Accept a payment

// server.js — npm install express
import express from "express";

const app = express();
app.use(express.json());

const API = process.env.SAPHRA_API_BASE ?? "https://api.saphra.one/v1";
const KEY = process.env.SAPHRA_SECRET_KEY; // sk_live_…

async function saphra(path, init = {}) {
  const response = await fetch(`${API}${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${KEY}`,
      "Content-Type": "application/json",
      ...init.headers,
    },
  });
  const body = await response.json();
  if (!response.ok) {
    throw Object.assign(new Error(body.error.message), body.error, { status: response.status });
  }
  return body;
}

// 1. The buyer clicks "Pay with USDC".
app.post("/checkout", async (req, res) => {
  const order = await db.orders.findForCart(req.body.cartId); // your code

  const session = await saphra("/checkout/sessions", {
    method: "POST",
    // One key per order: a retry can never create a second session.
    headers: { "Idempotency-Key": `order-${order.id}` },
    body: JSON.stringify({
      amount: order.total,                 // "25.00" — a string, never a float
      currency: "USDC",
      description: `Order #${order.number}`,
      client_reference_id: String(order.id),
      customer_email: order.email,
      line_items: order.lines.map((line) => ({
        name: line.title,
        quantity: line.quantity,
        unit_amount: line.unitPrice,
      })),
      metadata: { cart_id: req.body.cartId },
      success_url: "https://shop.example/thanks?session_id={CHECKOUT_SESSION_ID}",
      cancel_url: "https://shop.example/cart",
    }),
  });

  await db.orders.update(order.id, { saphraSessionId: session.id });
  res.redirect(303, session.url);
});

// 2. The buyer comes back. Check the session on the server before trusting it.
app.get("/thanks", async (req, res) => {
  const session = await saphra(`/checkout/sessions/${encodeURIComponent(req.query.session_id)}`);
  const order = await db.orders.findBySession(session.id);

  if (session.status === "complete") {
    await fulfil(order, session); // idempotent: safe to call twice
    return res.render("thanks", { order });
  }
  res.render("pending", { order }); // e.g. a card payment still clearing
});

app.listen(3000);