- Add rate limiting to prevent abuse on /api/donations/create endpoint
- Replace manual input validation with Zod schema for better error handling and type safety
- Switch from console.log to secureLogger to comply with LGPD and avoid exposing sensitive data
- Remove sensitive request body logging in AbacatePay client for improved security
Replace simple debug log with comprehensive logging of environment variables, including NODE_ENV, API key (masked), webhook secret, and base URL, to improve debugging and visibility in both development and production environments.
- Replaced signature-based verification with secret validation using webhookSecret query parameter for improved compatibility
- Added CORS headers in next.config.ts for webhook API routes to handle external requests from varying IPs
- Updated abacatepay.ts verifyWebhookSignature method for backward compatibility, now delegating validation to route handler
Updated ABACATEPAY_SETUP.md with comprehensive setup guide, including environment variables, API key instructions, webhook configuration, donation flow, and field details for better integration clarity. Added required fields (phone, CPF/CNPJ) to the donation form in app/[locale]/apoiar/page.tsx to collect essential donor information and improve compliance. This ensures smoother setup and more robust donation processing.
Add donation functionality to encourage community support, including a footer card on the home page, a highlighted "Apoiar" link in the header, and comprehensive English messages for the donation section to promote transparency and user engagement.
Evandro Fonseca Junior