arispay 0.1.0

package/src/users.ts

@@ -0,0 +1,67 @@
+import type {
+  CreateUserRequest,
+  UserResponse,
+  SetupPaymentMethodResponse,
+  WalletPaymentMethodResponse,
+  WalletStatusResponse,
+  SetLimitsRequest,
+  SpendLimitsResponse,
+} from '@arispay/shared';
+import type { HttpClient } from './client.js';
+
+export class UserService {
+  constructor(private client: HttpClient) {}
+
+  async create(params: CreateUserRequest): Promise<UserResponse> {
+    return this.client.post<UserResponse>('/v1/users', params);
+  }
+
+  async get(userId: string): Promise<UserResponse> {
+    return this.client.get<UserResponse>(`/v1/users/${userId}`);
+  }
+
+  async getByExternalId(externalId: string): Promise<UserResponse> {
+    return this.client.get<UserResponse>(`/v1/users/by-external/${encodeURIComponent(externalId)}`);
+  }
+
+  async getWalletStatus(userId: string): Promise<WalletStatusResponse> {
+    return this.client.get<WalletStatusResponse>(`/v1/users/${userId}/wallet-status`);
+  }
+
+  /** Hosted card flow — returns setupUrl for redirect */
+  async addPaymentMethod(
+    params: { userId: string; type: 'card'; returnUrl: string },
+  ): Promise<SetupPaymentMethodResponse>;
+  /** Direct card tokenization — returns user with card attached */
+  async addPaymentMethod(
+    params: {
+      userId: string;
+      type: 'card';
+      cardNumber: string;
+      expiryMonth: string;
+      expiryYear: string;
+      securityCode: string;
+    },
+  ): Promise<UserResponse>;
+  async addPaymentMethod(
+    params: { userId: string; type: 'wallet'; walletAddress: string; chain: string },
+  ): Promise<WalletPaymentMethodResponse>;
+  async addPaymentMethod(
+    params: { userId: string; type: string; [key: string]: unknown },
+  ): Promise<SetupPaymentMethodResponse | UserResponse | WalletPaymentMethodResponse> {
+    const { userId, ...body } = params;
+    return this.client.post(`/v1/users/${userId}/payment-methods`, body);
+  }
+
+  async completePaymentMethod(
+    params: { userId: string; sessionId: string },
+  ): Promise<UserResponse> {
+    const { userId, ...body } = params;
+    return this.client.post<UserResponse>(`/v1/users/${userId}/payment-methods/complete`, body);
+  }
+
+  async setLimits(params: { userId: string } & SetLimitsRequest): Promise<SpendLimitsResponse> {
+    const { userId, ...body } = params;
+    return this.client.put<SpendLimitsResponse>(`/v1/users/${userId}/limits`, body);
+  }
+}

package/src/webhooks.ts

@@ -0,0 +1,81 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+import type { RegisterWebhookRequest, WebhookResponse } from '@arispay/shared';
+import type { HttpClient } from './client.js';
+
+/** Maximum allowed age for webhook timestamps (5 minutes) */
+const WEBHOOK_TOLERANCE_SECONDS = 300;
+
+export class WebhookService {
+  constructor(private client: HttpClient) {}
+
+  async register(params: RegisterWebhookRequest): Promise<WebhookResponse & { secret: string }> {
+    return this.client.post<WebhookResponse & { secret: string }>('/v1/webhooks', params);
+  }
+
+  async list(): Promise<WebhookResponse[]> {
+    return this.client.get<WebhookResponse[]>('/v1/webhooks');
+  }
+
+  async delete(webhookId: string): Promise<void> {
+    await this.client.delete<void>(`/v1/webhooks/${webhookId}`);
+  }
+
+  /**
+   * Verify a webhook signature from an incoming request.
+   *
+   * ArisPay signs every webhook delivery with HMAC-SHA256 using the secret
+   * returned when you registered the webhook. The signature is sent in the
+   * `X-ArisPay-Signature` header and the unix timestamp in `X-ArisPay-Timestamp`.
+   *
+   * @param body      - The raw request body string (do NOT parse it first)
+   * @param signature - Value of the `X-ArisPay-Signature` header
+   * @param timestamp - Value of the `X-ArisPay-Timestamp` header
+   * @param secret    - Your webhook secret (`whsec_...`)
+   * @param toleranceSec - Maximum allowed age in seconds (default: 300 = 5 min)
+   * @returns `true` if the signature is valid and the timestamp is within tolerance
+   *
+   * @example
+   * ```ts
+   * import { WebhookService } from 'arispay';
+   *
+   * app.post('/webhooks', (req, res) => {
+   *   const isValid = WebhookService.verifyWebhookSignature(
+   *     req.body,                              // raw body string
+   *     req.headers['x-arispay-signature'],
+   *     req.headers['x-arispay-timestamp'],
+   *     process.env.WEBHOOK_SECRET!,
+   *   );
+   *   if (!isValid) return res.status(401).send('Invalid signature');
+   *   // Process the webhook event...
+   * });
+   * ```
+   */
+  static verifyWebhookSignature(
+    body: string,
+    signature: string,
+    timestamp: string,
+    secret: string,
+    toleranceSec: number = WEBHOOK_TOLERANCE_SECONDS,
+  ): boolean {
+    // Validate inputs
+    if (!body || !signature || !timestamp || !secret) return false;
+
+    // Check timestamp freshness (replay protection)
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) return false;
+    const age = Math.abs(Math.floor(Date.now() / 1000) - ts);
+    if (age > toleranceSec) return false;
+
+    // Compute expected signature
+    const signaturePayload = `${timestamp}.${body}`;
+    const expected = createHmac('sha256', secret).update(signaturePayload).digest('hex');
+
+    // Constant-time comparison to prevent timing attacks
+    try {
+      return timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));
+    } catch {
+      // Buffers different length = invalid
+      return false;
+    }
+  }
+}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src"]
+}

package/tsup.config.ts

@@ -0,0 +1,18 @@
+import { defineConfig } from 'tsup';
+
+export default defineConfig([
+  {
+    entry: ['src/index.ts'],
+    format: ['esm'],
+    dts: true,
+    outDir: 'dist',
+    clean: true,
+  },
+  {
+    entry: ['src/cli.ts', 'src/cli-b.ts'],
+    format: ['esm'],
+    outDir: 'dist',
+    banner: { js: '#!/usr/bin/env node' },
+    noExternal: ['@arispay/shared'],
+  },
+]);