Quickstart

// Server only: never import this file into code that runs in the browser.
const NORELIO_API = "https://app.norelio.eu";

async function norelio<T>(path: string, init: RequestInit = {}): Promise<T> {
  // The key comes from the server environment (NORELIO_API_KEY).
  // Never name it NEXT_PUBLIC_NORELIO_API_KEY: such variables are bundled into browser code.
  const apiKey = process.env.NORELIO_API_KEY;
  if (!apiKey) throw new Error("NORELIO_API_KEY is not set");

  const response = await fetch(`${NORELIO_API}${path}`, {
    ...init,
    headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
    cache: "no-store",
  });
  const body = await response.json();

  if (!response.ok) {
    // Every API error has one shape: { error: { code, message } }.
    throw new Error(`Norelio ${response.status} ${body.error?.code}: ${body.error?.message}`);
  }

  return body as T;
}

export type CheckoutRequest = {
  productId: string;
  clientReference: string;
  customerEmail?: string;
  returnUrl?: string;
  buyer?: { ip?: string; userAgent?: string };
  packageId?: number;
  amount?: number;
};

export type Checkout = {
  id: string;
  url: string;
  expiresAt: string;
  clientReference: string;
  warnings: { code: string; message: string }[];
  credits: number | null;
  creditsUnit: string | null;
  test: boolean;
};

export function createCheckout(body: CheckoutRequest) {
  return norelio<Checkout>("/api/v1/checkouts", { method: "POST", body: JSON.stringify(body) });
}

import { isIP } from "node:net";
import { getCurrentUser } from "@/lib/auth"; // your own sign-in: who is paying
import { createCheckout } from "@/lib/norelio";

export async function POST(request: Request) {
  const user = await getCurrentUser();
  if (!user) return new Response(null, { status: 401 });

  const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "";

  const checkout = await createCheckout({
    productId: process.env.NORELIO_PRODUCT_ID!,
    clientReference: String(user.id),
    customerEmail: user.email,
    // The user's IP address and browser, for the consent record.
    buyer: {
      ip: isIP(ip) ? ip : undefined,
      userAgent: request.headers.get("user-agent") ?? undefined,
    },
    // Top-up product: add packageId (package number) or amount (minor units).
  });

  // A normal browser navigation to the payment page; the address is single-use.
  return Response.redirect(checkout.url, 303);
}

// The user's Pay button posts to the route above.
export default function PricingPage() {
  return (
    <form action="/api/checkout" method="post">
      <button type="submit">Pay</button>
    </form>
  );
}

import crypto from "node:crypto";

export function verifyNorelioWebhook(rawBody: string, headers: Headers, secret: string | undefined): boolean {
  const id = headers.get("x-norelio-webhook-id");
  const timestamp = headers.get("x-norelio-webhook-timestamp");
  const signature = headers.get("x-norelio-webhook-signature"); // "v1,<base64>"
  if (!id || !timestamp || !signature || !secret) return false;

  // not older than 300 seconds: replay protection
  const sentAt = Number(timestamp);
  if (!Number.isInteger(sentAt) || Math.abs(Date.now() / 1000 - sentAt) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest();
  const [scheme, value] = signature.split(",");
  if (scheme !== "v1" || !value) return false;
  const received = Buffer.from(value, "base64");

  // constant-time comparison: a plain equality check lets the signature
  // be guessed from the response time
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

import { handleNorelioEvent } from "@/lib/norelio-events"; // step 7, or your own code for one-off purchases and subscriptions
import { verifyNorelioWebhook } from "@/lib/norelio-webhook";

export const runtime = "nodejs";

export async function POST(request: Request) {
  // The RAW body, before any JSON parsing: the signature covers exactly these bytes.
  const rawBody = await request.text();

  if (!verifyNorelioWebhook(rawBody, request.headers, process.env.NORELIO_WEBHOOK_SECRET)) {
    return new Response(null, { status: 401 });
  }

  const payload = JSON.parse(rawBody);

  // A test notification from the cabinet: nothing to grant or credit.
  if (payload.test !== true) {
    await handleNorelioEvent(payload);
  }

  return new Response(null, { status: 200 });
}

export type CustomerState = {
  subscriptions: {
    id: string;
    productId: string;
    status: "active" | "past_due" | "canceled" | "ended";
    validUntil: string | null;
    currentPeriodEnd: string | null;
    cancelAtPeriodEnd: boolean;
    clientReference: string | null;
  }[];
  purchases: {
    orderId: string;
    productId: string | null;
    paidAt: string | null;
    amount: number;
    currency: string;
    status: "paid" | "refunded" | "disputed";
    clientReference: string | null;
    refunded: boolean;
    credits: number | null;
    creditsUnit: string | null;
  }[];
};

export function getCustomerState(clientReference: string) {
  const query = new URLSearchParams({ clientReference });
  return norelio<CustomerState>(`/api/v1/customers/state?${query}`);
}

import { getCurrentUser } from "@/lib/auth";
import { getCustomerState } from "@/lib/norelio";

export default async function AccountPage() {
  const user = await getCurrentUser();
  if (!user) return null;

  // Subscriptions and purchases of this user, newest first.
  const { purchases } = await getCustomerState(String(user.id));

  return (
    <ul>
      {purchases.map((purchase) => (
        <li key={purchase.orderId}>
          {purchase.productId}: {purchase.status}
          {purchase.credits !== null ? ` (${purchase.credits} ${purchase.creditsUnit})` : null}
        </li>
      ))}
    </ul>
  );
}

import { Pool } from "pg";

// Your database (PostgreSQL here) remembers processed events in this table:
// CREATE TABLE norelio_events (
//   event_id TEXT PRIMARY KEY
// );
const pool = new Pool();

type NorelioWebhookPayload = {
  eventId: string;
  event: string;
  amount: number;
  clientReference: string | null;
  credits: number | null;
  refundedAmount: number | null;
};

function creditsChange(payload: NorelioWebhookPayload, credits: number): number {
  if (payload.event === "order.paid") return credits; // payment confirmed: add the credits
  if (payload.event === "order.refunded_full") return -credits; // full refund: remove the credits of this order
  // Partial refunds: remove credits in proportion to the refunded share; see the Top-ups section.
  return 0;
}

export async function handleNorelioEvent(payload: NorelioWebhookPayload) {
  // Not a top-up: grant or close access your own way.
  if (payload.credits === null || payload.clientReference === null) return;

  const change = creditsChange(payload, payload.credits);
  if (change === 0) return;

  // One transaction: the event mark and the credits commit together or not at all.
  const client = await pool.connect();
  try {
    await client.query("BEGIN");
    // Idempotency by eventId: a repeated delivery inserts nothing and credits nothing.
    const inserted = await client.query(
      "INSERT INTO norelio_events (event_id) VALUES ($1) ON CONFLICT DO NOTHING",
      [payload.eventId],
    );
    if (inserted.rowCount === 1) {
      await client.query("UPDATE accounts SET credits = credits + $1 WHERE id = $2", [
        change,
        payload.clientReference,
      ]);
    }
    await client.query("COMMIT");
  } catch (error) {
    await client.query("ROLLBACK");
    throw error;
  } finally {
    client.release();
  }
}