x402 Payments

import { Request, Response, NextFunction } from "express";

const SWIFTPAY_API = "https://api.swiftpay.finance";
const SECRET_KEY = process.env.SWIFTPAY_SECRET_KEY!;

export function x402Guard(endpointUrl: string) {
  return async (req: Request, res: Response, next: NextFunction) => {
    // Fetch requirements for this route (needed in both rounds)
    const reqsRes = await fetch(
      `${SWIFTPAY_API}/v1/x402/endpoints/requirements?url=${encodeURIComponent(endpointUrl)}`,
      { headers: { "X-Swift-Key": SECRET_KEY } }
    );
    const { data } = await reqsRes.json();
    const { x402Version, requirements } = data;

    const paymentHeader = req.headers["x-payment"] as string | undefined;

    // Round 1 — no payment header: return 402
    if (!paymentHeader) {
      return res.status(402).json({
        x402Version,
        accepts: [requirements],
      });
    }

    // Round 2 — settle the payment
    const settleRes = await fetch(`${SWIFTPAY_API}/v1/x402/settle`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        x402Version,
        paymentPayload: paymentHeader,
        paymentRequirements: requirements,
      }),
    });

    const result = await settleRes.json();

    if (!result.success) {
      return res.status(402).json({
        x402Version: 1,
        accepts: [requirements],
        error: result.error,
      });
    }

    res.setHeader("X-PAYMENT-RESPONSE", JSON.stringify(result));
    next();
  };
}