Grant access via external purchase

import express from 'express';

const app = express();

app.post(
  '/webhooks/hotmart',
  express.json(),
  async (req, res) => {
    // 1. Verify the gateway signature here (per gateway docs)

    const event = req.body;
    // Hotmart uses event types like "PURCHASE_APPROVED", "PURCHASE_CANCELED", etc.

    if (event.event === 'PURCHASE_APPROVED') {
      await handlePurchase({
        email: event.data.buyer.email,
        productId: event.data.product.id,
        purchaseId: event.data.purchase.transaction
      });
    }

    if (event.event === 'PURCHASE_CANCELED' ||
        event.event === 'PURCHASE_REFUNDED' ||
        event.event === 'PURCHASE_CHARGEBACK') {
      await handleCancellation({
        email: event.data.buyer.email,
        productId: event.data.product.id,
        purchaseId: event.data.purchase.transaction
      });
    }

    // Reply 2xx fast — process the rest in the background if you can.
    res.status(200).send('ok');
  }
);

curl "https://apis.cativalab.digital/tenant/api/v2/admin/users/email/buyer%40example.com" \
  -H "Authorization: Bearer cativa_live_..."

{
  "id": "01HQ7Z3X4Y5Z6A7B8C9D0E1F2G",
  "email": "buyer@example.com",
  "firstName": "Ana",
  "lastName": "Costa"
}

async function resolveCativaUserId(email) {
  const row = await db.userMap.findOne({ email });
  return row?.cativaUserId ?? null;
}

async function inviteBuyer({ email, productId, purchaseId }) {
  // Save the grant intent to complete it when user_created arrives
  await db.pendingGrants.insert({
    email,
    productId,
    purchaseId,
    createdAt: new Date()
  });

  // Send email with the tenant's sign-up link
  await mailer.send({
    to: email,
    subject: 'Your access to Premium Course',
    text: `Sign up at https://{customerName}.cativa.digital/signup?email=${encodeURIComponent(email)} to unlock your access.`
  });
}

{
  "userId": "01HQ7Z3X4Y5Z6A7B8C9D0E1F2G",
  "badgeId": "01HQBADGEPREMIUM0000000000",
  "assignedAt": "2026-07-10T09:01:12Z"
}

const PRODUCT_TO_BADGE = {
  'hotmart_product_123': 'badge_ulid_premium',
  'hotmart_product_456': 'badge_ulid_mentoring_2026'
};

async function handlePurchase({ email, productId, purchaseId }) {
  // Idempotency: don't reprocess the same purchase
  if (await db.purchases.exists({ purchaseId })) return;

  const badgeId = PRODUCT_TO_BADGE[productId];
  if (!badgeId) {
    console.warn(`No badge mapped for product ${productId}`);
    return;
  }

  const cativaUserId = await resolveCativaUserId(email);
  if (!cativaUserId) {
    await inviteBuyer({ email, productId, purchaseId });
    return;
  }

  // Assign the badge by id (userId already resolved)
  const res = await fetch(
    `https://apis.cativalab.digital/tenant/api/v2/admin/membership/badges/${badgeId}/users/${cativaUserId}`,
    {
      method: 'POST',
      headers: { Authorization: `Bearer ${process.env.CATIVA_API_KEY}` }
    }
  );
  if (!res.ok) throw new Error(`Badge assign failed: ${res.status}`);

  await db.purchases.insert({
    purchaseId,
    cativaUserId,
    badgeId,
    grantedAt: new Date()
  });
}

{
  "Event": "user_received_badge",
  "BadgeId": "01HQBADGEPREMIUM0000000000",
  "BadgeName": "Premium",
  "User": {
    "Id": "01HQ7Z3X4Y5Z6A7B8C9D0E1F2G",
    "Email": "buyer@example.com",
    "FirstName": "Ana"
  },
  "OccurredAt": "2026-07-10T09:01:12Z"
}

import express from 'express';
import crypto from 'crypto';

const SECRET = process.env.CATIVA_WEBHOOK_SECRET; // whsec_...

app.post(
  '/webhooks/cativa',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    // HMAC verification — see /webhooks/subscribing-and-verifying
    const sigHeader = req.header('X-Cativa-Signature') ?? '';
    const parts = Object.fromEntries(
      sigHeader.split(',').map(p => p.split('='))
    );
    const ts = Number(parts.t);
    const sig = parts.v1;
    if (Math.abs(Date.now() / 1000 - ts) > 300) return res.status(400).end();
    const expected = crypto
      .createHmac('sha256', SECRET)
      .update(`${ts}.${req.body.toString('utf8')}`)
      .digest('hex');
    if (!crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(sig, 'hex')
    )) return res.status(401).end();

    const event = JSON.parse(req.body.toString('utf8'));

    if (event.BadgeName === 'Premium') {
      await sendWelcomeEmail(event.User.Email, event.User.FirstName);
      await analytics.track('Purchase Activated', {
        email: event.User.Email,
        badge: event.BadgeName
      });
    }

    res.status(200).send('ok');
  }
);