Authorization Webhook Handler

import express from "express";
import crypto from "crypto";
import { ethers } from "ethers";

const app = express();
app.use(express.json({ verify: (req: any, _res, buf) => { req.rawBody = buf; } }));

const SPRINTER_API = "https://api.sprinter.tech";
const RAIN_WEBHOOK_SECRET = process.env.RAIN_WEBHOOK_SECRET!;
const SETTLEMENT_ADDRESS = process.env.SETTLEMENT_ADDRESS!;
const RPC_URL = process.env.RPC_URL!;
const SIGNER_PRIVATE_KEY = process.env.SIGNER_PRIVATE_KEY!;

const provider = new ethers.JsonRpcProvider(RPC_URL);
const signer = new ethers.Wallet(SIGNER_PRIVATE_KEY, provider);

interface ContractCall {
  to: string;
  data: string;
  value: string;
}

interface CreditInfo {
  data: {
    USDC: {
      totalCollateralValue: string;
      principal: string;
      interest: string;
      healthFactor: string;
      dueDate: string | null;
    };
  };
}

// Use Redis or a database in production
const processed = new Map<string, { approved: boolean; txHash?: string }>();

function validateSignature(rawBody: Buffer, signature: string): boolean {
  const expected = crypto
    .createHmac("sha256", RAIN_WEBHOOK_SECRET)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

async function getWalletForCard(cardId: string): Promise<string | null> {
  // TODO: query your database
  throw new Error(`Implement getWalletForCard for cardId: ${cardId}`);
}

async function getCreditInfo(account: string): Promise<CreditInfo> {
  const res = await fetch(`${SPRINTER_API}/credit/accounts/${account}/info`);
  if (!res.ok) throw new Error(`Credit info failed: ${res.status}`);
  return res.json();
}

async function buildDrawCalls(
  account: string,
  amountUsdc: string,
  receiver: string
): Promise<ContractCall[]> {
  const url = new URL(`${SPRINTER_API}/credit/accounts/${account}/draw`);
  url.searchParams.set("amount", amountUsdc);
  url.searchParams.set("receiver", receiver);
  const res = await fetch(url.toString());
  if (!res.ok) throw new Error(`Draw calldata failed: ${res.status}`);
  const data = await res.json();
  return data.calls;
}

async function executeCalls(calls: ContractCall[]): Promise<string> {
  let lastTxHash = "";
  for (const call of calls) {
    const tx = await signer.sendTransaction({
      to: call.to,
      data: call.data,
      value: call.value || "0",
    });
    const receipt = await tx.wait();
    if (!receipt || receipt.status !== 1) {
      throw new Error(`Transaction reverted: ${tx.hash}`);
    }
    lastTxHash = tx.hash;
  }
  return lastTxHash;
}

/** $1.00 = 100 cents = 1_000_000 USDC units (6 decimals) */
function centsToUsdcUnits(cents: number): string {
  return (cents * 10_000).toString();
}

app.post("/webhooks/rain/authorization", async (req, res) => {
  try {
    // 1. Validate webhook signature
    const signature = req.headers["x-rain-signature"] as string;
    if (!signature || !validateSignature((req as any).rawBody, signature)) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const { id, cardId, amount } = req.body;

    // 2. Idempotency — return cached result if already processed
    const cached = processed.get(id);
    if (cached) return res.json(cached);

    // 3. Look up user wallet
    const wallet = await getWalletForCard(cardId);
    if (!wallet) {
      processed.set(id, { approved: false });
      return res.json({ approved: false, reason: "unknown_card" });
    }

    // 4. Check available credit and health factor
    const info = await getCreditInfo(wallet);
    const available = parseFloat(info.data.USDC.totalCollateralValue);
    const healthFactor = parseFloat(info.data.USDC.healthFactor);

    if (amount / 100 > available) {
      processed.set(id, { approved: false });
      return res.json({ approved: false, reason: "insufficient_credit" });
    }

    if (healthFactor < 1.3) {
      processed.set(id, { approved: false });
      return res.json({ approved: false, reason: "low_health_factor" });
    }

    // 5. Build and execute the credit draw
    const calls = await buildDrawCalls(wallet, centsToUsdcUnits(amount), SETTLEMENT_ADDRESS);
    const txHash = await executeCalls(calls);

    processed.set(id, { approved: true, txHash });
    return res.json({ approved: true, txHash });
  } catch (error) {
    // Fail closed — always decline on error
    console.error("Authorization error:", error);
    return res.json({ approved: false, reason: "internal_error" });
  }
});

app.listen(3001, () => console.log("Webhook handler running on :3001"));