Grant access via external purchase

import express from 'express';

const app = express();

app.post(
  '/webhooks/hotmart',
  express.json(),
  async (req, res) => {
    // 1. Verify the gateway signature here (per gateway docs)

    const event = req.body;
    // Hotmart uses event types like "PURCHASE_APPROVED", "PURCHASE_CANCELED", etc.

    if (event.event === 'PURCHASE_APPROVED') {
      await handlePurchase({
        email: event.data.buyer.email,
        productId: event.data.product.id,
        purchaseId: event.data.purchase.transaction
      });
    }

    if (event.event === 'PURCHASE_CANCELED' ||
        event.event === 'PURCHASE_REFUNDED' ||
        event.event === 'PURCHASE_CHARGEBACK') {
      await handleCancellation({
        email: event.data.buyer.email,
        productId: event.data.product.id,
        purchaseId: event.data.purchase.transaction
      });
    }

    // Reply 2xx fast — process the rest in the background if you can.
    res.status(200).send('ok');
  }
);

async function resolveCativaUserId(email) {
  const row = await db.userMap.findOne({ email });
  return row?.cativaUserId ?? null;
}

async function inviteBuyer({ email, productId, purchaseId }) {
  // Save the grant intent to complete it when user_created arrives
  await db.pendingGrants.insert({
    email,
    productId,
    purchaseId,
    createdAt: new Date()
  });

  // Send email with the tenant's sign-up link
  await mailer.send({
    to: email,
    subject: 'Your access to Premium Course',
    text: `Sign up at https://{customerName}.cativa.digital/signup?email=${encodeURIComponent(email)} to unlock your access.`
  });
}

const PRODUCT_TO_BADGE = {
  'hotmart_product_123': 'badge_uuid_premium',
  'hotmart_product_456': 'badge_uuid_mentoring_2026'
};

async function handlePurchase({ email, productId, purchaseId }) {
  const badgeId = PRODUCT_TO_BADGE[productId];
  if (!badgeId) {
    console.warn(`No badge mapped for product ${productId}`);
    return;
  }

  const cativaUserId = await resolveCativaUserId(email);
  if (!cativaUserId) {
    await inviteBuyer({ email, productId, purchaseId });
    return;
  }

  // When the endpoint is available:
  const res = await fetch(
    `https://apis.cativalab.digital/tenant/v1/.../badges/${badgeId}/users/${cativaUserId}`,
    {
      method: 'POST',
      headers: { Authorization: `Bearer ${process.env.CATIVA_API_KEY}` }
    }
  );
  if (!res.ok) throw new Error(`Badge assign failed: ${res.status}`);

  await db.purchases.insert({
    purchaseId,
    cativaUserId,
    badgeId,
    grantedAt: new Date()
  });
}

import express from 'express';
import crypto from 'crypto';

const SECRET = process.env.CATIVA_WEBHOOK_SECRET; // whsec_...

app.post(
  '/webhooks/cativa',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    // HMAC verification — see /webhooks/subscribing-and-verifying
    const sigHeader = req.header('X-Cativa-Signature') ?? '';
    const parts = Object.fromEntries(
      sigHeader.split(',').map(p => p.split('='))
    );
    const ts = Number(parts.t);
    const sig = parts.v1;
    if (Math.abs(Date.now() / 1000 - ts) > 300) return res.status(400).end();
    const expected = crypto
      .createHmac('sha256', SECRET)
      .update(`${ts}.${req.body.toString('utf8')}`)
      .digest('hex');
    if (!crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(sig, 'hex')
    )) return res.status(401).end();

    const event = JSON.parse(req.body.toString('utf8'));

    if (event.BadgeName === 'Premium') {
      await sendWelcomeEmail(event.User.Email, event.User.FirstName);
      await analytics.track('Purchase Activated', {
        email: event.User.Email,
        badge: event.BadgeName
      });
    }

    res.status(200).send('ok');
  }
);