniqueAmount(baseAmount: number): number {
+  // Add a unique decimal suffix (1-99 kobo) to disambiguate
+  suffixCounter = (suffixCounter % 99) + 1;
+  const base = Math.floor(baseAmount);
+  const suffix = suffixCounter / 100; // 0.01 to 0.99
+  return Math.round((base + suffix) * 100) / 100;
+}
+
+Deno.serve(async (req: Request) => {
+  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders });
+  if (req.method !== 'POST') return errorResponse('Method not allowed', 405);
+
+  try {
+    const body = await req.json().catch(() => ({}));
+    const op = body.op || '';
+
+    switch (op) {
+      case 'create_order':   return await handleCreateOrder(req, body);
+      case 'confirm_sent':   return await handleConfirmSent(req, body);
+      case 'check_status':   return await handleCheckStatus(body);
+      default:               return errorResponse(`Unknown op: ${op}`, 400);
+    }
+  } catch (error) {
+    console.error('Payment error:', error);
+    return errorResponse(`Internal error: ${error instanceof Error ? error.message : String(error)}`, 500);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 1. CREATE ORDER
+// ---------------------------------------------------------------------------
+async function handleCreateOrder(req: Request, body: Record<string, unknown>): Promise<Response> {
+  // Validate inputs
+  const buyerName = (body.buyerName as string)?.trim();
+  const buyerEmail = (body.buyerEmail as string)?.trim();
+  const buyerPhone = (body.buyerPhone as string)?.trim() || null;
+  const itemsSummary = (body.itemsSummary as string)?.trim();
+  const itemCount = Number(body.itemCount) || 1;
+  const total = Number(body.total);
+
+  if (!buyerName || !buyerEmail || !itemsSummary || !total || total <= 0) {
+    return errorResponse('Missing required fields: buyerName, buyerEmail, itemsSummary, total', 400);
+  }
+
+  // Get user if logged in (optional)
+  const user = await getUser(req);
+
+  // Generate unique order ID + amount
+  const orderId = generateOrderId();
+  const expectedAmount = generateUniqueAmount(total);
+
+  // Insert into database
+  const resp = await fetch(`${SUPABASE_URL}/rest/v1/payment_orders`, {
+    method: 'POST',
+    headers: { ...adminHeaders, 'Prefer': 'return=representation' },
+    body: JSON.stringify({
+      order_id: orderId,
+      buyer_id: user?.id || null,
+      buyer_email: buyerEmail,
+      buyer_name: buyerName,
+      buyer_phone: buyerPhone,
+      expected_amount: expectedAmount,
+      items_summary: itemsSummary,
+      item_count: itemCount,
+      status: 'pending',
+    }),
+  });
+
+  if (!resp.ok) {
+    const err = await resp.text();
+    return errorResponse(`Failed to create order: ${err}`, 500);
+  }
+
+  const order = (await resp.json())[0];
+
+  return jsonResponse({
+    success: true,
+    orderId: order.order_id,
+    expectedAmount: Number(order.expected_amount),
+    palmpayAccount: {
+      name: PALMPAY_ACCOUNT_NAME,
+      number: PALMPAY_ACCOUNT_NUMBER,
+      bank: PALMPAY_BANK,
+    },
+    expiresAt: order.expires_at,
+    instructions: `Transfer exactly ₦${Number(order.expected_amount).toFixed(2)} to ${PALMPAY_ACCOUNT_NAME}, ${PALMPAY_ACCOUNT_NUMBER} (${PALMPAY_BANK}). The decimal amount (.${String(order.expected_amount).split('.')[1] || '00'}) is unique to your order — it helps us verify your payment automatically.`,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// 2. CONFIRM SENT — triggers Gmail IMAP polling
+// ---------------------------------------------------------------------------
+async function handleConfirmSent(req: Request, body: Record<string, unknown>): Promise<Response> {
+  const orderId = (body.orderId as string)?.trim();
+  if (!orderId) return errorResponse('orderId is required', 400);
+
+  // Get client IP for rate limiting
+  const clientIP = req.headers.get('x-forwarded-for')?.split(',')[0] || 'unknown';
+
+  // Rate limit check: max 1 confirm per order
+  const existingConfirm = await fetch(
+    `${SUPABASE_URL}/rest/v1/payment_rate_limits?order_id=eq.${encodeURIComponent(orderId)}&select=id&limit=1`,
+    { headers: adminHeaders }
+  );
+  const existing = await existingConfirm.json();
+  if (existing?.length > 0) {
+    return errorResponse('Verification already started for this order. Please wait.', 429);
+  }
+
+  // Rate limit check: max 3 per IP per 10 minutes
+  const ipCheck = await fetch(
+    `${SUPABASE_URL}/rest/v1/payment_rate_limits?ip_address=eq.${encodeURIComponent(clientIP)}&created_at=gte.${encodeURIComponent(new Date(Date.now() - 10 * 60 * 1000).toISOString())}&select=id`,
+    { headers: adminHeaders }
+  );
+  const ipEntries = await ipCheck.json();
+  if (ipEntries?.length >= 3) {
+    return errorResponse('Too many verification attempts. Please wait 10 minutes.', 429);
+  }
+
+  // Fetch the order
+  const orderResp = await fetch(
+    `${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}&select=*`,
+    { headers: adminHeaders }
+  );
+  const orders = await orderResp.json();
+  if (!orders?.length) return errorResponse('Order not found', 404);
+  const order = orders[0];
+
+  if (order.status !== 'pending') {
+    return errorResponse(`Order is already ${order.status}`, 400);
+  }
+
+  // Check expiry
+  if (new Date(order.expires_at) < new Date()) {
+    // Mark as expired
+    await fetch(`${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}`, {
+      method: 'PATCH',
+      headers: { ...adminHeaders, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ status: 'expired', updated_at: new Date().toISOString() }),
+    });
+    return errorResponse('Order has expired. Please create a new order.', 410);
+  }
+
+  // Record the rate limit entry
+  await fetch(`${SUPABASE_URL}/rest/v1/payment_rate_limits`, {
+    method: 'POST',
+    headers: { ...adminHeaders, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ order_id: orderId, ip_address: clientIP }),
+  });
+
+  // Update order status to awaiting_verification
+  await fetch(`${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}`, {
+    method: 'PATCH',
+    headers: { ...adminHeaders, 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      status: 'awaiting_verification',
+      verification_started_at: new Date().toISOString(),
+      updated_at: new Date().toISOString(),
+    }),
+  });
+
+  // Start Gmail IMAP polling in the background (don't await — return immediately)
+  pollGmailForPayment(orderId, Number(order.expected_amount)).catch((e) => {
+    console.error(`Gmail polling failed for order ${orderId}:`, e);
+  });
+
+  return jsonResponse({
+    success: true,
+    message: 'Verification started. We\'re checking for your payment. This usually takes 1-3 minutes.',
+  });
+}
+
+// ---------------------------------------------------------------------------
+// 3. Gmail IMAP polling — runs in background for up to 10 minutes
+// ---------------------------------------------------------------------------
+async function pollGmailForPayment(orderId: string, expectedAmount: number): Promise<void> {
+  if (!GMAIL_EMAIL || !GMAIL_APP_PASSWORD) {
+    console.warn('GMAIL_EMAIL or GMAIL_APP_PASSWORD not set — cannot verify payment');
+    // Mark as expired after 1 minute
+    await updateOrderStatus(orderId, 'expired', null);
+    return;
+  }
+
+  const maxAttempts = 20; // 20 attempts × 30s = 10 minutes
+  const intervalMs = 30000; // 30 seconds
+
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    // Check if order is still awaiting verification (might have been cancelled)
+    const checkResp = await fetch(
+      `${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}&select=status`,
+      { headers: adminHeaders }
+    );
+    const checkData = await checkResp.json();
+    if (!checkData?.length || checkData[0].status !== 'awaiting_verification') {
+      return; // Order was cancelled or already matched
+    }
+
+    try {
+      // Connect to Gmail via IMAP and search for PalmPay emails
+      const matched = await searchGmailForPayment(expectedAmount);
+      
+      if (matched) {
+        // Found a matching email! Mark the order as matched.
+        await fetch(`${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}`, {
+          method: 'PATCH',
+          headers: { ...adminHeaders, 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            status: 'matched',
+            matched_at: new Date().toISOString(),
+            matched_email_id: matched.messageId,
+            matched_sender_name: matched.senderName,
+            matched_amount: matched.amount,
+            updated_at: new Date().toISOString(),
+          }),
+        });
+        console.log(`✅ Payment matched for order ${orderId}: ${matched.senderName} sent ₦${matched.amount}`);
+        return;
+      }
+    } catch (e) {
+      console.error(`Gmail check attempt ${attempt + 1} failed:`, e);
+    }
+
+    // Wait before next attempt
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
+  }
+
+  // No match found within 10 minutes — mark as expired
+  await updateOrderStatus(orderId, 'expired', null);
+  console.log(`⏰ Order ${orderId} expired — no matching payment found`);
+}
+
+// ---------------------------------------------------------------------------
+// Gmail IMAP search — connects to Gmail, searches for PalmPay emails
+// ---------------------------------------------------------------------------
+async function searchGmailForPayment(expectedAmount: number): Promise<{ messageId: string; senderName: string; amount: number } | null> {
+  // Connect to Gmail IMAP using Deno's TCP socket + TLS
+  // We use a raw IMAP implementation since Deno doesn't have a built-in IMAP library
+  
+  const IMAP_HOST = 'imap.gmail.com';
+  const IMAP_PORT = 993;
+
+  // Connect via TLS
+  const conn = await Deno.connectTls({ hostname: IMAP_HOST, port: IMAP_PORT });
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+
+  // Read until we see the server greeting
+  await readUntil(conn, decoder, '\r\n');
+
+  // Login
+  const tag = `A${Date.now()}`;
+  await writeLine(conn, encoder, `${tag} LOGIN ${GMAIL_EMAIL} ${GMAIL_APP_PASSWORD}\r\n`);
+  const loginResp = await readUntil(conn, decoder, `${tag} OK`);
+  if (loginResp.includes('BAD') || loginResp.includes('NO')) {
+    conn.close();
+    throw new Error('Gmail login failed');
+  }
+
+  // Select the "PalmPay" label/folder (or INBOX if no label)
+  const folderTag = `${tag}1`;
+  await writeLine(conn, encoder, `${folderTag} SELECT INBOX\r\n`);
+  await readUntil(conn, decoder, `${folderTag} OK`);
+
+  // Search for unread emails from PalmPay (last 24 hours)
+  const searchTag = `${tag}2`;
+  const sinceDate = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString().split('T')[0].replace(/-/g, '-');
+  await writeLine(conn, encoder, `${searchTag} SEARCH UNSEEN FROM "palmpay" SINCE ${sinceDate}\r\n`);
+  const searchResp = await readUntil(conn, decoder, `${searchTag} OK`);
+  
+  // Parse search results — format: * SEARCH 1 2 3 4
+  const searchMatch = searchResp.match(/\* SEARCH (.+)/);
+  if (!searchMatch) {
+    // No unread PalmPay emails
+    await logoutImap(conn, encoder, decoder, tag);
+    return null;
+  }
+
+  const messageIds = searchMatch[1].trim().split(/\s+/);
+  
+  // Check each email for matching amount
+  for (const msgId of messageIds) {
+    const fetchTag = `${tag}3`;
+    await writeLine(conn, encoder, `${fetchTag} FETCH ${msgId} (BODY.PEEK[HEADER.FIELDS (FROM SUBJECT)] BODY.PEEK[TEXT])\r\n`);
+    const fetchResp = await readUntil(conn, decoder, `${fetchTag} OK`);
+    
+    // Parse the email for amount
+    const amount = parseAmountFromEmail(fetchResp);
+    const senderName = parseSenderFromEmail(fetchResp);
+    
+    if (amount !== null && Math.abs(amount - expectedAmount) < 0.01) {
+      // Amount matches! Check that this email hasn't been used for another order
+      const usedCheck = await fetch(
+        `${SUPABASE_URL}/rest/v1/payment_orders?matched_email_id=not.is.null&select=matched_email_id`,
+        { headers: adminHeaders }
+      );
+      const usedEmails = await usedCheck.json();
+      const usedIds = new Set((usedEmails || []).map((o: Record<string, unknown>) => o.matched_email_id));
+      
+      // Generate a unique email ID (folder + message number)
+      const emailUid = `INBOX:${msgId}`;
+      
+      if (!usedIds.has(emailUid)) {
+        // Mark the email as read (SEEN)
+        const seenTag = `${tag}4`;
+        await writeLine(conn, encoder, `${seenTag} STORE ${msgId} +FLAGS (\Seen)\r\n`);
+        await readUntil(conn, decoder, `${seenTag} OK`);
+        
+        await logoutImap(conn, encoder, decoder, tag);
+        return { messageId: emailUid, senderName, amount };
+      }
+    }
+  }
+
+  await logoutImap(conn, encoder, decoder, tag);
+  return null;
+}
+
+// Parse amount from PalmPay email body
+function parseAmountFromEmail(emailText: string): number | null {
+  // PalmPay emails typically contain: "Amount: ₦5,000.23" or "You received ₦5,000.23"
+  const patterns = [
+    /Amount:\s*₦?\s*([\d,]+\.?\d*)/i,
+    /received\s*₦?\s*([\d,]+\.?\d*)/i,
+    /₦\s*([\d,]+\.?\d*)/i,
+    /NGN\s*([\d,]+\.?\d*)/i,
+  ];
+  
+  for (const pattern of patterns) {
+    const match = emailText.match(pattern);
+    if (match) {
+      const amount = parseFloat(match[1].replace(/,/g, ''));
+      if (!isNaN(amount) && amount > 0) return Math.round(amount * 100) / 100;
+    }
+  }
+  return null;
+}
+
+// Parse sender name from email
+function parseSenderFromEmail(emailText: string): string {
+  const fromMatch = emailText.match(/From:\s*(.+)/i);
+  if (fromMatch) return fromMatch[1].trim().split('<')[0].trim().replace(/"/g, '');
+  return 'Unknown';
+}
+
+// IMAP helper: read until we find a specific string
+async function readUntil(conn: Deno.TlsConn, decoder: TextDecoder, until: string): Promise<string> {
+  let buf = '';
+  const chunk = new Uint8Array(4096);
+  while (!buf.includes(until)) {
+    const n = await conn.read(chunk);
+    if (n === null) break;
+    buf += decoder.decode(chunk.subarray(0, n));
+  }
+  return buf;
+}
+
+// IMAP helper: write a line
+async function writeLine(conn: Deno.TlsConn, encoder: TextEncoder, text: string): Promise<void> {
+  await conn.write(encoder.encode(text));
+}
+
+// IMAP helper: logout
+async function logoutImap(conn: Deno.TlsConn, encoder: TextEncoder, decoder: TextDecoder, tag: string): Promise<void> {
+  try {
+    const logoutTag = `${tag}99`;
+    await writeLine(conn, encoder, `${logoutTag} LOGOUT\r\n`);
+    await readUntil(conn, decoder, logoutTag);
+  } catch {}
+  conn.close();
+}
+
+// ---------------------------------------------------------------------------
+// 4. CHECK STATUS — returns only status, no sensitive details
+// ---------------------------------------------------------------------------
+async function handleCheckStatus(body: Record<string, unknown>): Promise<Response> {
+  const orderId = (body.orderId as string)?.trim();
+  if (!orderId) return errorResponse('orderId is required', 400);
+
+  const resp = await fetch(
+    `${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}&select=status,expected_amount,expires_at,created_at&limit=1`,
+    { headers: adminHeaders }
+  );
+  const orders = await resp.json();
+  if (!orders?.length) return errorResponse('Order not found', 404);
+  const order = orders[0];
+
+  return jsonResponse({
+    success: true,
+    status: order.status,
+    expectedAmount: Number(order.expected_amount),
+    expiresAt: order.expires_at,
+    createdAt: order.created_at,
+    // Only return matched info if matched (no email details)
+    ...(order.status === 'matched' ? { message: 'Payment verified! Your order is confirmed.' } : {}),
+    ...(order.status === 'expired' ? { message: 'Payment verification timed out. Please contact support.' } : {}),
+    ...(order.status === 'awaiting_verification' ? { message: 'Checking for your payment...' } : {}),
+    ...(order.status === 'pending' ? { message: 'Click "I\'ve sent it" after making the transfer.' } : {}),
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Helper: update order status
+// ---------------------------------------------------------------------------
+async function updateOrderStatus(orderId: string, status: string, matchedEmailId: string | null): Promise<void> {
+  const updates: Record<string, unknown> = { status, updated_at: new Date().toISOString() };
+  if (matchedEmailId) updates.matched_email_id = matchedEmailId;
+  await fetch(`${SUPABASE_URL}/rest/v1/payment_orders?order_id=eq.${encodeURIComponent(orderId)}`, {
+    method: 'PATCH',
+    headers: { ...adminHeaders, 'Content-Type': 'application/json' },
+    body: JSON.stringify(updates),
+  });
+}

web-server/server.py

@@ -324,6 +324,11 @@ async def proxy_cross_platform(request: Request):
 async def proxy_telegram(request: Request):
     return await _proxy_to_edge_function("telegram", request)
 
+# ---- Payment Gateway (PalmPay verification) ----
+@app.post("/api/payment")
+async def proxy_payment(request: Request):
+    return await _proxy_to_edge_function("payment", request)
+
 # ---- Phase 4: OpenWA gateway proxy (avoids CORS issues from browser) ----
 OPENWA_BASE_URL = os.environ.get("OPENWA_BASE_URL", "https://eesha-search.onrender.com")
 OPENWA_API_KEY = os.environ.get("OPENWA_API_KEY", "CellexWA2024")