thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/java/seed-033.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: path_traversal
+// severity: high
+// language: java
+// expected: Path traversal via file write using user-supplied output path
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class ReportWriterServlet extends HttpServlet {
+    private static final String REPORT_BASE = "/var/reports/";
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String reportName = req.getParameter("reportName");
+        String content    = req.getParameter("content");
+        // Vulnerable: reportName can traverse directories (../../etc/cron.d/backdoor)
+        File out = new File(REPORT_BASE + reportName + ".txt");
+        try (FileWriter fw = new FileWriter(out)) {
+            fw.write(content);
+        }
+        resp.getWriter().println("Report saved.");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-034.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: MD5 used for password hashing via MessageDigest
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class PasswordHasher {
+    public static String hashPassword(String password) throws NoSuchAlgorithmException {
+        // Vulnerable: MD5 is cryptographically broken and unsalted
+        MessageDigest md = MessageDigest.getInstance("MD5");
+        byte[] hash = md.digest(password.getBytes());
+        StringBuilder sb = new StringBuilder();
+        for (byte b : hash) sb.append(String.format("%02x", b));
+        return sb.toString();
+    }
+
+    public static boolean verifyPassword(String password, String storedHash)
+            throws NoSuchAlgorithmException {
+        return hashPassword(password).equals(storedHash);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-035.java

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: critical
+// language: java
+// expected: DES cipher used for data encryption (56-bit key, broken algorithm)
+
+import javax.crypto.*;
+import javax.crypto.spec.SecretKeySpec;
+import java.util.Base64;
+
+public class DataEncryptor {
+    // Vulnerable: DES uses only 56-bit key, broken since 1999
+    private static final String ALGORITHM = "DES";
+    private static final byte[] KEY_BYTES = "8byteKey".getBytes();
+
+    public static String encrypt(String plaintext) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
+        Cipher cipher = Cipher.getInstance(ALGORITHM);
+        cipher.init(Cipher.ENCRYPT_MODE, key);
+        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
+    }
+
+    public static String decrypt(String ciphertext) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
+        Cipher cipher = Cipher.getInstance(ALGORITHM);
+        cipher.init(Cipher.DECRYPT_MODE, key);
+        return new String(cipher.doFinal(Base64.getDecoder().decode(ciphertext)));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-036.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: java.util.Random used for security token generation instead of SecureRandom
+
+import java.util.Random;
+
+public class TokenGenerator {
+    // Vulnerable: java.util.Random is not cryptographically secure
+    private static final Random RANDOM = new Random();
+    private static final String CHARS  = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+
+    public static String generateSessionToken(int length) {
+        StringBuilder sb = new StringBuilder(length);
+        for (int i = 0; i < length; i++) {
+            sb.append(CHARS.charAt(RANDOM.nextInt(CHARS.length())));
+        }
+        return sb.toString();
+    }
+
+    public static String generatePasswordResetToken() {
+        return generateSessionToken(32);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-037.java

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: SHA-1 used for HMAC signature and MD5 for file integrity check
+
+import java.security.MessageDigest;
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+public class IntegrityChecker {
+    public static String computeHmac(String data, String key) throws Exception {
+        // Vulnerable: HMAC-SHA1 is weak for new applications
+        Mac mac = Mac.getInstance("HmacSHA1");
+        mac.init(new SecretKeySpec(key.getBytes(), "HmacSHA1"));
+        byte[] raw = mac.doFinal(data.getBytes());
+        StringBuilder sb = new StringBuilder();
+        for (byte b : raw) sb.append(String.format("%02x", b));
+        return sb.toString();
+    }
+
+    public static String md5File(byte[] fileBytes) throws Exception {
+        // Vulnerable: MD5 used for file integrity — collision attacks possible
+        MessageDigest md = MessageDigest.getInstance("MD5");
+        byte[] hash = md.digest(fileBytes);
+        StringBuilder sb = new StringBuilder();
+        for (byte b : hash) sb.append(String.format("%02x", b));
+        return sb.toString();
+    }
+}

package/dist/packages/crucible/seeds/java/seed-038.java

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: java
+// expected: AES-ECB mode used for encryption (ECB leaks patterns, no IV)
+
+import javax.crypto.*;
+import javax.crypto.spec.SecretKeySpec;
+import java.util.Base64;
+
+public class AesEcbEncryptor {
+    // Vulnerable: AES/ECB/PKCS5Padding does not use an IV and leaks data patterns
+    private static final String CIPHER_SPEC = "AES/ECB/PKCS5Padding";
+    private static final String SECRET_KEY  = "1234567890abcdef"; // 16 bytes
+
+    public static String encrypt(String plaintext) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
+        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
+        cipher.init(Cipher.ENCRYPT_MODE, key);
+        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
+    }
+
+    public static String decrypt(String ct) throws Exception {
+        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
+        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
+        cipher.init(Cipher.DECRYPT_MODE, key);
+        return new String(cipher.doFinal(Base64.getDecoder().decode(ct)));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-039.java

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization via ObjectInputStream.readObject on untrusted data
+
+import java.io.*;
+import javax.servlet.http.*;
+
+public class SessionRestoreServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        // Vulnerable: deserializes raw bytes from request body — no type checking
+        InputStream body = req.getInputStream();
+        ObjectInputStream ois = new ObjectInputStream(body);
+        Object sessionData;
+        try {
+            sessionData = ois.readObject();
+        } catch (ClassNotFoundException e) {
+            resp.sendError(400, "Unknown class");
+            return;
+        }
+        req.getSession().setAttribute("data", sessionData);
+        resp.getWriter().println("Session restored");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-040.java

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization of Base64-decoded cookie value via ObjectInputStream
+
+import java.io.*;
+import java.util.Base64;
+import javax.servlet.http.*;
+
+public class RememberMeServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        Cookie[] cookies = req.getCookies();
+        for (Cookie c : cookies) {
+            if ("rememberMe".equals(c.getName())) {
+                byte[] data = Base64.getDecoder().decode(c.getValue());
+                // Vulnerable: deserializes attacker-controlled cookie bytes
+                try (ObjectInputStream ois = new ObjectInputStream(
+                        new ByteArrayInputStream(data))) {
+                    Object principal = ois.readObject();
+                    req.getSession().setAttribute("user", principal);
+                } catch (ClassNotFoundException e) {
+                    resp.sendError(400);
+                }
+                break;
+            }
+        }
+        resp.sendRedirect("/dashboard");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-041.java

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization via XMLDecoder on user-supplied XML
+
+import java.beans.XMLDecoder;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class XmlConfigServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        // Vulnerable: XMLDecoder can execute arbitrary Java code via crafted XML
+        XMLDecoder decoder = new XMLDecoder(req.getInputStream());
+        Object config = decoder.readObject();
+        decoder.close();
+        resp.getWriter().println("Loaded config: " + config.getClass().getName());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-042.java

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization in JMS message listener via ObjectMessage
+
+import javax.jms.*;
+
+public class OrderMessageListener implements MessageListener {
+    @Override
+    public void onMessage(Message message) {
+        try {
+            if (message instanceof ObjectMessage) {
+                // Vulnerable: ObjectMessage.getObject() deserializes untrusted JMS payload
+                Object payload = ((ObjectMessage) message).getObject();
+                processOrder(payload);
+            }
+        } catch (JMSException e) {
+            e.printStackTrace();
+        }
+    }
+
+    private void processOrder(Object order) {
+        System.out.println("Processing: " + order);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-043.java

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: java
+// expected: Unsafe deserialization via ObjectInputStream reading from Redis cache
+
+import java.io.*;
+import java.util.Base64;
+import redis.clients.jedis.Jedis;
+
+public class CacheService {
+    private final Jedis jedis;
+
+    public CacheService(Jedis jedis) { this.jedis = jedis; }
+
+    public Object get(String key) throws Exception {
+        String raw = jedis.get(key);
+        if (raw == null) return null;
+        byte[] bytes = Base64.getDecoder().decode(raw);
+        // Vulnerable: deserializes data from Redis without class allowlist
+        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
+            return ois.readObject();
+        }
+    }
+
+    public void put(String key, Serializable value) throws Exception {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        new ObjectOutputStream(bos).writeObject(value);
+        jedis.set(key, Base64.getEncoder().encodeToString(bos.toByteArray()));
+    }
+}

package/dist/packages/crucible/seeds/java/seed-044.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via XMLReader without disabling external entities or DOCTYPE processing
+
+import org.xml.sax.*;
+import org.xml.sax.helpers.XMLReaderFactory;
+import java.io.StringReader;
+import javax.servlet.http.*;
+
+public class XmlImportServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        String xmlBody = new String(req.getInputStream().readAllBytes());
+        // Vulnerable: XMLReader with default settings processes external entities
+        XMLReader reader = XMLReaderFactory.createXMLReader();
+        reader.setContentHandler(new org.xml.sax.helpers.DefaultHandler());
+        reader.parse(new InputSource(new StringReader(xmlBody)));
+        resp.getWriter().println("XML processed");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-045.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via DocumentBuilderFactory without disabling external entity expansion
+
+import javax.xml.parsers.*;
+import org.w3c.dom.*;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class DataImportServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        // Vulnerable: DocumentBuilderFactory default allows XXE
+        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+        DocumentBuilder db = dbf.newDocumentBuilder();
+        Document doc = db.parse(req.getInputStream());
+        NodeList items = doc.getElementsByTagName("item");
+        PrintWriter out = resp.getWriter();
+        for (int i = 0; i < items.getLength(); i++) {
+            out.println("Item: " + items.item(i).getTextContent());
+        }
+    }
+}

package/dist/packages/crucible/seeds/java/seed-046.java

@@ -0,0 +1,22 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via SAXParser without secure processing feature enabled
+
+import javax.xml.parsers.*;
+import org.xml.sax.helpers.DefaultHandler;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class FeedParserServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        // Vulnerable: SAXParserFactory default config allows external entity inclusion
+        SAXParserFactory factory = SAXParserFactory.newInstance();
+        SAXParser parser = factory.newSAXParser();
+        DefaultHandler handler = new DefaultHandler();
+        parser.parse(req.getInputStream(), handler);
+        resp.getWriter().println("Feed parsed");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-047.java

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: xxe
+// severity: critical
+// language: java
+// expected: XXE via JAXB Unmarshaller processing user-supplied XML without secure settings
+
+import javax.xml.bind.*;
+import java.io.*;
+import javax.servlet.http.*;
+
+public class OrderUnmarshalServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws Exception {
+        // Vulnerable: JAXB uses DocumentBuilderFactory internally; XXE possible by default
+        JAXBContext ctx = JAXBContext.newInstance(Order.class);
+        Unmarshaller um = ctx.createUnmarshaller();
+        Object result = um.unmarshal(req.getInputStream());
+        resp.getWriter().println("Received order: " + result);
+    }
+
+    static class Order {
+        public String id;
+        public String product;
+        public int quantity;
+    }
+}

package/dist/packages/crucible/seeds/java/seed-048.java

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: java
+// expected: SSRF via URL.openConnection with user-supplied URL parameter
+
+import java.io.*;
+import java.net.*;
+import javax.servlet.http.*;
+
+public class ProxyServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String targetUrl = req.getParameter("url");
+        // Vulnerable: opens connection to any URL including internal services
+        URL url = new URL(targetUrl);
+        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+        conn.setConnectTimeout(5000);
+        conn.setReadTimeout(5000);
+        InputStream is = conn.getInputStream();
+        resp.setContentType(conn.getContentType());
+        is.transferTo(resp.getOutputStream());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-049.java

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: java
+// expected: SSRF via URL.openStream with user-controlled webhook URL
+
+import java.io.*;
+import java.net.*;
+import javax.servlet.http.*;
+
+public class WebhookTesterServlet extends HttpServlet {
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String webhookUrl = req.getParameter("webhook_url");
+        String payload    = req.getParameter("payload");
+        // Vulnerable: attacker can direct the server to POST to internal endpoints
+        URL url = new URL(webhookUrl);
+        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+        conn.setRequestMethod("POST");
+        conn.setDoOutput(true);
+        conn.setRequestProperty("Content-Type", "application/json");
+        try (OutputStream os = conn.getOutputStream()) {
+            os.write(payload.getBytes());
+        }
+        int code = conn.getResponseCode();
+        resp.getWriter().println("Webhook responded: " + code);
+    }
+}

package/dist/packages/crucible/seeds/java/seed-050.java

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: ssrf
+// severity: high
+// language: java
+// expected: SSRF via HttpClient built from user-supplied base URL for metadata fetch
+
+import java.net.*;
+import java.net.http.*;
+import java.time.Duration;
+import javax.servlet.http.*;
+import java.io.*;
+
+public class MetadataFetcherServlet extends HttpServlet {
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException, InterruptedException {
+        String endpoint = req.getParameter("endpoint");
+        // Vulnerable: endpoint could be http://169.254.169.254/latest/meta-data/
+        HttpClient client = HttpClient.newBuilder()
+            .connectTimeout(Duration.ofSeconds(3))
+            .build();
+        HttpRequest httpReq = HttpRequest.newBuilder()
+            .uri(URI.create(endpoint))
+            .GET()
+            .build();
+        HttpResponse<String> response = client.send(httpReq, HttpResponse.BodyHandlers.ofString());
+        resp.setContentType("text/plain");
+        resp.getWriter().write(response.body());
+    }
+}

package/dist/packages/crucible/seeds/java/seed-051.java

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: log_injection
+// severity: medium
+// language: java
+// expected: Log injection via logger.info with unvalidated user input enabling log forging
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.servlet.http.*;
+import java.io.IOException;
+
+public class LoginAuditServlet extends HttpServlet {
+    private static final Logger logger = LoggerFactory.getLogger(LoginAuditServlet.class);
+
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String username = req.getParameter("username");
+        String ip       = req.getHeader("X-Forwarded-For");
+        // Vulnerable: attacker-controlled input logged without sanitization
+        // e.g. username = "admin\nINFO: Successful login for admin"
+        logger.info("Login attempt for user: " + username + " from IP: " + ip);
+        // ... authentication logic
+        resp.getWriter().println("Login processed");
+    }
+}

package/dist/packages/crucible/seeds/java/seed-052.java

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: log_injection
+// severity: medium
+// language: java
+// expected: Log injection via logger.error with exception message containing user input
+
+import org.apache.log4j.Logger;
+import javax.servlet.http.*;
+import java.io.IOException;
+
+public class ApiGatewayServlet extends HttpServlet {
+    private static final Logger log = Logger.getLogger(ApiGatewayServlet.class);
+
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws IOException {
+        String apiKey  = req.getParameter("api_key");
+        String method  = req.getParameter("method");
+        // Vulnerable: method and apiKey injected into log entries without stripping CR/LF
+        log.warn("API call - method: " + method + ", key: " + apiKey);
+        try {
+            dispatch(method, apiKey);
+        } catch (Exception e) {
+            // Vulnerable: exception message may contain user input
+            log.error("Dispatch failed for method: " + method + " - " + e.getMessage());
+            resp.sendError(500);
+        }
+    }
+
+    private void dispatch(String method, String key) throws Exception {
+        if (method == null) throw new Exception("Unknown method: " + method);
+    }
+}

package/dist/packages/crucible/seeds/js/seed-001.js

@@ -0,0 +1,27 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded API key AWS_SECRET_ACCESS_KEY
+
+const AWS = require('aws-sdk');
+
+// Production credentials - do not commit!
+const credentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1'
+};
+
+AWS.config.update(credentials);
+const s3 = new AWS.S3();
+
+function uploadFile(buffer, key) {
+  return s3.putObject({
+    Bucket: 'my-production-bucket',
+    Key: key,
+    Body: buffer,
+  }).promise();
+}
+
+module.exports = { s3, uploadFile };

package/dist/packages/crucible/seeds/js/seed-002.js

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded database password in connection string
+
+const { Pool } = require('pg');
+
+const pool = new Pool({
+  host: 'prod-db.internal.company.com',
+  port: 5432,
+  database: 'users_production',
+  user: 'db_admin',
+  password: 'Sup3rS3cr3tPa$$w0rd!',
+  ssl: { rejectUnauthorized: false },
+});
+
+async function getUser(id) {
+  const result = await pool.query('SELECT * FROM users WHERE id = $1', [id]);
+  return result.rows[0];
+}
+
+async function listUsers() {
+  const result = await pool.query('SELECT id, email, created_at FROM users');
+  return result.rows;
+}
+
+module.exports = { pool, getUser, listUsers };

package/dist/packages/crucible/seeds/js/seed-003.js

@@ -0,0 +1,30 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded JWT secret used to sign tokens
+
+const jwt = require('jsonwebtoken');
+
+const JWT_SECRET = 'my-super-secret-jwt-key-do-not-share-1234';
+const JWT_REFRESH_SECRET = 'refresh-secret-key-also-private-5678';
+
+function generateTokens(userId, role) {
+  const accessToken = jwt.sign(
+    { userId, role },
+    JWT_SECRET,
+    { expiresIn: '15m' }
+  );
+  const refreshToken = jwt.sign(
+    { userId },
+    JWT_REFRESH_SECRET,
+    { expiresIn: '7d' }
+  );
+  return { accessToken, refreshToken };
+}
+
+function verifyToken(token) {
+  return jwt.verify(token, JWT_SECRET);
+}
+
+module.exports = { generateTokens, verifyToken };

package/dist/packages/crucible/seeds/js/seed-004.js

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: javascript
+// expected: hardcoded Stripe API secret key
+
+const stripe = require('stripe');
+
+// TODO: move this to env vars before going to prod
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripeClient = stripe(STRIPE_SECRET_KEY);
+
+async function createPaymentIntent(amount, currency = 'usd') {
+  const intent = await stripeClient.paymentIntents.create({
+    amount,
+    currency,
+    automatic_payment_methods: { enabled: true },
+  });
+  return intent.client_secret;
+}
+
+async function handleWebhook(payload, sig) {
+  return stripeClient.webhooks.constructEvent(payload, sig, STRIPE_WEBHOOK_SECRET);
+}
+
+module.exports = { createPaymentIntent, handleWebhook };