# WinyPay Integration — Setup Steps

## 1. Test environment is already configured
`config.php` is currently set to WinyPay's **test environment**:

```php
define('WINYPAY_MODE', 'test');            // 'test' or 'live'
define('WINYPAY_BASE_URL', 'https://bd.gopostman.com');
define('WINYPAY_MERCHANT_CODE', 'M1001');
define('WINYPAY_SECRET_KEY', 'abc123');
define('WINYPAY_PAYOUT_KEY', 'abc123');
```

Test the whole flow (deposit + withdraw + callbacks) with these values first.
When you get production access, just change `WINYPAY_MODE` to `'live'` and swap in
your real `WINYPAY_BASE_URL` / `MERCHANT_CODE` / `SECRET_KEY` / `PAYOUT_KEY` —
nothing else needs to change, the code picks the right endpoint automatically.

Also set:
```php
define('SITE_DOMAIN', 'https://yourdomain.com');   // no trailing slash
```

## 2. Run the DB migration once
Visit `https://yourdomain.com/db_repair_winypay.php` in a browser once, then **delete
that file** from the server. It adds `order_id` / `transaction_id` columns to
`activation_requests` and `withdraws`.

## 3. What changed
| File | Purpose |
|---|---|
| `config.php` | New WinyPay constants added (old RupantorPay config kept, untouched) |
| `includes/winypay.php` | Shared helper: API calls + HMAC signature verification |
| `activate_account.php` | Now creates a WinyPay deposit instead of calling RupantorPay |
| `pay/winypay_pay.php` | New — automatic bKash/Nagad deposit for plan purchases / wallet top-up |
| `pay/index.php` | bKash/Nagad buttons now point to the automatic flow |
| `received_callback.php` | **New** — WinyPay calls this URL when a deposit finishes (matches the `callback_url` in the docs) |
| `withdraw.php` | Withdraw requests for bKash/Nagad now trigger WinyPay's payout API automatically instead of just waiting for manual admin approval |
| `withdraw_callback.php` | **New** — WinyPay calls this when a payout is finally settled; refunds the user automatically if it fails |
| `db_repair_winypay.php` | One-time DB migration (run once, then delete) |

`pay/payment.php` (the old manual trx-id form) and `admin_withdraw.php` (manual
approve/reject) were **left in place** as a fallback for any payment method other
than bKash/Nagad (e.g. Rocket), and as a manual backup if WinyPay is ever down.

## 4. Make sure these are reachable from the internet
WinyPay needs to be able to POST to:
- `https://yourdomain.com/received_callback.php`
- `https://yourdomain.com/withdraw_callback.php`

They can't be behind login or IP-restricted.

## 5. Test
- Logs are written to `winypay_logs.txt` in the site root — check this first if
  something doesn't work.
- Try a small real deposit and withdrawal once your merchant account is live to
  confirm the callback signature verifies correctly.
