> For the complete documentation index, see [llms.txt](https://payana-saas.gitbook.io/payana-saas-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://payana-saas.gitbook.io/payana-saas-docs/arsitektur/backend.md).

# Lapisan Backend

Dibangun dengan Express dan Drizzle ORM di atas Node.js/TypeScript. Menangani semua hal yang tidak seharusnya (atau tidak bisa) berjalan di blockchain publik.

## Yang dimiliki backend

* **Data pribadi karyawan** — nama, NIK, nomor telepon, dienkripsi AES-256-GCM sebelum disimpan. Tidak pernah ditulis on-chain.
* **Autentikasi** — sesi berbasis JWT, access token berumur 15 menit, refresh token 7 hari.
* **Relay transaksi gasless** — meneruskan UserOperation dari frontend ke bundler Pimlico (ERC-4337), sehingga frontend tidak perlu bicara langsung dengan infrastruktur bundler.
* **Dokumen PDF** — slip gaji, bukti potong pajak, surat keterangan kerja, surat keputusan PHK.
* **Ekspor compliance** — laporan Excel/CSV untuk pelaporan BPJS/pajak.
* **Monitoring terjadwal (cron)** — memantau saldo gas Paymaster tiap vault, mendeteksi pola transaksi mencurigakan (anomaly detection).

## Yang TIDAK dimiliki backend

Backend **tidak pernah menjadi sumber kebenaran untuk uang**. Ia membaca state dari smart contract (langsung via RPC, atau lebih sering lewat tabel yang sudah diindeks `payana-indexer`), tapi tidak pernah menyimpan saldo karyawan di tabelnya sendiri sebagai otoritas.

## Dua skema database, satu database fisik

Backend berbagi satu instance PostgreSQL dengan `payana-indexer`, tapi memakai dua skema terpisah:

* **`app`** — tabel milik backend sendiri (dikelola Drizzle): `employees`, `sessions`, `pending_registrations`, `reimbursement_claims`, `bounties`, `company_settings`, `notifications`, `anomaly_alerts`, dan lainnya.
* **`ponder`/`public`** (nama skema dikonfigurasi lewat `DATABASE_SCHEMA`) — tabel milik indexer, dibaca (tidak pernah ditulis) oleh backend lewat client `postgres` mentah dengan `search_path` diarahkan ke sana.

## Rute API utama

Satu file per domain fitur di `src/routes/`: `auth`, `employees` (via `registration`/`invitations`), `bounty`, `kasbon` (via `salaryAdvances`), `reimburse`, `compliance`, `termination`, `taxcert`, `payslip`, `employmentLetter`, `transfer`, `notifications`, `webhook`, `security`, `suspension`, `companySettings`, `directory`. Referensi endpoint lengkap: [Referensi API Backend](/payana-saas-docs/dokumentasi-teknis/referensi-api-backend.md).

## Layanan background

* **`paymasterMonitor`** — mengecek saldo gas tiap `CompanyVault` setiap 15 menit, mengirim alert ke webhook operasional kalau saldo di bawah `PAYMASTER_ALERT_THRESHOLD_ETH`.
* **`anomalyDetector`** — menjalankan siklus pemeriksaan keamanan setiap 2 menit, mengawasi pola yang menyerupai vault yang dikompromikan.
* **`wsServer`** — koneksi WebSocket untuk notifikasi real-time ke frontend.

Karena ini berjalan lewat `node-cron`, service harus tetap aktif tanpa idle (lihat catatan "Always On" di panduan [deployment](/payana-saas-docs/deployment/backend-dan-indexer.md)) — kalau container tidur, jadwal ini berhenti jalan.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://payana-saas.gitbook.io/payana-saas-docs/arsitektur/backend.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.