aman-ga

🛡️ Aman ga? - Payment Verification System

Tanya dulu, transfer kemudian.
Ask first, transfer later.

📖 Table of Contents

What is Aman ga?
✨ Features
🎯 Quick Start
📋 Demo Credentials
🏗️ Architecture
📁 Project Structure
🔌 API Endpoints
💰 Service Pricing
🧪 Testing
🚀 Deployment
🛡️ Security
📊 Database Schema
🤝 Contributing
📄 License
📞 Support

🎯 What is Aman ga?

Aman ga? is a comprehensive payment verification platform designed for the Indonesian market to help users verify if online transactions are safe before transferring money.

The Problem We Solve

In Indonesia, online fraud is rampant. People need a way to:

✅ Verify if a seller/service is legitimate
✅ Check payment proofs before releasing services
✅ Get expert analysis on suspicious transactions
✅ Report and flag fraudulent activities

How It Works

graph LR
    A[User Uploads Payment Proof] --> B{Amount < Rp 1.000?}
    B -->|Yes| C[Auto-Approve]
    B -->|No| D[Admin Review]
    C --> E[Service Credit Activated]
    D --> E
    D --> F[Fraud Detected?]
    F -->|Yes| G[Flag & Suspend]
    F -->|No| E

User registers and purchases a service package
Uploads payment proof (screenshot of transfer)
System verifies:
- Amount < Rp 1.000 → Auto-approved ⚡
- Amount ≥ Rp 1.000 → Admin review 👮
Service credit activated → User can perform fraud checks
Fraud detection runs in background, flags suspicious patterns

✨ Features

🔐 Authentication & Authorization

✅ JWT-based authentication
✅ Role-based access control (USER, ADMIN, FINANCE)
✅ Secure password hashing (bcrypt)
✅ Token expiration & refresh

💳 Payment Processing

✅ Auto-Approval for payments < Rp 1.000
✅ Manual admin review for larger amounts
✅ Image upload for payment proofs
✅ Multiple payment methods (Bank Transfer, E-Wallets)
✅ Payment history tracking

🛡️ Fraud Detection

✅ Risk scoring algorithm
✅ Duplicate transaction detection
✅ Pattern analysis
✅ Automatic user suspension for confirmed fraud
✅ Fraud flag review system

👮 Admin Dashboard

✅ Pending payment review queue
✅ Approve/Reject payments with notes
✅ Flag users for fraud
✅ Real-time statistics
✅ Complete audit log

📱 User Interface

✅ Responsive design (mobile-first)
✅ Beautiful gradient UI (Tailwind CSS)
✅ Real-time notifications
✅ Service credit tracking
✅ Payment history view

🔔 Notifications (Optional)

✅ WhatsApp integration (Fonnte)
✅ Email integration (SendGrid)
✅ Mock mode for development

🎯 Quick Start

Option 1: Mock Mode (Recommended for Testing) ⭐

No external services needed! Test everything locally in 5 minutes.

# 1. Clone repository
git clone https://github.com/Therealratoshen/aman-ga.git
cd aman-ga

# 2. Start Backend (Terminal 1)
cd backend
python3 -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate
pip install -r requirements.txt
uvicorn main:app --reload --port 8000

# Look for this message:
# 🎯 MOCK MODE: Using in-memory database for testing
#    Demo accounts:
#    - Admin: admin@amanga.id / admin123
#    - Finance: finance@amanga.id / admin123

# 3. Start Frontend (Terminal 2)
cd frontend
npm install
npm run dev

# 4. Open browser
# http://localhost:3000

✅ Ready to test! Login with demo credentials below.

Option 2: Production Mode (With Supabase)

For persistent data and production deployment:

# 1. Create free Supabase project
# Go to: https://supabase.com
# Create project → Copy URL and anon key

# 2. Run database schema
# SQL Editor → New Query → Paste database/schema.sql → Run

# 3. Configure backend
cd backend
cp .env.example .env
nano .env  # Edit with your Supabase credentials

# 4. Restart backend
uvicorn main:app --reload --port 8000

See QUICKSTART.md for detailed setup guide.

📋 Demo Credentials

Role	Email	Password	Access Level
👑 Admin	admin@amanga.id	admin123	Full access, fraud flagging
💰 Finance	finance@amanga.id	admin123	Approve/reject payments
👤 User	Register new	Your choice	Purchase & use services

Try these steps:

Login as Admin → Explore admin dashboard
Register new user → Purchase service → Upload payment
Logout → Login as Finance → Approve payment
Check user dashboard → See activated credit

🏗️ Architecture

┌─────────────────────────────────────────────────────────────┐
│                         CLIENT LAYER                         │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │   Desktop   │  │   Mobile    │  │   Tablet    │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼ HTTP/JSON
┌─────────────────────────────────────────────────────────────┐
│                      PRESENTATION LAYER                      │
│  ┌─────────────────────────────────────────────────────┐    │
│  │           Next.js 14 Frontend (React)               │    │
│  │           • Tailwind CSS                           │    │
│  │           • Axios HTTP Client                      │    │
│  │           • JWT Authentication                     │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼ REST API
┌─────────────────────────────────────────────────────────────┐
│                       APPLICATION LAYER                      │
│  ┌─────────────────────────────────────────────────────┐    │
│  │            FastAPI Backend (Python)                 │    │
│  │  ┌──────────┐ ┌──────────┐ ┌──────────┐            │    │
│  │  │   Auth   │ │ Payment  │ │  Fraud   │            │    │
│  │  │ Service  │ │ Service  │ │ Service  │            │    │
│  │  └──────────┘ └──────────┘ └──────────┘            │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼ SQL
┌─────────────────────────────────────────────────────────────┐
│                        DATA LAYER                            │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │  Supabase   │  │    Mock     │  │   Storage   │         │
│  │  PostgreSQL │  │   Database  │  │  (Images)   │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
└─────────────────────────────────────────────────────────────┘

📁 Project Structure

aman-ga/
├── 📂 backend/                    # FastAPI Backend
│   ├── main.py                   # 📄 API endpoints (414 lines)
│   ├── auth.py                   # 🔐 JWT authentication
│   ├── database.py               # 💾 Database client (Supabase/Mock)
│   ├── mock_database.py          # 🎭 In-memory mock database ⭐ NEW
│   ├── models.py                 # 📋 Pydantic schemas
│   ├── requirements.txt          # 📦 Python dependencies
│   ├── .env.example              # ⚙️ Environment template
│   └── 📂 services/
│       ├── payment.py            # 💳 Payment processing
│       ├── fraud.py              # 🛡️ Fraud detection
│       └── notification.py       # 🔔 WhatsApp/Email
│
├── 📂 frontend/                   # Next.js Frontend
│   ├── 📂 pages/
│   │   ├── index.js              # 🏠 Login/Register
│   │   ├── dashboard.js          # 📊 User dashboard
│   │   ├── admin.js              # 👮 Admin panel
│   │   └── payment.js            # 💳 Payment history
│   ├── 📂 components/
│   │   ├── PaymentUpload.js      # 📸 Upload modal
│   │   ├── ServiceCard.js        # 💎 Service pricing
│   │   └── AdminDashboard.js     # 📈 Admin view
│   ├── 📂 styles/
│   │   └── globals.css           # 🎨 Tailwind CSS
│   ├── package.json              # 📦 NPM dependencies
│   └── next.config.js            # ⚙️ Next.js config
│
├── 📂 database/
│   ├── schema.sql                # 🗄️ Database schema
│   └── seed.sql                  # 🌱 Test data
│
└── 📂 docs/
    ├── README.md                 # 📖 This file
    ├── QUICKSTART.md             # 🚀 Setup guide (5 min)
    ├── API-KEY-SETUP.md          # 🔑 API key acquisition
    ├── TEST-REVIEW.md            # ✅ Code review report
    └── DEPLOYMENT-OPTIONS.md     # ☁️ Deployment comparison

🔌 API Endpoints

Authentication

Method	Endpoint	Description	Auth Required
`POST`	`/register`	Register new user	❌
`POST`	`/token`	Login (get JWT token)	❌
`GET`	`/me`	Get current user	✅

Example: Login

curl -X POST "http://localhost:8000/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=admin@amanga.id&password=admin123"

Payment

Method	Endpoint	Description	Auth Required
`POST`	`/payment/upload`	Upload payment proof	✅
`GET`	`/payment/my`	Get payment history	✅
`GET`	`/payment/credits`	Get service credits	✅

Example: Upload Payment

curl -X POST "http://localhost:8000/payment/upload" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -F "service_type=CEK_DASAR" \
  -F "amount=1000" \
  -F "payment_method=BANK_TRANSFER" \
  -F "bank_name=BCA" \
  -F "transaction_id=TRX123" \
  -F "transaction_date=2024-01-01T10:00:00" \
  -F "proof_image=@screenshot.png"

Admin (Requires ADMIN or FINANCE role)

Method	Endpoint	Description	Auth Required
`GET`	`/admin/payments/pending`	Get pending payments	✅
`POST`	`/admin/payment/{id}/approve`	Approve payment	✅
`POST`	`/admin/payment/{id}/reject`	Reject payment	✅
`POST`	`/admin/payment/{id}/flag`	Flag as fraud	✅
`GET`	`/admin/stats`	Dashboard statistics	✅

Example: Approve Payment

curl -X POST "http://localhost:8000/admin/payment/PAYMENT_ID/approve?notes=Verified" \
  -H "Authorization: Bearer ADMIN_TOKEN"

Service

Method	Endpoint	Description	Auth Required
`GET`	`/service/use/{type}`	Use service credit	✅

Health Check

Method	Endpoint	Description	Auth Required
`GET`	`/health`	Server status	❌

📖 Full API Documentation: http://localhost:8000/docs (Swagger UI)

💰 Service Pricing

Service	Price	Auto-Approve	Processing Time	Description
🥉 Cek Dasar	Rp 1.000	✅ Yes	Instant	Basic OJK/Kominfo check
🥈 Cek Deep	Rp 15.000	❌ Manual	5-30 min	AI chat analysis
🥇 Cek Plus	Rp 45.000	❌ Manual	5-30 min	Contract + legal letter

Auto-Approval Rules

Payments are auto-approved when ALL conditions are met:

✅ Amount ≤ Rp 1.000
✅ Service type = CEK_DASAR
✅ No fraud history for user
✅ Passes 10% random audit check

🧪 Testing

Test Flow (Mock Mode)

# 1. Start backend (Terminal 1)
cd backend
source venv/bin/activate
uvicorn main:app --reload --port 8000

# 2. Start frontend (Terminal 2)
cd frontend
npm run dev

# 3. Open http://localhost:3000

Test Scenarios

Scenario 1: User Registration & Purchase

Register new account
Login with new credentials
Purchase “Cek Dasar” (Rp 1.000)
Upload payment proof (any image)
See instant auto-approval ✅
Service credit activated in dashboard

Scenario 2: Admin Approval

Login as admin (admin@amanga.id / admin123)
Navigate to Admin Panel
See pending payment (if amount > Rp 1.000)
Click “Approve” or “Reject”
Add verification notes
User receives notification

Scenario 3: Fraud Detection

Login as admin
Flag suspicious payment
Select flag type: FAKE_PROOF
Select severity: HIGH
User automatically suspended
Service credits revoked

API Testing

# Health check
curl http://localhost:8000/health

# Register user
curl -X POST "http://localhost:8000/register" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "test@example.com",
    "password": "test123",
    "full_name": "Test User"
  }'

# Login
curl -X POST "http://localhost:8000/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=test@example.com&password=test123"

🚀 Deployment

Recommended Stack (Production)

Component	Service	Cost	Setup Time
Frontend	Vercel	Free	5 min
Backend	Railway	$5/month	10 min
Database	Supabase	Free (500MB)	5 min
Storage	Supabase Storage	Free (1GB)	5 min
Total		~$5/month	25 min

Deployment Guides

QUICKSTART.md - Basic setup
DEPLOYMENT-OPTIONS.md - Cloud provider comparison
API-KEY-SETUP.md - WhatsApp/Email setup

Alibaba Cloud Option

For Indonesian market with local data residency:

Setup	Monthly Cost	Complexity
Minimal (Simple Server)	~$6.50	⭐⭐ Medium
Production (ECS + RDS)	~$50	⭐⭐⭐ Hard

See DEPLOYMENT-OPTIONS.md for full comparison.

🛡️ Security

Authentication

✅ JWT tokens with 30-minute expiration
✅ Password hashing with bcrypt (12 rounds)
✅ Role-based access control (RBAC)
✅ Protected routes with middleware

Data Protection

✅ SQL injection prevention (Supabase client)
✅ Input validation (Pydantic schemas)
✅ CORS configuration
✅ XSS protection headers

Fraud Prevention

✅ Risk scoring algorithm
✅ Duplicate transaction detection
✅ Pattern analysis
✅ Automatic suspension for confirmed fraud
✅ Audit logging for all admin actions

Production Recommendations

⚠️ Enable HTTPS/SSL
⚠️ Add rate limiting
⚠️ Implement CSRF protection
⚠️ Set up monitoring (Sentry)
⚠️ Regular security audits

📊 Database Schema

Entity Relationship Diagram

erDiagram
    USERS ||--o{ PAYMENT_PROOFS : creates
    USERS ||--o{ SERVICE_CREDITS : owns
    USERS ||--o{ FRAUD_FLAGS : flagged_in
    USERS ||--o{ ADMIN_AUDIT_LOG : actions
    
    PAYMENT_PROOFS ||--o| SERVICE_CREDITS : generates
    PAYMENT_PROOFS ||--o{ FRAUD_FLAGS : associated_with
    
    USERS {
        uuid id PK
        string email UK
        string password_hash
        string full_name
        string phone
        string role "USER|ADMIN|FINANCE"
        string status "ACTIVE|SUSPENDED|BANNED"
        timestamp created_at
        timestamp updated_at
    }
    
    PAYMENT_PROOFS {
        uuid id PK
        uuid user_id FK
        string service_type
        integer amount
        string payment_method
        string status
        text proof_image_url
        timestamp created_at
    }
    
    SERVICE_CREDITS {
        uuid id PK
        uuid user_id FK
        string service_type
        integer quantity
        integer used_quantity
        string status
        timestamp expires_at
    }
    
    FRAUD_FLAGS {
        uuid id PK
        uuid user_id FK
        uuid payment_proof_id FK
        string flag_type
        string severity
        string status
        string action_taken
        timestamp reviewed_at
    }
    
    ADMIN_AUDIT_LOG {
        uuid id PK
        uuid admin_id FK
        string action
        string target_type
        uuid target_id
        jsonb details
        timestamp created_at
    }

Tables Overview

Table	Purpose	Key Fields
`users`	User accounts	email, role, status
`payment_proofs`	Payment records	amount, status, proof_image_url
`service_credits`	Service usage tracking	quantity, used_quantity, expires_at
`fraud_flags`	Fraud detection	flag_type, severity, action_taken
`admin_audit_log`	Admin action tracking	action, target_type, details

🤝 Contributing

Contributions are welcome! Please follow these steps:

Fork the repository
Create feature branch (git checkout -b feature/amazing-feature)
Commit changes (git commit -m 'Add amazing feature')
Push to branch (git push origin feature/amazing-feature)
Open Pull Request

Development Setup

# Backend
cd backend
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Frontend
cd frontend
npm install
npm run dev

Code Style

Python: PEP 8, type hints where possible
JavaScript: ESLint (Next.js recommended)
Commits: Conventional Commits format

📄 License

MIT License - feel free to use for learning or commercial projects.

See LICENSE for details.

📞 Support

Documentation

📖 Quick Start - Setup in 5 minutes
🔑 API Keys - Get WhatsApp/Email keys
🧪 Test Review - Complete code review
☁️ Deployment - Cloud provider comparison
📡 API Docs - Swagger UI (when running)

Contact

For questions or support, please open an issue on GitHub.

🙏 Acknowledgments

Built with ❤️ for Indonesian market safety.

Tech Stack

FastAPI - Modern Python web framework
Next.js - React framework
Supabase - Open source Firebase alternative
Tailwind CSS - Utility-first CSS
Python - Programming language
React - UI library

Inspiration

This project was built to help Indonesians verify online transactions and avoid fraud.

📈 Project Status

Milestone	Status	Date
POC Development	✅ Complete	Mar 2026
Mock Mode	✅ Complete	Mar 2026
Documentation	✅ Complete	Mar 2026
Frontend UI	✅ Complete	Mar 2026
Backend API	✅ Complete	Mar 2026
Production Deployment	🔄 Ready	-

Last Updated: March 15, 2026

### 🛡️ Aman ga? - Tanya dulu, transfer kemudian. [⭐ Star this repo](https://github.com/Therealratoshen/aman-ga/stargazers) • [🍴 Fork it](https://github.com/Therealratoshen/aman-ga/fork) • [📋 Issues](https://github.com/Therealratoshen/aman-ga/issues) **Made with ❤️ in Indonesia**

This site is open source. Improve this page.

aman-ga

🛡️ Aman ga? - Payment Verification System

📖 Table of Contents

🎯 What is Aman ga?

The Problem We Solve

How It Works

✨ Features

🔐 Authentication & Authorization

💳 Payment Processing

🛡️ Fraud Detection

👮 Admin Dashboard

📱 User Interface

🔔 Notifications (Optional)

🎯 Quick Start

Option 1: Mock Mode (Recommended for Testing) ⭐

Option 2: Production Mode (With Supabase)

📋 Demo Credentials

🏗️ Architecture

📁 Project Structure

🔌 API Endpoints

Authentication

Payment

Admin (Requires ADMIN or FINANCE role)

Service

Health Check

💰 Service Pricing

Auto-Approval Rules

🧪 Testing

Test Flow (Mock Mode)

Test Scenarios

Scenario 1: User Registration & Purchase

Scenario 2: Admin Approval

Scenario 3: Fraud Detection

API Testing

🚀 Deployment

Recommended Stack (Production)

Deployment Guides

Alibaba Cloud Option

🛡️ Security

Authentication

Data Protection

Fraud Prevention

Production Recommendations

📊 Database Schema

Entity Relationship Diagram

Tables Overview

🤝 Contributing

Development Setup

Code Style

📄 License

📞 Support

Documentation

Links

Contact

🙏 Acknowledgments

Tech Stack

Inspiration

📈 Project Status