thuban 0.4.10 → 0.4.12

package/packages/crucible/seeds/java/seed-033.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: path_traversal
-// severity: high
-// language: java
-// expected: Path traversal via file write using user-supplied output path
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class ReportWriterServlet extends HttpServlet {
-    private static final String REPORT_BASE = "/var/reports/";
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String reportName = req.getParameter("reportName");
-        String content    = req.getParameter("content");
-        // Vulnerable: reportName can traverse directories (../../etc/cron.d/backdoor)
-        File out = new File(REPORT_BASE + reportName + ".txt");
-        try (FileWriter fw = new FileWriter(out)) {
-            fw.write(content);
-        }
-        resp.getWriter().println("Report saved.");
-    }
-}

package/packages/crucible/seeds/java/seed-034.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: MD5 used for password hashing via MessageDigest
-
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-
-public class PasswordHasher {
-    public static String hashPassword(String password) throws NoSuchAlgorithmException {
-        // Vulnerable: MD5 is cryptographically broken and unsalted
-        MessageDigest md = MessageDigest.getInstance("MD5");
-        byte[] hash = md.digest(password.getBytes());
-        StringBuilder sb = new StringBuilder();
-        for (byte b : hash) sb.append(String.format("%02x", b));
-        return sb.toString();
-    }
-
-    public static boolean verifyPassword(String password, String storedHash)
-            throws NoSuchAlgorithmException {
-        return hashPassword(password).equals(storedHash);
-    }
-}

package/packages/crucible/seeds/java/seed-035.java

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: critical
-// language: java
-// expected: DES cipher used for data encryption (56-bit key, broken algorithm)
-
-import javax.crypto.*;
-import javax.crypto.spec.SecretKeySpec;
-import java.util.Base64;
-
-public class DataEncryptor {
-    // Vulnerable: DES uses only 56-bit key, broken since 1999
-    private static final String ALGORITHM = "DES";
-    private static final byte[] KEY_BYTES = "8byteKey".getBytes();
-
-    public static String encrypt(String plaintext) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
-        Cipher cipher = Cipher.getInstance(ALGORITHM);
-        cipher.init(Cipher.ENCRYPT_MODE, key);
-        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
-    }
-
-    public static String decrypt(String ciphertext) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(KEY_BYTES, ALGORITHM);
-        Cipher cipher = Cipher.getInstance(ALGORITHM);
-        cipher.init(Cipher.DECRYPT_MODE, key);
-        return new String(cipher.doFinal(Base64.getDecoder().decode(ciphertext)));
-    }
-}

package/packages/crucible/seeds/java/seed-036.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: java.util.Random used for security token generation instead of SecureRandom
-
-import java.util.Random;
-
-public class TokenGenerator {
-    // Vulnerable: java.util.Random is not cryptographically secure
-    private static final Random RANDOM = new Random();
-    private static final String CHARS  = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-
-    public static String generateSessionToken(int length) {
-        StringBuilder sb = new StringBuilder(length);
-        for (int i = 0; i < length; i++) {
-            sb.append(CHARS.charAt(RANDOM.nextInt(CHARS.length())));
-        }
-        return sb.toString();
-    }
-
-    public static String generatePasswordResetToken() {
-        return generateSessionToken(32);
-    }
-}

package/packages/crucible/seeds/java/seed-037.java

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: SHA-1 used for HMAC signature and MD5 for file integrity check
-
-import java.security.MessageDigest;
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
-
-public class IntegrityChecker {
-    public static String computeHmac(String data, String key) throws Exception {
-        // Vulnerable: HMAC-SHA1 is weak for new applications
-        Mac mac = Mac.getInstance("HmacSHA1");
-        mac.init(new SecretKeySpec(key.getBytes(), "HmacSHA1"));
-        byte[] raw = mac.doFinal(data.getBytes());
-        StringBuilder sb = new StringBuilder();
-        for (byte b : raw) sb.append(String.format("%02x", b));
-        return sb.toString();
-    }
-
-    public static String md5File(byte[] fileBytes) throws Exception {
-        // Vulnerable: MD5 used for file integrity — collision attacks possible
-        MessageDigest md = MessageDigest.getInstance("MD5");
-        byte[] hash = md.digest(fileBytes);
-        StringBuilder sb = new StringBuilder();
-        for (byte b : hash) sb.append(String.format("%02x", b));
-        return sb.toString();
-    }
-}

package/packages/crucible/seeds/java/seed-038.java

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: insecure_crypto
-// severity: high
-// language: java
-// expected: AES-ECB mode used for encryption (ECB leaks patterns, no IV)
-
-import javax.crypto.*;
-import javax.crypto.spec.SecretKeySpec;
-import java.util.Base64;
-
-public class AesEcbEncryptor {
-    // Vulnerable: AES/ECB/PKCS5Padding does not use an IV and leaks data patterns
-    private static final String CIPHER_SPEC = "AES/ECB/PKCS5Padding";
-    private static final String SECRET_KEY  = "1234567890abcdef"; // 16 bytes
-
-    public static String encrypt(String plaintext) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
-        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
-        cipher.init(Cipher.ENCRYPT_MODE, key);
-        return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes()));
-    }
-
-    public static String decrypt(String ct) throws Exception {
-        SecretKeySpec key = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
-        Cipher cipher = Cipher.getInstance(CIPHER_SPEC);
-        cipher.init(Cipher.DECRYPT_MODE, key);
-        return new String(cipher.doFinal(Base64.getDecoder().decode(ct)));
-    }
-}

package/packages/crucible/seeds/java/seed-039.java

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization via ObjectInputStream.readObject on untrusted data
-
-import java.io.*;
-import javax.servlet.http.*;
-
-public class SessionRestoreServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        // Vulnerable: deserializes raw bytes from request body — no type checking
-        InputStream body = req.getInputStream();
-        ObjectInputStream ois = new ObjectInputStream(body);
-        Object sessionData;
-        try {
-            sessionData = ois.readObject();
-        } catch (ClassNotFoundException e) {
-            resp.sendError(400, "Unknown class");
-            return;
-        }
-        req.getSession().setAttribute("data", sessionData);
-        resp.getWriter().println("Session restored");
-    }
-}

package/packages/crucible/seeds/java/seed-040.java

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization of Base64-decoded cookie value via ObjectInputStream
-
-import java.io.*;
-import java.util.Base64;
-import javax.servlet.http.*;
-
-public class RememberMeServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        Cookie[] cookies = req.getCookies();
-        for (Cookie c : cookies) {
-            if ("rememberMe".equals(c.getName())) {
-                byte[] data = Base64.getDecoder().decode(c.getValue());
-                // Vulnerable: deserializes attacker-controlled cookie bytes
-                try (ObjectInputStream ois = new ObjectInputStream(
-                        new ByteArrayInputStream(data))) {
-                    Object principal = ois.readObject();
-                    req.getSession().setAttribute("user", principal);
-                } catch (ClassNotFoundException e) {
-                    resp.sendError(400);
-                }
-                break;
-            }
-        }
-        resp.sendRedirect("/dashboard");
-    }
-}

package/packages/crucible/seeds/java/seed-041.java

@@ -1,20 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization via XMLDecoder on user-supplied XML
-
-import java.beans.XMLDecoder;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class XmlConfigServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        // Vulnerable: XMLDecoder can execute arbitrary Java code via crafted XML
-        XMLDecoder decoder = new XMLDecoder(req.getInputStream());
-        Object config = decoder.readObject();
-        decoder.close();
-        resp.getWriter().println("Loaded config: " + config.getClass().getName());
-    }
-}

package/packages/crucible/seeds/java/seed-042.java

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization in JMS message listener via ObjectMessage
-
-import javax.jms.*;
-
-public class OrderMessageListener implements MessageListener {
-    @Override
-    public void onMessage(Message message) {
-        try {
-            if (message instanceof ObjectMessage) {
-                // Vulnerable: ObjectMessage.getObject() deserializes untrusted JMS payload
-                Object payload = ((ObjectMessage) message).getObject();
-                processOrder(payload);
-            }
-        } catch (JMSException e) {
-            e.printStackTrace();
-        }
-    }
-
-    private void processOrder(Object order) {
-        System.out.println("Processing: " + order);
-    }
-}

package/packages/crucible/seeds/java/seed-043.java

@@ -1,31 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: java
-// expected: Unsafe deserialization via ObjectInputStream reading from Redis cache
-
-import java.io.*;
-import java.util.Base64;
-import redis.clients.jedis.Jedis;
-
-public class CacheService {
-    private final Jedis jedis;
-
-    public CacheService(Jedis jedis) { this.jedis = jedis; }
-
-    public Object get(String key) throws Exception {
-        String raw = jedis.get(key);
-        if (raw == null) return null;
-        byte[] bytes = Base64.getDecoder().decode(raw);
-        // Vulnerable: deserializes data from Redis without class allowlist
-        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
-            return ois.readObject();
-        }
-    }
-
-    public void put(String key, Serializable value) throws Exception {
-        ByteArrayOutputStream bos = new ByteArrayOutputStream();
-        new ObjectOutputStream(bos).writeObject(value);
-        jedis.set(key, Base64.getEncoder().encodeToString(bos.toByteArray()));
-    }
-}

package/packages/crucible/seeds/java/seed-044.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via XMLReader without disabling external entities or DOCTYPE processing
-
-import org.xml.sax.*;
-import org.xml.sax.helpers.XMLReaderFactory;
-import java.io.StringReader;
-import javax.servlet.http.*;
-
-public class XmlImportServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        String xmlBody = new String(req.getInputStream().readAllBytes());
-        // Vulnerable: XMLReader with default settings processes external entities
-        XMLReader reader = XMLReaderFactory.createXMLReader();
-        reader.setContentHandler(new org.xml.sax.helpers.DefaultHandler());
-        reader.parse(new InputSource(new StringReader(xmlBody)));
-        resp.getWriter().println("XML processed");
-    }
-}

package/packages/crucible/seeds/java/seed-045.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via DocumentBuilderFactory without disabling external entity expansion
-
-import javax.xml.parsers.*;
-import org.w3c.dom.*;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class DataImportServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        // Vulnerable: DocumentBuilderFactory default allows XXE
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        DocumentBuilder db = dbf.newDocumentBuilder();
-        Document doc = db.parse(req.getInputStream());
-        NodeList items = doc.getElementsByTagName("item");
-        PrintWriter out = resp.getWriter();
-        for (int i = 0; i < items.getLength(); i++) {
-            out.println("Item: " + items.item(i).getTextContent());
-        }
-    }
-}

package/packages/crucible/seeds/java/seed-046.java

@@ -1,22 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via SAXParser without secure processing feature enabled
-
-import javax.xml.parsers.*;
-import org.xml.sax.helpers.DefaultHandler;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class FeedParserServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        // Vulnerable: SAXParserFactory default config allows external entity inclusion
-        SAXParserFactory factory = SAXParserFactory.newInstance();
-        SAXParser parser = factory.newSAXParser();
-        DefaultHandler handler = new DefaultHandler();
-        parser.parse(req.getInputStream(), handler);
-        resp.getWriter().println("Feed parsed");
-    }
-}

package/packages/crucible/seeds/java/seed-047.java

@@ -1,26 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: xxe
-// severity: critical
-// language: java
-// expected: XXE via JAXB Unmarshaller processing user-supplied XML without secure settings
-
-import javax.xml.bind.*;
-import java.io.*;
-import javax.servlet.http.*;
-
-public class OrderUnmarshalServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws Exception {
-        // Vulnerable: JAXB uses DocumentBuilderFactory internally; XXE possible by default
-        JAXBContext ctx = JAXBContext.newInstance(Order.class);
-        Unmarshaller um = ctx.createUnmarshaller();
-        Object result = um.unmarshal(req.getInputStream());
-        resp.getWriter().println("Received order: " + result);
-    }
-
-    static class Order {
-        public String id;
-        public String product;
-        public int quantity;
-    }
-}

package/packages/crucible/seeds/java/seed-048.java

@@ -1,24 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: java
-// expected: SSRF via URL.openConnection with user-supplied URL parameter
-
-import java.io.*;
-import java.net.*;
-import javax.servlet.http.*;
-
-public class ProxyServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String targetUrl = req.getParameter("url");
-        // Vulnerable: opens connection to any URL including internal services
-        URL url = new URL(targetUrl);
-        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-        conn.setConnectTimeout(5000);
-        conn.setReadTimeout(5000);
-        InputStream is = conn.getInputStream();
-        resp.setContentType(conn.getContentType());
-        is.transferTo(resp.getOutputStream());
-    }
-}

package/packages/crucible/seeds/java/seed-049.java

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: java
-// expected: SSRF via URL.openStream with user-controlled webhook URL
-
-import java.io.*;
-import java.net.*;
-import javax.servlet.http.*;
-
-public class WebhookTesterServlet extends HttpServlet {
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String webhookUrl = req.getParameter("webhook_url");
-        String payload    = req.getParameter("payload");
-        // Vulnerable: attacker can direct the server to POST to internal endpoints
-        URL url = new URL(webhookUrl);
-        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-        conn.setRequestMethod("POST");
-        conn.setDoOutput(true);
-        conn.setRequestProperty("Content-Type", "application/json");
-        try (OutputStream os = conn.getOutputStream()) {
-            os.write(payload.getBytes());
-        }
-        int code = conn.getResponseCode();
-        resp.getWriter().println("Webhook responded: " + code);
-    }
-}

package/packages/crucible/seeds/java/seed-050.java

@@ -1,29 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: ssrf
-// severity: high
-// language: java
-// expected: SSRF via HttpClient built from user-supplied base URL for metadata fetch
-
-import java.net.*;
-import java.net.http.*;
-import java.time.Duration;
-import javax.servlet.http.*;
-import java.io.*;
-
-public class MetadataFetcherServlet extends HttpServlet {
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException, InterruptedException {
-        String endpoint = req.getParameter("endpoint");
-        // Vulnerable: endpoint could be http://169.254.169.254/latest/meta-data/
-        HttpClient client = HttpClient.newBuilder()
-            .connectTimeout(Duration.ofSeconds(3))
-            .build();
-        HttpRequest httpReq = HttpRequest.newBuilder()
-            .uri(URI.create(endpoint))
-            .GET()
-            .build();
-        HttpResponse<String> response = client.send(httpReq, HttpResponse.BodyHandlers.ofString());
-        resp.setContentType("text/plain");
-        resp.getWriter().write(response.body());
-    }
-}

package/packages/crucible/seeds/java/seed-051.java

@@ -1,25 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: log_injection
-// severity: medium
-// language: java
-// expected: Log injection via logger.info with unvalidated user input enabling log forging
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.servlet.http.*;
-import java.io.IOException;
-
-public class LoginAuditServlet extends HttpServlet {
-    private static final Logger logger = LoggerFactory.getLogger(LoginAuditServlet.class);
-
-    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String username = req.getParameter("username");
-        String ip       = req.getHeader("X-Forwarded-For");
-        // Vulnerable: attacker-controlled input logged without sanitization
-        // e.g. username = "admin\nINFO: Successful login for admin"
-        logger.info("Login attempt for user: " + username + " from IP: " + ip);
-        // ... authentication logic
-        resp.getWriter().println("Login processed");
-    }
-}

package/packages/crucible/seeds/java/seed-052.java

@@ -1,32 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: log_injection
-// severity: medium
-// language: java
-// expected: Log injection via logger.error with exception message containing user input
-
-import org.apache.log4j.Logger;
-import javax.servlet.http.*;
-import java.io.IOException;
-
-public class ApiGatewayServlet extends HttpServlet {
-    private static final Logger log = Logger.getLogger(ApiGatewayServlet.class);
-
-    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-            throws IOException {
-        String apiKey  = req.getParameter("api_key");
-        String method  = req.getParameter("method");
-        // Vulnerable: method and apiKey injected into log entries without stripping CR/LF
-        log.warn("API call - method: " + method + ", key: " + apiKey);
-        try {
-            dispatch(method, apiKey);
-        } catch (Exception e) {
-            // Vulnerable: exception message may contain user input
-            log.error("Dispatch failed for method: " + method + " - " + e.getMessage());
-            resp.sendError(500);
-        }
-    }
-
-    private void dispatch(String method, String key) throws Exception {
-        if (method == null) throw new Exception("Unknown method: " + method);
-    }
-}

package/packages/crucible/seeds/js/seed-001.js

@@ -1,27 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded API key AWS_SECRET_ACCESS_KEY
-
-const AWS = require('aws-sdk');
-
-// Production credentials - do not commit!
-const credentials = {
-  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
-  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-  region: 'us-east-1'
-};
-
-AWS.config.update(credentials);
-const s3 = new AWS.S3();
-
-function uploadFile(buffer, key) {
-  return s3.putObject({
-    Bucket: 'my-production-bucket',
-    Key: key,
-    Body: buffer,
-  }).promise();
-}
-
-module.exports = { s3, uploadFile };

package/packages/crucible/seeds/js/seed-002.js

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded database password in connection string
-
-const { Pool } = require('pg');
-
-const pool = new Pool({
-  host: 'prod-db.internal.company.com',
-  port: 5432,
-  database: 'users_production',
-  user: 'db_admin',
-  password: 'Sup3rS3cr3tPa$$w0rd!',
-  ssl: { rejectUnauthorized: false },
-});
-
-async function getUser(id) {
-  const result = await pool.query('SELECT * FROM users WHERE id = $1', [id]);
-  return result.rows[0];
-}
-
-async function listUsers() {
-  const result = await pool.query('SELECT id, email, created_at FROM users');
-  return result.rows;
-}
-
-module.exports = { pool, getUser, listUsers };

package/packages/crucible/seeds/js/seed-003.js

@@ -1,30 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded JWT secret used to sign tokens
-
-const jwt = require('jsonwebtoken');
-
-const JWT_SECRET = 'my-super-secret-jwt-key-do-not-share-1234';
-const JWT_REFRESH_SECRET = 'refresh-secret-key-also-private-5678';
-
-function generateTokens(userId, role) {
-  const accessToken = jwt.sign(
-    { userId, role },
-    JWT_SECRET,
-    { expiresIn: '15m' }
-  );
-  const refreshToken = jwt.sign(
-    { userId },
-    JWT_REFRESH_SECRET,
-    { expiresIn: '7d' }
-  );
-  return { accessToken, refreshToken };
-}
-
-function verifyToken(token) {
-  return jwt.verify(token, JWT_SECRET);
-}
-
-module.exports = { generateTokens, verifyToken };

package/packages/crucible/seeds/js/seed-004.js

@@ -1,28 +0,0 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: javascript
-// expected: hardcoded Stripe API secret key
-
-const stripe = require('stripe');
-
-// TODO: move this to env vars before going to prod
-const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
-const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
-
-const stripeClient = stripe(STRIPE_SECRET_KEY);
-
-async function createPaymentIntent(amount, currency = 'usd') {
-  const intent = await stripeClient.paymentIntents.create({
-    amount,
-    currency,
-    automatic_payment_methods: { enabled: true },
-  });
-  return intent.client_secret;
-}
-
-async function handleWebhook(payload, sig) {
-  return stripeClient.webhooks.constructEvent(payload, sig, STRIPE_WEBHOOK_SECRET);
-}
-
-module.exports = { createPaymentIntent, handleWebhook };