Let each business connect XRPay without sharing API keys

import crypto from "node:crypto";

const state = crypto.randomBytes(32).toString("base64url");
const verifier = crypto.randomBytes(48).toString("base64url");
const challenge = crypto
  .createHash("sha256")
  .update(verifier)
  .digest("base64url");

// Store state and verifier in the signed-in user's server-side session.
const url = new URL("https://xrpay.it/connect/authorize");
url.search = new URLSearchParams({
  response_type: "code",
  client_id: process.env.XRPAY_CONNECT_CLIENT_ID!,
  redirect_uri: "https://platform.example.com/integrations/xrpay/callback",
  scope: "account.read checkout.read checkout.write transaction.read webhook.read",
  state,
  code_challenge: challenge,
  code_challenge_method: "S256",
  mode: "test"
}).toString();

return redirect(url.toString());

// First compare callback state with the value in the server-side session.
const response = await fetch("https://xrpay.it/api/connect/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "authorization_code",
    client_id: process.env.XRPAY_CONNECT_CLIENT_ID!,
    client_secret: process.env.XRPAY_CONNECT_CLIENT_SECRET!,
    code: callbackUrl.searchParams.get("code")!,
    redirect_uri: "https://platform.example.com/integrations/xrpay/callback",
    code_verifier: verifier
  })
});

const connected = await response.json();
// Encrypt access_token, refresh_token, and webhook_signing_secret at rest.
// Save connection_id and xrpay_account_id against this customer business.

const response = await fetch(
  "https://xrpay.it/api/v1/connect/capabilities",
  { headers: { Authorization: "Bearer " + connectedBusiness.xrpayAccessToken } }
);

const capabilities = await response.json();

// Show only methods whose status is active.
// If status is setup_required, show the returned requirement to the business owner.

const response = await fetch("https://xrpay.it/api/v1/sessions", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + connectedBusiness.xrpayAccessToken,
    "Content-Type": "application/json",
    "Idempotency-Key": "order:" + order.id + ":payment:v1"
  },
  body: JSON.stringify({
    amount: 850,
    currency: "GHS",
    order_id: order.id,
    order_number: order.reference,
    customer_email: customer.email,
    success_url: "https://platform.example.com/payment-return",
    cancel_url: "https://platform.example.com/payment-cancelled",
    metadata: {
      business_id: connectedBusiness.id,
      order_id: order.id,
      service_date: order.serviceDate
    },
    line_items: [
      { name: "Service deposit", quantity: 1, amount: 850 }
    ]
  })
});

const checkout = await response.json();
return redirect(checkout.checkout_url);

const expected = "sha256=" + crypto
  .createHmac("sha256", connectedBusiness.xrpayWebhookSecret)
  .update(rawRequestBody)
  .digest("hex");

const received = request.headers["x-xrpay-signature"];
const valid = typeof received === "string" &&
  Buffer.byteLength(received) === Buffer.byteLength(expected) &&
  crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));

if (!valid) return new Response("Invalid signature", { status: 401 });

const event = JSON.parse(rawRequestBody);
if (await webhookEvents.exists(event.webhook_id)) return new Response("OK");

if (event.event === "payment.confirmed") {
  const order = await orders.find(event.data.order_id);
  if (
    event.platform_connection_id !== order.xrpayConnectionId ||
    event.data.fiat_amount !== order.amount ||
    event.data.fiat_currency !== order.currency
  ) throw new Error("Payment does not match the order");

  await orders.markPaid(order.id, event.data.transaction_id);
  await webhookEvents.record(event.webhook_id);
}

return new Response("OK");

const response = await fetch("https://xrpay.it/api/connect/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "refresh_token",
    client_id: process.env.XRPAY_CONNECT_CLIENT_ID!,
    client_secret: process.env.XRPAY_CONNECT_CLIENT_SECRET!,
    refresh_token: connectedBusiness.xrpayRefreshToken
  })
});

const tokens = await response.json();
// Replace the stored refresh token. The previous value no longer works.