@tassyir/app

npm install @tassyir/app

import express from 'express';
import { Redis } from 'ioredis';
import {
  createTassyirApp,
  isTassyirError,
  TassyirVerificationError,
  type RefreshLock,
  type TokenSet,
  type TokenStore,
  type WebhookEvent,
} from '@tassyir/app';

const redis = new Redis(process.env.REDIS_URL!);

// Where each installation's offline tokens live. Encrypt them at rest in a
// real deployment: they are secrets.
const tokenStore: TokenStore = {
  async get(installationId) {
    const value = await redis.get(`tassyir:tokens:${installationId}`);
    return value ? (JSON.parse(value) as TokenSet) : undefined;
  },
  async set(installationId, tokens) {
    await redis.set(`tassyir:tokens:${installationId}`, JSON.stringify(tokens));
  },
  async delete(installationId) {
    await redis.del(`tassyir:tokens:${installationId}`);
  },
};

// One refresh at a time per installation, across every process.
const refreshLock: RefreshLock = {
  async withLock(key, task) {
    const owner = crypto.randomUUID();
    for (
      let tries = 0;
      !(await redis.set(key, owner, 'PX', 60_000, 'NX'));
      tries += 1
    ) {
      if (tries === 120) throw new Error(`Timed out waiting for ${key}`);
      await new Promise((resolve) => setTimeout(resolve, 500));
    }
    try {
      return await task();
    } finally {
      await redis.eval(
        "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) end return 0",
        1,
        key,
        owner,
      );
    }
  },
};

const tassyir = createTassyirApp({
  clientId: process.env.TASSYIR_CLIENT_ID!, // app_…
  clientSecret: process.env.TASSYIR_CLIENT_SECRET!, // tsy_cs_…
  appId: process.env.TASSYIR_APP_ID!, // the numeric app id from the developer console
  tokenStore,
  refreshLock,
  retries: 3,
});

// Installations are recorded from app/installed. A delivery can arrive before
// it (no ordering): refusing it is fine, Tassyir retries it.
const isOurInstallation = async (id: string, event: WebhookEvent) =>
  event.type === 'app/installed' ||
  (await redis.sismember('tassyir:installations', id)) === 1;

const app = express();

// Webhooks: verify the RAW body, answer within 10 seconds, work afterwards.
app.post(
  '/webhooks',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    let delivery;
    try {
      delivery = await tassyir.verifyWebhook(
        { headers: req.headers, body: req.body as Buffer },
        { installationId: isOurInstallation },
      );
    } catch (error) {
      if (isTassyirError(error, 'WEBHOOK_TEST_DELIVERY'))
        return res.sendStatus(200);
      if (error instanceof TassyirVerificationError) return res.sendStatus(400);
      throw error;
    }
    // At least once, in any order: skip a webhook-id you already handled.
    if (
      !(await redis.set(
        `tassyir:seen:${delivery.id}`,
        '1',
        'EX',
        259_200,
        'NX',
      ))
    ) {
      return res.sendStatus(200);
    }
    res.sendStatus(200);

    switch (delivery.event.type) {
      case 'app/installed':
        await redis.sadd('tassyir:installations', delivery.installationId);
        break;
      case 'orders/created':
        console.log(
          'new order',
          delivery.event.data.order.orderNumber,
          delivery.event.data.order.total,
        ); // total: "2500.00"
        break;
      case 'app/uninstalled':
        await redis.srem('tassyir:installations', delivery.installationId);
        await tassyir.tokens.forget(delivery.installationId);
        break;
    }
  },
);

// The embedded page calls this with its App Bridge ID token as a bearer.
app.get('/api/pending-orders', async (req, res) => {
  const idToken = req.get('authorization')?.replace(/^Bearer /, '') ?? '';
  try {
    const { idToken: session } = await tassyir.authenticate(idToken);
    const admin = tassyir.admin(session.installationId);
    const orders = [];
    for await (const order of admin.paginate('/orders', {
      query: {
        status: 'pending',
        limit: 100,
        fields: ['orderNumber', 'total', 'createdAt'],
      },
    })) {
      orders.push(order);
      if (orders.length === 200) break;
    }
    res.json(orders);
  } catch (error) {
    if (error instanceof TassyirVerificationError) return res.sendStatus(401);
    throw error;
  }
});

app.listen(3000);

app.get('/auth/callback', async (req, res) => {
  const tokens = await tassyir.redeemInstallCode(String(req.query.code)); // stored for you
  res.send(`Installed on business ${tokens.businessId}`);
});

const { data: order } = await admin.get('/orders/{id}', { path: { id } });
await admin.post('/orders/{id}/confirm', {
  path: { id },
  idempotencyKey: `confirm-${id}`,
});
const created = await admin.request('post', '/orders', { body }); // created.status: 201, or 200 for a duplicate