payment.go

// Package models contains GORM entities mapped to PostgreSQL.
//
// PCI DSS note: we never persist full Primary Account Number (PAN) or CVV.
// Only the last four digits and the original PAN length are stored so we can
// render a masked card number on retrieval without keeping sensitive data.
package models

import (
	"time"

	"github.com/google/uuid"
)

// Payment is a single card payment attempt that reached the acquiring bank
// (status Authorized or Declined). Rejected validation failures are not stored.
type Payment struct {
	ID        uuid.UUID `gorm:"type:uuid;primaryKey"`
	Status    string    `gorm:"size:20;not null;index"` // Authorized | Declined
	CardLast4 string    `gorm:"column:card_last_four;size:4;not null"`

	// CardNumberLength records how many digits the PAN had (14–19) so we can
	// build a same-length mask (e.g. ************1111) without storing the PAN.
	CardNumberLength int `gorm:"not null"`

	ExpiryMonth int    `gorm:"not null"`
	ExpiryYear  int    `gorm:"not null"`
	Currency    string `gorm:"size:3;not null"`
	Amount      int64  `gorm:"not null"`

	// AuthorizationCode is returned by the bank simulator when authorized;
	// NULL / empty when the bank declines.
	AuthorizationCode *string `gorm:"size:64"`

	CreatedAt time.Time `gorm:"autoCreateTime"`
}

// TableName keeps the physical table name explicit.
func (Payment) TableName() string {
	return "payments"
}