This diagram captures our end-to-end credit card payment submission via Gravy, including the async webhook flow. During a recent discussion with @MGerlach from Research, we realised we lacked a convenient way to explain our existing fraud touchpoints within the payment processing flow. This visualisation will support conversations regarding our current fraud prevention measures and how we can accommodate a potential ML solution in the future.
Donation diagram covers:
- Page load and checkout session creation
- Secure Fields iframe rendering
- Form submission
- Two-phase fraud filtering (pre-auth and post-auth),
- Authorisation call via SmashPig to the Gravy API
- 3DS redirect handling
- Fraud REVIEW path (authorised but not captured),
- Capture call via SmashPig to the Gravy API
- Queue message creation (payments-antifraud, pending, donations).
Webhook diagram covers:
- Webhook receipt and validation (Basic auth header check)
- Message parsing and type normalisation
- Status normalisation via ResponseMapper (config mappers/cc-response)
- Authorization webhook (PENDING_POKE) with conditional capture-from-ipn-listener branch
- Capture webhook (COMPLETE) and RecordCaptureJob creation
- Async job processing: pending DB lookup, Gravy API call for full transaction details
- Pending record enrichment (processor info, donor details, recurring token)
- Donations queue push and pending record resolution
