gopay-merchant-qris-gateway: add topic — GoPay/GoBiz merchant→QRIS gateway reverse-engineering audit (gopay-api-gateaway, gobiz-payment, QrisMerchantID, pinned commits)

gopay-merchant-qris-gateway/sources.md

@@ -0,0 +1,105 @@
+---
+title: Sources — GoPay Merchant QRIS gateways
+description: Citation list for the merchant-gateway audit — pinned repos, capture reports, APK analyses, issue threads — with what each source evidenced and where each claim was verified.
+status: concluded
+category: technical
+tags: [gopay, gobiz, sources, citations]
+draft: true
+created: 2026-10-15
+updated: 2026-10-15
+---
+
+# Sources — GoPay Merchant QRIS gateways
+
+> Part of [[gopay-merchant-qris-gateway/index|GoPay Merchant QRIS gateways]]
+
+**Audit provenance:** all three repos were cloned shallowly on **2026-10-15** and read at the commits below (`git log -1`); star/fork/license metadata captured the same day via GitHub API (`gh api repos/<owner>/<repo>`). Issue threads fetched via GitHub API 2026-10-15. **No calls were made to any GoPay/GoBiz endpoint, no credentials were used, no traffic was captured by us** — everything about live behavior is quoted from the sources' own documented captures. Repo URLs below are pinned to the audited commit SHA.
+
+## S1 — `AlfinAI/QrisMerchantID` (Python SDK + research knowledge base)
+
+- Repo (pinned): `https://github.com/AlfinAI/QrisMerchantID/tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b` — commit `ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b` (main, 2026-10-10). MIT (LICENSE file); GitHub classifier reports "NOASSERTION". 12 ★ / 2 forks (2026-10-15).
+- Evidenced: the complete audit trail of the reverse-engineering work, capture-verified API shapes, the SDK whose code corroborates the mechanics (§ refs below), disclaimers and credits.
+
+## S2 — `kavionn/gobiz-payment` (Node.js library)
+
+- Repo (pinned): `https://github.com/kavionn/gobiz-payment/tree/0bac129fefa09a3b723b68dd8f09e4b0e3899527` — commit `0bac129fefa09a3b723b68dd8f09e4b0e3899527` (main, 2026-09-07). MIT. 73 ★ / 29 forks (2026-10-15).
+- Core file read in full: [`gobiz.js`](https://github.com/kavionn/gobiz-payment/blob/0bac129fefa09a3b723b68dd8f09e4b0e3899527/gobiz.js) — key anchors:
+  - device header set: L71–L100 · password login: L102–L149 · OTP login: L158–L254
+  - token validity probe: L292–L304 · merchant discovery: L256–L272
+  - `getHistory` (analytics→journal fallback): L399–L467 · analytics: L469–L518 · journals: L520–L629
+  - watcher: L632–L748 · singleton factory: L750–L763 · minor-unit ÷100: L407, L435, L678–L681
+- Evidenced: readable reference implementation of auth replay, feed normalization, watcher pattern; the §4 unit-handling comparison; curl-subprocess quirk (L107/124/174/226).
+
+## S3 — `ahmadzakiyox/gopay-api-gateaway` (Node.js service)
+
+- Repo (pinned): `https://github.com/ahmadzakiyox/gopay-api-gateaway/tree/c753b8c23daf5ced58febe650bcd229b6b2b7dec` — commit `c753b8c23daf5ced58febe650bcd229b6b2b7dec` (main, 2026-07-26). MIT. 233 ★ / 84 forks (2026-10-15).
+- Core file read in full: [`server.js`](https://github.com/ahmadzakiyox/gopay-api-gateaway/blob/c753b8c23daf5ced58febe650bcd229b6b2b7dec/server.js) — key anchors:
+  - claim map + 24-h cleanup: L16–L53 · 6-h refresh cycle: L56–L69 · CRC16: L72–L85
+  - `generateDynamicQRIS` (tag 54 + tag 01→12 + CRC): L88–L147 · token-status probe: L176–L204
+  - `/create-qris`: L207–L252 · checkout page (5-min countdown, manual check, 8-s opt-in poll): L255–L481
+  - `verifyPayment` (claim scoping; no unit conversion — see analysis §4): L566–L653 · public status: L656–L686 · `/check-payment`: L690–L727
+- Obfuscation evidence: `login.js` (425,457 B) and `sessionManager.js` (463,886 B) are javascript-obfuscator output (hex string-array, no readable endpoints; `javascript-obfuscator` in devDependencies); `package.json` checked for dependency list.
+- Evidenced: service architecture, claim-scoping design, RAM claim store, obfuscation red flag, third-party QR rendering (`api.qrserver.com` at L267/L272).
+
+## S4 — `kavionn/gobiz-payment` issue #3: "Gopay Merchant app not Gobiz? and what are the risks?"
+
+- Thread: `https://github.com/kavionn/gobiz-payment/issues/3` (open; fetched 2026-10-15).
+- Evidenced [reported]: maintainer statement that GoPay Merchant transactions are visible on the GoBiz web for the same account ("ambil datanya dari web gobiz"); community suspension observations ("kena suspend / peningkatan transaksi"); the on-demand-poller suggestion and QMID author's participation.
+
+## S5 — GitHub API metadata (captured 2026-10-15)
+
+- `gh api repos/ahmadzakiyox/gopay-api-gateaway`, `…/kavionn/gobiz-payment`, `…/AlfinAI/QrisMerchantID` — stars, forks, license, created/pushed dates quoted in the repo cards.
+
+## S6 — QMID `research/RESEARCH_GOPAY_SHOPEEPAY.md` (flagship research doc, 2026-09-11, updated through §9.5)
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/research/RESEARCH_GOPAY_SHOPEEPAY.md`
+- Evidenced: ecosystem map (8+ repos); GoPay auth endpoint table (§2.1); data endpoints (§2.2); watcher pattern (§2.3); QRIS + anti-double-claim recipe (§2.4); gateway architecture pattern (§5); HAR verification results §9.1 (body/param shapes, 23-key tx object, minor units), §9.2 (corrections: `login_type`, `X-AppVersion` bump, split headers, journal headers), §9.3 (new endpoints: payouts, payable_detail, merchant detail), §9.4 (second capture, drift), §9.5 (email login verified live).
+
+## S7 — QMID `research/REPORT_GOBIZ_OTP_2026-09-19.md` (OTP regression analysis, HAR-based)
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/research/REPORT_GOBIZ_OTP_2026-09-19.md`
+- Evidenced: capture provenance (`GOTO.har`, 51 MB, 589 entries, Firefox); OTP request/response shapes + headers + rate limit (§3.1); token exchange + JWE sizes (§3.2); split-header finding (§3.3); root-cause ranking incl. phone-format + `X-AppVersion` gating (§4); credential-hygiene rules (preamble §5); email login second capture (§8); "mirror the browser, byte-for-byte" principle (§5).
+
+## S8 — QMID `research/APK_GOPAY_MERCHANT_2.3.0_ANALYSIS.md` (APK static analysis)
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/research/APK_GOPAY_MERCHANT_2.3.0_ANALYSIS.md`
+- Evidenced: APK identity/hashes (§1); permissions (§2); exported components (§3); anti-tamper + crypto inventory (§4); **host inventory §5.1 + ~150 endpoint groups §5.2** (incl. `unified-histories`, `transactions/charge/qris-link`, `qris/shared`, raccoon WebSocket); §5.4 sister-app evidence (GoBiz relation, answering kavionn#3); honest static-only limits (§7, §12 reproducibility log).
+
+## S9 — QMID `docs/APK_RESEARCH_REPRODUCTION_GUIDE.md` (how the APK research was done)
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/APK_RESEARCH_REPRODUCTION_GUIDE.md`
+- Evidenced: full repro pipeline (tooling, download patterns, hashing, apktool/androguard steps §3.1–§3.11); masking rule ("4 leading + 4 trailing chars + length" §3.9); secret-scan commands; ethics boundaries (§5).
+
+## S10 — QMID GoPay client docs + source (the capture-annotated SDK)
+
+- Docs pinned: `.../tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/gopay/` (`README.md`, `auth.md`, `qris.md`, `watcher.md`, `transactions.md`, `merchants.md`, `payouts.md`).
+- Source pinned: `.../tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/src/qrismerchantid/gopay/` — read: `constants.py` (hosts, `platform-v3.125.0-e1923971`, journal headers), `auth.py` (OTP/password/refresh flows L56–L103, L105–L125), `qris.py` (TLV + CRC16 + `inject_amount` L51–L73), `watcher.py` (seed/poll/match L47–L82), `money.py` (minor units).
+- Evidenced: the SDK-side mechanics and defaults quoted in [[gopay-merchant-qris-gateway/analysis|analysis]] §3–§7; the tag-01 conservatism and its rationale (docs/gopay/qris.md); the anti-double-claim guidance.
+
+## S11 — QMID `docs/SECURITY_DISCLOSURE.md` (responsible disclosure)
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/SECURITY_DISCLOSURE.md`
+- Evidenced: static-only method, 0-critical classification, masking/no-redistribution commitments, vendor contact + 7-day correction policy.
+
+## S12 — QMID `reference/endpoints.csv` + `reference/hosts.csv`
+
+- Pinned: `.../tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/reference/`
+- Evidenced: 249-row endpoint inventory — **all rows marked `BELUM TERVERIFIKASI` for runtime use** (static strings only); host inventory incl. staging hosts, `gopaymerchant.midtrans.com`, raccoon wss.
+
+## S13 — QMID `docs/ISSUE-1-RESPONSE.md` (Oct 2026 drift fix)
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/ISSUE-1-RESPONSE.md`
+- Evidenced: `X-AppVersion` v3.122→**v3.125** bump; auth calls moved to `portal.gofoodmerchant.co.id` while data stays on `api.gobiz.co.id`; OTP length read from response.
+
+## S14 — `kavionn/gobiz-payment` issues #4, #7
+
+- `https://github.com/kavionn/gobiz-payment/issues/4` (closed) — empty-history field report + maintainer response ("masih bisa"); `https://github.com/kavionn/gobiz-payment/issues/7` (open) — OTP not arriving. Fetched 2026-10-15. Evidenced [reported]: real-world fragility profile.
+
+## S15 — QMID `docs/KB_QRIS_MERCHANT_INDEX.md` + `reference/MANIFEST.md`
+
+- Pinned: `.../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/KB_QRIS_MERCHANT_INDEX.md` and `.../blob/.../reference/MANIFEST.md`
+- Evidenced: sister-app relation map; priority endpoint list for future work (raccoon wss, unified-histories); open research questions (signing, cross-app tokens, `/v1/payments/search` scope); artifact hashes + honest note that APK↔hash re-verification is pending (APKs deleted post-analysis).
+
+## Referenced but not audited (reported by S6 only)
+
+`warungerik/API-GOPAY-MERCHANT` (user-tested per S6, not independently verified), `namtxs/gopay-api` (customer-side, 2024, possibly stale), `alhifnywahid/merchantid`, `IbraDecode/gopaymerchant`, `ardianryan/qbiz-qrisdinamis`, `xirf/gobiz-merchant-sdk`, `azmi2409/gopay-merchant-qris-gateway`, `ahmadzakiyox/shoppepay-api-gateway`. Treat as pointers for future audits, not evidence.