[susanyusuf]

Summary

Implements the four issues assigned to me. Each feature follows the existing backend conventions (in-memory services + Express routers registered on the /api/v1 router, Zod validation, AppError/asyncHandler error handling, Vitest coverage).

This PR targets main.

Issues

Closes #926
Closes #927
Closes #928
Closes #739

What changed

#926 — Chargeback management with evidence submission

• New backend/src/services/chargebacks.ts: full chargeback lifecycle (received → under_review → evidence_required → evidence_submitted → representment → won/lost/accepted) with enforced transitions, evidence submission against a deadline, evidence removal, notes, an append-only timeline, and aggregate metrics (disputed/recovered amount, win rate).
• New backend/src/routes/chargebacks.ts exposing POST/GET /chargebacks, GET /chargebacks/:id, PATCH /chargebacks/:id/status, POST/DELETE .../evidence, POST .../notes, and GET /chargebacks/summary.
• Tests: backend/src/services/__tests__/chargebacks.test.ts covering success and failure paths (invalid transitions, deadline expiry via fake timers, closed cases, summaries).

#927 — Fraud detection engine with ML scoring

• The fraud engine (backend/src/services/fraud-detection.ts) and route already existed but had no tests. Added backend/src/services/__tests__/fraud-detection.test.ts covering feature engineering, bounded scoring, allow/review/block paths, the review queue, threshold updates/reset, model training, adversarial probe, and defensive copies.

#928 — Merchant onboarding with risk tiering

• New backend/src/services/merchant-risk-tiering.ts: deterministic 0..100 risk scoring over business/financial/compliance signals, tier assignment (low/medium/high/critical), tier policies (transaction/daily limits, payout hold, manual review, required checks), re-scoring, and per-transaction limit evaluation.
• New backend/src/routes/merchant-risk.ts exposing assess/reassess, policy lookup, listing, retrieval, and transaction-limit evaluation endpoints.
• Tests: backend/src/services/__tests__/merchant-risk-tiering.test.ts.

#739 — Database query optimization with index analysis

• New backend/src/services/query-optimization.ts: pure helpers to fingerprint SQL, extract tables/predicate/order-by columns, recommend composite indexes, detect likely full-table scans, and consolidate recommendations by table.
• Added POST /api/v1/database/analyse-queries to backend/src/routes/database.ts to analyse observed SQL end-to-end.
• Tests: backend/src/services/query-optimization.test.ts and backend/src/middleware/__tests__/queryLogger.test.ts (adds coverage for the existing slow-query logger/profiler).

Documentation

• Added docs/CHARGEBACK_MANAGEMENT.md and docs/MERCHANT_RISK_TIERING.md, and linked both from docs/README.md.

Testing notes

No dependencies were installed in the environment used to prepare this branch; changes were written to match the repository's existing patterns (tsconfig NodeNext .js import extensions, strict mode, ESLint rules). The added Vitest suites are run by CI via the changed-test-file step. You can run them locally with:

cd backend && npm run lint && npm test

Checklist

• Follows existing project conventions and architecture
• Unit tests added covering success and failure paths
• No changes to schema.prisma/migrations, so the migrations workflow is unaffected
• Routers registered in backend/src/index.ts
• Documentation added and indexed

[vercel]

@susanyusuf is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@susanyusuf Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits