// server.js — Node/Express Backend with Stripe Webhook & Protected PDF Delivery
const express = require('express');
const crypto = require('crypto');
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const app = express();

// 1. Create Stripe Checkout Session (Server-Side Price Authority)
app.post('/api/create-checkout-session', express.json(), async (req, res) => {
  const { customerEmail } = req.body;
  const session = await stripe.checkout.sessions.create({
    mode: 'payment',
    customer_email: customerEmail,
    line_items: [{ price: process.env.STRIPE_PRICE_ID, quantity: 1 }],
    success_url: `${process.env.PUBLIC_URL}/#/purchase-confirmation?session_id={CHECKOUT_SESSION_ID}`,
    cancel_url: `${process.env.PUBLIC_URL}/#/checkout`
  });
  res.json({ url: session.url });
});

// 2. Verify Payment Server-Side Before Issuing Signed Download Token
app.get('/api/verify-order', async (req, res) => {
  const session = await stripe.checkout.sessions.retrieve(req.query.session_id);
  if (session.payment_status !== 'paid') {
    return res.status(402).json({ verified: false, error: 'Payment not completed' });
  }
  const exp = Date.now() + 3600 * 1000;
  const sig = crypto.createHmac('sha256', process.env.DOWNLOAD_SECRET)
    .update(`${session.id}:${exp}`).digest('hex');
  res.json({ verified: true, downloadUrl: `/api/download-cookbook?sid=${session.id}&exp=${exp}&sig=${sig}` });
});