Embed AfriLink Pay in Minutes

// 2a. NFC path — read wearable with Web NFC API (Chrome Android)
if ('NDEFReader' in window) {
  const reader = new NDEFReader();
  await reader.scan();
  reader.onreading = async ({ message }) => {
    const url = message.records.find(r => r.recordType === 'url');
    const tagId = new URL(url.toText()).searchParams.get('id');

    // 2b. Submit the tap to resolve payer + debit wallet
    await fetch(`/api/pos/sessions/${sessionId}/tap`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Authorization': 'Bearer <merchant_api_key>'
      },
      body: JSON.stringify({ tagId })
    });
  };
}

// 2c. Manual fallback — payer types their @handle or scans QR
await fetch(`/api/pos/sessions/${sessionId}/tap`, {
  method: 'POST',
  headers: { /* … */ },
  body: JSON.stringify({ payerHandle: '@amara' })   // QR or typed
});

// 3. Poll session status (or use webhooks instead)
async function pollSession(sessionId, apiKey) {
  for (let i = 0; i < 18; i++) {          // up to 90 s
    const r = await fetch(`/api/pos/sessions/${sessionId}`, {
      headers: { 'Authorization': `Bearer ${apiKey}` }
    });
    const { status, payerHandle, completedAt } = await r.json();

    if (status === 'completed') { showSuccess(payerHandle); return; }
    if (['failed','expired','cancelled'].includes(status)) {
      showError(status); return;
    }
    await new Promise(r => setTimeout(r, 5000));   // wait 5 s
  }
}

// 4. Webhook payload — POST to your registered endpoint
{
  "event":      "pos.session.completed",
  "sessionId":  "pos_abc123",
  "merchantId": "m_xyz",
  "amount":     5000,
  "currency":   "KES",
  "payerHandle":"@amara",
  "completedAt":"2026-05-26T14:02:11Z"
}

// Verify signature — always validate before acting
const crypto = require('crypto');
const sig  = req.headers['x-afrilink-signature'];  // sha256={hmac}
const hmac = 'sha256=' + crypto
  .createHmac('sha256', process.env.WEBHOOK_SECRET)
  .update(req.rawBody)
  .digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(hmac)))
  return res.status(403).end();             // reject tampered payloads

// 2. Public verify — no auth. Confirms validity without revealing the issuer.
const r = await fetch('/api/gift-cards/verify?code=AFL-1A2B-3C4D-5E6F-7A8B');
const info = await r.json();
// { valid, amount, currency, expiresAt, hasPin, locked }
if (!info.valid) showError('This card is not redeemable');

// 3. Redeem — credits the caller's wallet in the card currency
const res = await fetch('/api/merchant/gift-cards/redeem', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-merchant-api-key': '<merchant_api_key>'
  },
  body: JSON.stringify({
    code:           'AFL-1A2B-3C4D-5E6F-7A8B',
    pinCode:        '4821',        // only if the card has a PIN
    redeemAmount:   20,            // optional (Phase 2) — partial redeem; omit = full remaining
    targetCurrency: 'NGN'          // optional (Phase 2) — credit in another currency at live FX
  })
});
const out = await res.json();
// { ok, amountDrawn, cardCurrency, creditedAmount, creditedCurrency,
//   fxRate, remaining, fullyRedeemed, amount, currency, message }
// Partial: card stays active with `remaining` > 0 until fully drawn.
// 409 already redeemed/cancelled · 410 expired · 422 amount > remaining · 403 PIN/lock

// 4. Bulk issue up to 100 cards (promotions, payroll rewards)
const res = await fetch('/api/merchant/gift-cards/bulk', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-merchant-api-key': '<merchant_api_key>'
  },
  body: JSON.stringify({
    count:           25,            // 1–100
    amount:          20,
    currency:        'GHS',
    designTheme:     'business',
    expiresInMonths: 6
  })
});
const { batchId, cards } = await res.json();
// cards: [{ id, code, qrPng }, …] — all share the same batchId

// 5a. Admin: list / filter all gift cards
await fetch('/api/admin/gift-cards?status=active&issuerType=merchant&page=1&limit=50', {
  headers: { 'x-admin-api-key': '<admin_api_key>' }
});

// 5b. Admin: aggregate stats
await fetch('/api/admin/gift-cards/stats', {
  headers: { 'x-admin-api-key': '<admin_api_key>' }
});
// { total, active, redeemed, expired, cancelled, totalValueIssued, totalValueRedeemed }

// 5c. Admin: force-cancel or refund an active card back to the issuer
await fetch('/api/admin/gift-cards/<id>', {
  method: 'PATCH',
  headers: {
    'Content-Type': 'application/json',
    'x-admin-api-key': '<admin_api_key>'
  },
  body: JSON.stringify({ action: 'refund' })   // 'cancel' | 'refund'
});