FM Kinetic Wallet — FlowMoney VPN integration

// base44/functions/fmVpnPartner/entry.ts — FM KINETIC WALLET project
// All FlowMoney VPN credentials stay in this project's Secrets interface.
import { createClientFromRequest } from 'npm:@base44/sdk@0.8.54';
import { secrets } from 'base44:runtime';

const apiBase = () => (secrets.get('FMVPN_API_BASE_URL') || '').replace(/\/$/, '');
const partnerId = () => secrets.get('FMVPN_PARTNER_ID') || '';
const partnerKey = () => secrets.get('FMVPN_PARTNER_API_KEY') || '';
const expectedStatus = () => secrets.get('FMVPN_PARTNER_STATUS') || 'development';

const CUSTOMER_ACTIONS = ['locations', 'availability', 'entitlement', 'connection', 'dashboard-url'];
let cachedPartnerToken = { value: '', expiresAt: 0 };
const customerTokens = new Map();
const linkRequests = new Map();

async function partnerToken() {
  if (cachedPartnerToken.value && Date.now() < cachedPartnerToken.expiresAt) return cachedPartnerToken.value;
  const response = await fetch(apiBase() + '/functions/partnerToken', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ grant_type: 'client_credentials', client_id: partnerId(), client_secret: partnerKey() }),
    signal: AbortSignal.timeout(15000),
  });
  const data = await response.json().catch(() => ({}));
  if (!response.ok) throw new Error(data.message || 'FlowMoney VPN authentication failed');
  cachedPartnerToken = { value: data.access_token, expiresAt: Date.now() + (data.expires_in - 60) * 1000 };
  return cachedPartnerToken.value;
}

async function callPartnerApi(payload, token) {
  const bearer = token || await partnerToken();
  const response = await fetch(apiBase() + '/functions/partnerApi', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + bearer },
    body: JSON.stringify(payload),
    signal: AbortSignal.timeout(15000),
  });
  const data = await response.json().catch(() => ({}));
  if (!response.ok) throw new Error(data.message || data.error || 'Partner API error ' + response.status);
  return data;
}

const b64Url = (bytes) => {
  let out = '';
  new Uint8Array(bytes).forEach((b) => { out += String.fromCharCode(b); });
  return btoa(out).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
};
const randomVerifier = () => { const b = new Uint8Array(32); crypto.getRandomValues(b); return b64Url(b); };
const challengeFrom = async (verifier) => {
  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
  return b64Url(digest);
};

export default async function (req) {
  try {
    const base44 = createClientFromRequest(req);
    const user = await base44.auth.me();
    if (!user) return Response.json({ error: 'unauthorized' }, { status: 401 });
    const body = await req.json().catch(() => ({}));
    const action = body?.action || 'status';

    if (action === 'status') {
      const data = await callPartnerApi({ action: 'status' });
      return Response.json({
        partner_status: data.partner_status,
        expected_status: expectedStatus(),
        status_matches: data.partner_status === expectedStatus(),
        environment: data.environment,
        scopes: data.scopes,
      });
    }

    if (action === 'start-link') {
      const codeVerifier = randomVerifier();
      const codeChallenge = await challengeFrom(codeVerifier);
      const data = await callPartnerApi({
        action: 'customer-link',
        redirect_uri: 'https://wallet.flowmoney.app/fm-vpn/callback',
        scopes: 'vpn.locations.read vpn.entitlement.read vpn.connection.read vpn.dashboard.open',
        code_challenge: codeChallenge,
        code_challenge_method: 'S256',
      });
      linkRequests.set(user.id, { codeVerifier, expiresAt: Date.now() + 9 * 60 * 1000 });
      return Response.json({ consent_url: data.consent_url, expires_in: data.link_expires_in });
    }

    if (action === 'complete-link') {
      const stored = linkRequests.get(user.id);
      linkRequests.delete(user.id);
      if (!stored || Date.now() > stored.expiresAt) {
        return Response.json({ error: 'link_expired', message: 'Start the link again.' }, { status: 400 });
      }
      const response = await fetch(apiBase() + '/functions/partnerToken', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          grant_type: 'authorization_code',
          code: body?.code,
          code_verifier: stored.codeVerifier,
          redirect_uri: 'https://wallet.flowmoney.app/fm-vpn/callback',
          client_id: partnerId(),
          client_secret: partnerKey(),
        }),
        signal: AbortSignal.timeout(15000),
      });
      const data = await response.json().catch(() => ({}));
      if (!response.ok) {
        return Response.json({ error: data.error || 'link_failed', message: data.message }, { status: 400 });
      }
      customerTokens.set(user.id, { token: data.access_token, expiresAt: Date.now() + data.expires_in * 1000 });
      return Response.json({ linked: true, subject: data.subject, scopes: data.scopes, expires_in: data.expires_in });
    }

    if (!CUSTOMER_ACTIONS.includes(action)) {
      return Response.json({ error: 'unknown_action' }, { status: 400 });
    }
    const customer = customerTokens.get(user.id);
    if (!customer || Date.now() > customer.expiresAt) {
      return Response.json({ error: 'not_linked', message: 'Link your FlowMoney VPN account first.' }, { status: 403 });
    }
    const data = await callPartnerApi({ action, access_token: customer.token });
    return Response.json(data);
  } catch (error) {
    return Response.json({ error: error.message }, { status: 500 });
  }
}

// FM VPN section inside the wallet's Privacy Center (React)
import { base44 } from '@/api/base44Client';

// 1. Show partner status in the Privacy Center
const [fmvpn, setFmvpn] = useState({ status: 'loading' });
useEffect(() => {
  base44.functions.invoke('fmVpnPartner', { action: 'status' })
    .then((res) => setFmvpn({ status: 'ready', ...res.data }))
    .catch(() => setFmvpn({ status: 'offline' }));
}, []);

// 2. "Connect FM VPN" button → customer consents on FlowMoney VPN
const openFmVpn = async () => {
  const res = await base44.functions.invoke('fmVpnPartner', { action: 'start-link' });
  window.open(res.data.consent_url, '_blank', 'noopener');
};

// 3. Callback page at /fm-vpn/callback (FlowMoney VPN redirects here with ?code=…)
const completeLink = async () => {
  const params = new URLSearchParams(window.location.search);
  if (params.get('error')) { /* customer declined: show a neutral message */ return; }
  const res = await base44.functions.invoke('fmVpnPartner', {
    action: 'complete-link',
    code: params.get('code'),
  });
  if (res.data.linked) {
    // 4. Linked: show entitlement, locations and the dashboard link
    const entitlement = await base44.functions.invoke('fmVpnPartner', { action: 'entitlement' });
    const locations = await base44.functions.invoke('fmVpnPartner', { action: 'locations' });
    const dashboard = await base44.functions.invoke('fmVpnPartner', { action: 'dashboard-url' });
    window.open(dashboard.data.dashboard_url, '_blank', 'noopener');
  }
};

// The native client launch button appears when the platform reports a
// deployable client — do not promise tunnel connectivity before then.