Accept a payment

// Take a BRC-29 payment from the user's wallet and receive it into the server's wallet.
import type { Request, Response } from 'express'
import { PrivateKey, Transaction, Utils, createNonce, verifyNonce } from '@bsv/sdk'
import { SetupClient, type Wallet } from '@bsv/wallet-toolbox-client'
import { SERVER_PRIVATE_KEY, BSV_NETWORK } from './bsv/config.js'

const PRICE = 1000 // satoshis

// Same key as the ProtoWallet in index.ts, so the identity key clients see doesn't change.
let wallet: Promise<Wallet> | undefined
function paymentWallet (): Promise<Wallet> {
  wallet ??= SetupClient.createWalletClientNoEnv({
    chain: BSV_NETWORK === 'main' ? 'main' : 'test',
    rootKeyHex: PrivateKey.fromString(SERVER_PRIVATE_KEY).toHex()
  })
  return wallet
}

const usedTxids = new Set<string>() // use your database in production

export async function payRoute (req: Request, res: Response): Promise<void> {
  const server = await paymentWallet()
  const payment = req.body?.payment

  // 1. No payment yet: say what it costs, and hand out a one-time derivation prefix.
  if (payment == null) {
    const derivationPrefix = await createNonce(server)
    res.status(402).json({ satoshisRequired: PRICE, derivationPrefix })
    return
  }

  const { derivationPrefix, derivationSuffix, transaction, senderIdentityKey } = payment
  if (typeof derivationPrefix !== 'string' || typeof derivationSuffix !== 'string' ||
      typeof transaction !== 'string' || typeof senderIdentityKey !== 'string') {
    res.status(400).json({ error: 'malformed payment' })
    return
  }

  // 2. The prefix must be one this server issued.
  if (!await verifyNonce(derivationPrefix, server).catch(() => false)) {
    res.status(400).json({ error: 'unknown derivation prefix' })
    return
  }

  // 3. Output 0 must pay at least the price, and each transaction only counts once.
  let txid: string
  try {
    const tx = Transaction.fromAtomicBEEF(Utils.toArray(transaction, 'base64'))
    txid = tx.id('hex')
    if ((tx.outputs[0]?.satoshis ?? 0) < PRICE) throw new Error('underpaid')
  } catch {
    res.status(402).json({ error: 'payment does not cover the price', satoshisRequired: PRICE })
    return
  }
  if (usedTxids.has(txid)) {
    res.status(409).json({ error: 'payment already used' })
    return
  }
  usedTxids.add(txid)

  // 4. The wallet checks the proofs, checks output 0 is locked to its own BRC-29 key, and keeps it.
  try {
    await server.internalizeAction({
      tx: Utils.toArray(transaction, 'base64'),
      outputs: [{
        outputIndex: 0,
        protocol: 'wallet payment',
        paymentRemittance: { derivationPrefix, derivationSuffix, senderIdentityKey }
      }],
      description: 'Payment for premium content'
    })
  } catch {
    usedTxids.delete(txid)
    res.status(400).json({ error: 'payment rejected' })
    return
  }

  res.json({ paid: PRICE, txid, from: senderIdentityKey })
}

import { useState } from 'react'
import { P2PKH, PublicKey, Random, Utils } from '@bsv/sdk'
import { useWallet } from './bsv/WalletContext.js'
import { getServerIdentity } from './bsv/serverIdentity.js'
import { apiFetch, readApiJson } from './bsv/apiClient.js'

const post = (body: unknown) => apiFetch('/api/pay', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify(body)
})

export function PayButton () {
  const { wallet, identityKey } = useWallet()
  const [status, setStatus] = useState('')

  async function pay () {
    if (wallet === null || identityKey === null) return
    try {
      // 1. Ask the server for the price and a one-time derivation prefix.
      const quote = await readApiJson(await post({})) as { satoshisRequired: number, derivationPrefix: string }
      const { satoshisRequired, derivationPrefix } = quote

      // 2. Derive a fresh key that only the server can spend (BRC-29).
      const derivationSuffix = Utils.toBase64(Random(16))
      const { publicKey } = await wallet.getPublicKey({
        protocolID: [2, '3241645161d8'],
        keyID: `${derivationPrefix} ${derivationSuffix}`,
        counterparty: await getServerIdentity()
      })

      // 3. The wallet asks the user to approve, then builds and signs the transaction.
      const { tx } = await wallet.createAction({
        description: 'Unlock premium content',
        outputs: [{
          lockingScript: new P2PKH().lock(PublicKey.fromString(publicKey).toAddress()).toHex(),
          satoshis: satoshisRequired,
          outputDescription: 'Payment to the app'
        }],
        options: { randomizeOutputs: false } // keep the payment at output 0
      })
      if (tx === undefined) throw new Error('wallet returned no transaction')

      // 4. Hand the transaction to the server, which receives it into its own wallet.
      const res = await post({
        payment: { derivationPrefix, derivationSuffix, transaction: Utils.toBase64(tx), senderIdentityKey: identityKey }
      })
      setStatus(res.ok ? 'Paid. Thank you!' : `Payment failed (${res.status})`)
    } catch (e) {
      setStatus(e instanceof Error ? e.message : String(e))
    }
  }

  if (wallet === null) return null
  return (
    <>
      <button onClick={() => { void pay() }}>Pay 1000 satoshis</button>
      <p role="status">{status}</p>
    </>
  )
}