payment-kit 1.29.1 → 1.29.2

package/api/src/routes/{payment-methods.ts → hono/payment-methods.ts}

@@ -1,23 +1,27 @@
+// Phase 3 (express→hono) — hono fork of routes/payment-methods.ts. Sub-app with
+// routes relative to /api/payment-methods (mounted via mountResourceGroup). The
+// business logic is unchanged; only the express plumbing becomes hono:
+//   req.body → c.get('sanitizedBody'); res.status(n).json(x) → c.json(x, n).
 import { getUrl } from '@blocklet/sdk/lib/component';
 import { fromTokenToUnit } from '@ocap/util';
 import { ethers } from 'ethers';
-import { Router } from 'express';
+import { Hono } from 'hono';
 import pick from 'lodash/pick';
 import { InferAttributes, Op, WhereOptions } from 'sequelize';
 import cloneDeep from 'lodash/cloneDeep';
 import merge from 'lodash/merge';
 import Joi from 'joi';
-import { ensureWebhookRegistered, cleanupStripeWebhook, validateStripeKeys } from '../integrations/stripe/setup';
-import logger from '../libs/logger';
-import { authenticate } from '../libs/security';
-import { PaymentCurrency } from '../store/models/payment-currency';
-import { PaymentMethod, TPaymentMethod } from '../store/models/payment-method';
-import type { EVMChainType, PaymentMethodSettings } from '../store/models/types';
-import { ethWallet, wallet } from '../libs/auth';
-import { EVM_CHAIN_TYPES } from '../libs/constants';
-import { getTokenSummaryByDid } from '../integrations/arcblock/stake';
-
-const router = Router();
+import { ensureWebhookRegistered, cleanupStripeWebhook, validateStripeKeys } from '../../integrations/stripe/setup';
+import logger from '../../libs/logger';
+import { authenticate } from '../../middlewares/hono/security';
+import { PaymentCurrency } from '../../store/models/payment-currency';
+import { PaymentMethod, TPaymentMethod } from '../../store/models/payment-method';
+import type { EVMChainType, PaymentMethodSettings } from '../../store/models/types';
+import { ethWallet, wallet } from '../../libs/auth';
+import { EVM_CHAIN_TYPES } from '../../libs/constants';
+import { getTokenSummaryByDid } from '../../integrations/arcblock/stake';
+
+const app = new Hono();
 
 const auth = authenticate<PaymentMethod>({ component: true, roles: ['owner', 'admin'] });
 
@@ -26,43 +30,44 @@ const paymentMethodCreateSchema = Joi.object({
   description: Joi.string().max(255).required(),
 }).unknown(true);
 
-router.post('/', auth, async (req, res) => {
-  const raw: Partial<TPaymentMethod> = req.body;
+app.post('/', auth, async (c) => {
+  const body = c.get('sanitizedBody') ?? {};
+  const raw: Partial<TPaymentMethod> = body;
 
-  raw.livemode = req.livemode;
+  raw.livemode = c.get('livemode');
   raw.locked = false;
   raw.active = true;
-  const { error } = paymentMethodCreateSchema.validate(pick(req.body, ['name', 'description']));
+  const { error } = paymentMethodCreateSchema.validate(pick(body, ['name', 'description']));
   if (error) {
-    return res.status(400).json({ error: error.message });
+    return c.json({ error: error.message }, 400);
   }
 
   if (!raw.name) {
-    return res.status(400).json({ error: 'payment method name is required' });
+    return c.json({ error: 'payment method name is required' }, 400);
   }
   if (!raw.description) {
-    return res.status(400).json({ error: 'payment method description is required' });
+    return c.json({ error: 'payment method description is required' }, 400);
   }
 
   if (!raw.settings) {
-    return res.status(400).json({ error: 'payment method settings is required' });
+    return c.json({ error: 'payment method settings is required' }, 400);
   }
 
   if (raw.type === 'stripe') {
     const exist = await PaymentMethod.findOne({ where: { type: 'stripe', livemode: raw.livemode } });
     if (exist) {
-      return res.status(400).json({ error: 'stripe payment method already exist' });
+      return c.json({ error: 'stripe payment method already exist' }, 400);
     }
 
     if (!raw.settings.stripe?.publishable_key) {
-      return res.status(400).json({ error: 'stripe publishable key is required' });
+      return c.json({ error: 'stripe publishable key is required' }, 400);
     }
     if (!raw.settings.stripe?.secret_key) {
-      return res.status(400).json({ error: 'stripe secret key is required' });
+      return c.json({ error: 'stripe secret key is required' }, 400);
     }
     const isValid = await validateStripeKeys(raw.settings.stripe.secret_key);
     if (!isValid) {
-      return res.status(400).json({ error: 'Invalid Stripe API keys' });
+      return c.json({ error: 'Invalid Stripe API keys' }, 400);
     }
 
     raw.settings = pick(PaymentMethod.encryptSettings(raw.settings), ['stripe']) as PaymentMethodSettings;
@@ -106,19 +111,19 @@ router.post('/', auth, async (req, res) => {
 
     ensureWebhookRegistered().catch(console.error);
 
-    return res.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
+    return c.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
   }
 
   if (EVM_CHAIN_TYPES.includes(raw.type as string)) {
     const paymentType = raw.type as EVMChainType;
     if (!raw.settings[paymentType]?.api_host) {
-      return res.status(400).json({ error: `${paymentType} api_host is required` });
+      return c.json({ error: `${paymentType} api_host is required` }, 400);
     }
     if (!raw.settings[paymentType]?.explorer_host) {
-      return res.status(400).json({ error: `${paymentType} explorer_host is required` });
+      return c.json({ error: `${paymentType} explorer_host is required` }, 400);
     }
     if (!raw.settings[paymentType]?.native_symbol) {
-      return res.status(400).json({ error: `${paymentType} native_symbol is required` });
+      return c.json({ error: `${paymentType} native_symbol is required` }, 400);
     }
 
     try {
@@ -132,14 +137,14 @@ router.post('/', auth, async (req, res) => {
       });
     } catch (err) {
       logger.error(`verify ${paymentType} api endpoint failed`, err);
-      return res.status(400).json({ error: err.message });
+      return c.json({ error: (err as any).message }, 400);
     }
 
     const exist = await PaymentMethod.findOne({
       where: { type: paymentType, [`settings.${paymentType}.chain_id`]: raw.settings[paymentType]?.chain_id },
     });
     if (exist) {
-      return res.status(400).json({ error: `${paymentType} payment method already exist` });
+      return c.json({ error: `${paymentType} payment method already exist` }, 400);
     }
 
     raw.settings = pick(PaymentMethod.encryptSettings(raw.settings), [paymentType]) as PaymentMethodSettings;
@@ -180,30 +185,40 @@ router.post('/', auth, async (req, res) => {
       metadata: {},
     });
     await method.update({ default_currency_id: currency.id });
-    return res.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
+    return c.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
   }
 
   if (raw.type === 'google_play') {
     if (!raw.settings.google_play?.package_name) {
-      return res.status(400).json({ error: 'google_play package_name is required' });
+      return c.json({ error: 'google_play package_name is required' }, 400);
     }
     if (!raw.settings.google_play?.service_account_json) {
-      return res.status(400).json({ error: 'google_play service_account_json is required' });
+      return c.json({ error: 'google_play service_account_json is required' }, 400);
     }
     try {
       const parsed = JSON.parse(raw.settings.google_play.service_account_json);
       if (!parsed.client_email || !parsed.private_key) {
-        return res.status(400).json({ error: 'service_account_json missing client_email or private_key' });
+        return c.json({ error: 'service_account_json missing client_email or private_key' }, 400);
       }
     } catch {
-      return res.status(400).json({ error: 'service_account_json is not valid JSON' });
+      return c.json({ error: 'service_account_json is not valid JSON' }, 400);
     }
 
-    const exist = await PaymentMethod.findOne({
-      where: { type: 'google_play', livemode: raw.livemode },
+    // Phase 6 (W1-4b): a channel identifier (package_name) must be unique
+    // across the WHOLE deployment regardless of tenant — the S2S webhook
+    // reverse-maps package_name -> tenant and ambiguity would misroute
+    // notifications. Per-tenant duplicates of the same identifier are
+    // therefore refused at registration time.
+    const sameType = await PaymentMethod.findAll({ where: { type: 'google_play', livemode: raw.livemode } });
+    const identifierTaken = sameType.some((m) => {
+      const settings = PaymentMethod.decryptSettings(m.settings);
+      return settings.google_play?.package_name === raw.settings?.google_play?.package_name;
     });
-    if (exist) {
-      return res.status(400).json({ error: 'google_play payment method already exists for this livemode' });
+    if (identifierTaken) {
+      return c.json(
+        { error: 'this package_name is already registered in this deployment', code: 'CHANNEL_ID_TAKEN' },
+        400
+      );
     }
 
     raw.settings = pick(PaymentMethod.encryptSettings(raw.settings), ['google_play']) as PaymentMethodSettings;
@@ -234,16 +249,16 @@ router.post('/', auth, async (req, res) => {
     });
     await method.update({ default_currency_id: currency.id });
 
-    return res.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
+    return c.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
   }
 
   if (raw.type === 'app_store') {
     if (!raw.settings.app_store?.bundle_id) {
-      return res.status(400).json({ error: 'app_store bundle_id is required' });
+      return c.json({ error: 'app_store bundle_id is required' }, 400);
     }
     const env = raw.settings.app_store?.environment;
     if (env !== 'production' && env !== 'sandbox') {
-      return res.status(400).json({ error: 'app_store environment must be production or sandbox' });
+      return c.json({ error: 'app_store environment must be production or sandbox' }, 400);
     }
     // Server API credentials are optional — StoreKit 2 JWS verify doesn't need them.
     // But if any of the three is set, all three must be set together.
@@ -258,17 +273,33 @@ router.post('/', auth, async (req, res) => {
         !raw.settings.app_store?.key_id ||
         !raw.settings.app_store?.private_key_pem
       ) {
-        return res.status(400).json({
-          error: 'app_store Server API credentials must include all of issuer_id, key_id, private_key_pem',
-        });
+        return c.json(
+          {
+            error: 'app_store Server API credentials must include all of issuer_id, key_id, private_key_pem',
+          },
+          400
+        );
       }
     }
 
-    const exist = await PaymentMethod.findOne({
-      where: { type: 'app_store', livemode: raw.livemode },
+    // Phase 6 (W1-4b): bundle_id (+environment) must be deployment-unique —
+    // see the google_play comment above for why.
+    const sameType = await PaymentMethod.findAll({ where: { type: 'app_store', livemode: raw.livemode } });
+    const identifierTaken = sameType.some((m) => {
+      const settings = PaymentMethod.decryptSettings(m.settings);
+      return (
+        settings.app_store?.bundle_id === raw.settings?.app_store?.bundle_id &&
+        settings.app_store?.environment === raw.settings?.app_store?.environment
+      );
     });
-    if (exist) {
-      return res.status(400).json({ error: 'app_store payment method already exists for this livemode' });
+    if (identifierTaken) {
+      return c.json(
+        {
+          error: 'this bundle_id/environment is already registered in this deployment',
+          code: 'CHANNEL_ID_TAKEN',
+        },
+        400
+      );
     }
 
     raw.settings = pick(PaymentMethod.encryptSettings(raw.settings), ['app_store']) as PaymentMethodSettings;
@@ -298,16 +329,16 @@ router.post('/', auth, async (req, res) => {
     });
     await method.update({ default_currency_id: currency.id });
 
-    return res.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
+    return c.json({ ...method.toJSON(), payment_currencies: [currency.toJSON()] });
   }
 
   // FIXME: support bitcoin payment methods
 
-  return res.status(400).json({ error: 'payment method type is not supported' });
+  return c.json({ error: 'payment method type is not supported' }, 400);
 });
 
-router.get('/', auth, async (req, res) => {
-  const { query } = req;
+app.get('/', auth, async (c) => {
+  const query = c.req.query();
   const where: WhereOptions<InferAttributes<PaymentMethod>> = {};
 
   if (typeof query.active === 'string') {
@@ -325,34 +356,35 @@ router.get('/', auth, async (req, res) => {
     if (query.addresses === 'true') {
       try {
         const [arcblock, ethereum] = await Promise.all([
-          getTokenSummaryByDid(wallet.address, !!req.livemode, 'arcblock'),
-          getTokenSummaryByDid(ethWallet.address, !!req.livemode, EVM_CHAIN_TYPES),
+          getTokenSummaryByDid(wallet.address, !!c.get('livemode'), 'arcblock'),
+          getTokenSummaryByDid(ethWallet.address, !!c.get('livemode'), EVM_CHAIN_TYPES),
         ]);
-        res.json({
+        return c.json({
           list,
           addresses: { arcblock: wallet.address, ethereum: ethWallet.address },
           balances: { ...arcblock, ...ethereum },
         });
       } catch (err) {
-        logger.error('get token summary failed', err.message);
-        res.json({
+        logger.error('get token summary failed', (err as any).message);
+        return c.json({
           list,
           addresses: { arcblock: wallet.address, ethereum: ethWallet.address },
           balances: {},
-          error: `get token summary failed: ${err.message}`,
+          error: `get token summary failed: ${(err as any).message}`,
         });
       }
     } else {
-      res.json(list);
+      return c.json(list);
     }
   } catch (err) {
     logger.error('get payment methods failed', err);
-    res.status(400).json({ error: err.message });
+    return c.json({ error: (err as any).message }, 400);
   }
 });
 
-router.get('/types', auth, (_, res) => {
-  res.json([
+// registered before /:id so the static segment wins
+app.get('/types', auth, (c) => {
+  return c.json([
     {
       type: 'arcblock',
       name: 'ArcBlock',
@@ -392,38 +424,36 @@ router.get('/types', auth, (_, res) => {
   ]);
 });
 
-router.get('/:id', auth, async (req, res) => {
+app.get('/:id', auth, async (c) => {
   const doc = await PaymentMethod.findOne({
-    where: { [Op.or]: [{ id: req.params.id }, { name: req.params.id }] },
+    where: { [Op.or]: [{ id: c.req.param('id') }, { name: c.req.param('id') }] },
   });
 
   if (doc) {
-    res.json(doc);
-  } else {
-    res.status(404).json(null);
+    return c.json(doc);
   }
+  return c.json(null, 404);
 });
 
-router.put('/:id/settings', auth, async (req, res) => {
-  const { id } = req.params;
-  const settings = req.body;
+// registered before /:id so the static segment '/settings' wins
+app.put('/:id/settings', auth, async (c) => {
+  const id = c.req.param('id');
+  const settings = c.get('sanitizedBody') ?? {};
   try {
     const paymentMethod = await PaymentMethod.findOne({ where: { id } });
     if (!paymentMethod) {
-      return res.status(400).json({ error: 'payment method not found' });
+      return c.json({ error: 'payment method not found' }, 400);
     }
     if (paymentMethod.type !== 'arcblock') {
-      return res
-        .status(400)
-        .json({ error: `Updating settings is not supported for the ${paymentMethod.type} payment method` });
+      return c.json({ error: `Updating settings is not supported for the ${paymentMethod.type} payment method` }, 400);
     }
     const updateSettings = merge(cloneDeep(paymentMethod.settings), settings);
     const doc = await paymentMethod.update({
       settings: updateSettings,
     });
-    return res.json(doc);
+    return c.json(doc);
   } catch (err) {
-    return res.status(400).json({ error: err.message });
+    return c.json({ error: (err as any).message }, 400);
   }
 });
 
@@ -432,17 +462,19 @@ const updateMethodSchema = Joi.object({
   description: Joi.string().empty('').max(255).optional(),
   logo: Joi.string().empty('').optional(),
 }).unknown(true);
-router.put('/:id', auth, async (req, res) => {
-  const { id } = req.params;
-  const { error, value: raw } = updateMethodSchema.validate(pick(req.body, ['name', 'description', 'logo']));
+
+app.put('/:id', auth, async (c) => {
+  const id = c.req.param('id');
+  const body = c.get('sanitizedBody') ?? {};
+  const { error, value: raw } = updateMethodSchema.validate(pick(body, ['name', 'description', 'logo']));
   if (error) {
-    return res.status(400).json({ error: error.message });
+    return c.json({ error: error.message }, 400);
   }
 
   try {
     const method = await PaymentMethod.findByPk(id);
     if (!method) {
-      return res.status(404).json({ error: 'Payment method not found' });
+      return c.json({ error: 'Payment method not found' }, 404);
     }
     const updateData: Partial<TPaymentMethod> = {
       name: raw.name ?? method.name,
@@ -452,17 +484,17 @@ router.put('/:id', auth, async (req, res) => {
     if ('logo' in method.dataValues || raw.logo !== undefined) {
       updateData.logo = raw.logo ?? method.logo;
     }
-    let updateSettings = 'settings' in req.body ? req.body.settings : null;
+    let updateSettings = 'settings' in body ? body.settings : null;
     if (EVM_CHAIN_TYPES.includes(method.type as string) && updateSettings) {
       const paymentType = method.type as EVMChainType;
       if (!updateSettings[paymentType]?.api_host) {
-        return res.status(400).json({ error: `${paymentType} api_host is required` });
+        return c.json({ error: `${paymentType} api_host is required` }, 400);
       }
       if (!updateSettings[paymentType]?.explorer_host) {
-        return res.status(400).json({ error: `${paymentType} explorer_host is required` });
+        return c.json({ error: `${paymentType} explorer_host is required` }, 400);
       }
       if (!updateSettings[paymentType]?.native_symbol) {
-        return res.status(400).json({ error: `${paymentType} native_symbol is required` });
+        return c.json({ error: `${paymentType} native_symbol is required` }, 400);
       }
       try {
         const provider = new ethers.JsonRpcProvider(updateSettings[paymentType]?.api_host);
@@ -475,21 +507,21 @@ router.put('/:id', auth, async (req, res) => {
         });
       } catch (err) {
         logger.error(`verify ${paymentType} api endpoint failed`, err);
-        return res.status(400).json({ error: err.message });
+        return c.json({ error: (err as any).message }, 400);
       }
       updateData.settings = pick(PaymentMethod.encryptSettings(updateSettings), [paymentType]) as PaymentMethodSettings;
     }
     if (method.type === 'stripe') {
       if (!updateSettings.stripe?.publishable_key) {
-        return res.status(400).json({ error: 'stripe publishable key is required' });
+        return c.json({ error: 'stripe publishable key is required' }, 400);
       }
       if (!updateSettings.stripe?.secret_key) {
-        return res.status(400).json({ error: 'stripe secret key is required' });
+        return c.json({ error: 'stripe secret key is required' }, 400);
       }
       if (method.settings?.stripe?.secret_key !== updateSettings.stripe.secret_key) {
         const isValid = await validateStripeKeys(updateSettings.stripe.secret_key);
         if (!isValid) {
-          return res.status(400).json({ error: 'Invalid Stripe API keys' });
+          return c.json({ error: 'Invalid Stripe API keys' }, 400);
         }
         updateSettings.stripe.webhook_signing_secret = null;
         updateSettings = PaymentMethod.encryptSettings(updateSettings);
@@ -502,10 +534,10 @@ router.put('/:id', auth, async (req, res) => {
     if (method.type === 'stripe') {
       ensureWebhookRegistered().catch(console.error);
     }
-    return res.json(updatedMethod);
+    return c.json(updatedMethod);
   } catch (err) {
-    return res.status(400).json({ error: err.message });
+    return c.json({ error: (err as any).message }, 400);
   }
 });
 
-export default router;
+export default app;

package/api/src/routes/{payment-stats.ts → hono/payment-stats.ts}

@@ -1,15 +1,19 @@
-import { Router } from 'express';
+// Phase 3a (express→hono) — hono fork of routes/payment-stats.ts. Sub-app with
+// routes relative to /api/payment-stats (mounted via mountResourceGroup). The
+// business logic is unchanged; only the express plumbing becomes hono:
+//   req.query → c.req.query(); req.livemode → c.get('livemode'); res.json(x) → return c.json(x).
+import { Hono } from 'hono';
 import Joi from 'joi';
 import { Op, type WhereOptions } from 'sequelize';
 import { joinURL } from 'ufo';
 
 import { BN } from '@ocap/util';
-import { getPaymentStat } from '../crons/payment-stat';
-import { getTokenSummaryByDid } from '../integrations/arcblock/stake';
-import { createListParamSchema, getOrder } from '../libs/api';
-import { ethWallet, wallet } from '../libs/auth';
-import dayjs from '../libs/dayjs';
-import { authenticate } from '../libs/security';
+import { getPaymentStat } from '../../crons/payment-stat';
+import { getTokenSummaryByDid } from '../../integrations/arcblock/stake';
+import { createListParamSchema, getOrder } from '../../libs/api';
+import { ethWallet, wallet } from '../../libs/auth';
+import dayjs from '../../libs/dayjs';
+import { authenticate } from '../../middlewares/hono/security';
 import {
   CreditGrant,
   EVMChainType,
@@ -23,11 +27,11 @@ import {
   Refund,
   RevenueSnapshot,
   Subscription,
-} from '../store/models';
-import { EVM_CHAIN_TYPES } from '../libs/constants';
-import logger from '../libs/logger';
+} from '../../store/models';
+import { EVM_CHAIN_TYPES } from '../../libs/constants';
+import logger from '../../libs/logger';
 
-const router = Router();
+const app = new Hono();
 const auth = authenticate<PaymentStat>({ component: true, roles: ['owner', 'admin'] });
 const BILLING_REASON_EXCLUSIONS = ['stake', 'stake_overdraft_protection', 'recharge'];
 
@@ -42,8 +46,9 @@ const summaryQuerySchema = Joi.object({
   start: Joi.number().positive().optional().empty(''),
   end: Joi.number().positive().optional().empty(''),
 });
-router.get('/', auth, async (req, res) => {
-  const { page, pageSize, ...query } = await schema.validateAsync(req.query, { stripUnknown: true });
+
+app.get('/', auth, async (c) => {
+  const { page, pageSize, ...query } = await schema.validateAsync(c.req.query(), { stripUnknown: true });
   const where: WhereOptions = {};
 
   if (typeof query.livemode === 'boolean') {
@@ -66,7 +71,7 @@ router.get('/', auth, async (req, res) => {
   try {
     const { rows: list, count } = await PaymentStat.findAndCountAll({
       where,
-      order: getOrder(req.query, [['created_at', 'ASC']]),
+      order: getOrder(c.req.query(), [['created_at', 'ASC']]),
       include: [],
     });
 
@@ -76,7 +81,7 @@ router.get('/', auth, async (req, res) => {
       list.push(
         // @ts-ignore
         ...currencies
-          .filter((x) => x.livemode === !!req.livemode)
+          .filter((x) => x.livemode === !!c.get('livemode'))
           .map((currency) => ({
             livemode: currency.livemode,
             timestamp,
@@ -88,10 +93,10 @@ router.get('/', auth, async (req, res) => {
       );
     }
 
-    res.json({ count, list });
+    return c.json({ count, list });
   } catch (err) {
     logger.error(err);
-    res.json({ count: 0, list: [] });
+    return c.json({ count: 0, list: [] });
   }
 });
 
@@ -472,23 +477,23 @@ async function getRevenueStats(livemode: boolean, currencyId?: string, start?: n
   return byCurrency;
 }
 
-router.get('/summary', auth, async (req, res) => {
+app.get('/summary', auth, async (c) => {
   try {
     const {
       currency_id: currencyId,
       start,
       end,
-    } = await summaryQuerySchema.validateAsync(req.query, {
+    } = await summaryQuerySchema.validateAsync(c.req.query(), {
       stripUnknown: true,
     });
-    const livemode = !!req.livemode;
+    const livemode = !!c.get('livemode');
     const [arcblock, ethereum, links, revenueByCurrency] = await Promise.all([
-      getTokenSummaryByDid(wallet.address, !!req.livemode, 'arcblock'),
-      getTokenSummaryByDid(ethWallet.address, !!req.livemode, EVM_CHAIN_TYPES),
+      getTokenSummaryByDid(wallet.address, !!c.get('livemode'), 'arcblock'),
+      getTokenSummaryByDid(ethWallet.address, !!c.get('livemode'), EVM_CHAIN_TYPES),
       getCurrencyLinks(livemode),
       getRevenueStats(livemode, currencyId, start, end),
     ]);
-    res.json({
+    return c.json({
       links,
       balances: { ...arcblock, ...ethereum },
       addresses: { arcblock: wallet.address, ethereum: ethWallet.address },
@@ -503,8 +508,8 @@ router.get('/summary', auth, async (req, res) => {
     });
   } catch (err) {
     logger.error(err);
-    res.json(null);
+    return c.json(null);
   }
 });
 
-export default router;
+export default app;