Implementing Instant Checkout

// POST /checkouts - Create a checkout session
// Request from ChatGPT/AI Platform
{
  "items": [
    {
      "id": "item_123",
      "quantity": 2
    }
  ],
  "buyer": {
    "first_name": "John",
    "last_name": "Doe",
    "email": "john.doe@example.com",
    "phone_number": "+1234567890"
  },
  "fulfillment_address": {
    "name": "John Doe",
    "line_one": "123 Main St",
    "line_two": "Apt 4B",
    "city": "San Francisco",
    "state": "CA",
    "country": "US",
    "postal_code": "94105"
  }
}

// Response to AI Platform
{
  "id": "checkout_abc123",
  "status": "ready_for_payment",
  "currency": "usd",
  "line_items": [
    {
      "id": "item_123",
      "item": {
        "id": "item_123",
        "quantity": 2
      },
      "base_amount": 2000,
      "discount": 0,
      "total": 2000,
      "subtotal": 2000,
      "tax": 0
    }
  ],
  "fulfillment_options": [
    {
      "type": "shipping",
      "id": "shipping_fast",
      "title": "Express Shipping",
      "subtitle": "2-3 business days",
      "carrier": "Shipping Co",
      "subtotal": 150,
      "tax": 0,
      "total": 150
    }
  ],
  "totals": [
    {
      "type": "subtotal",
      "display_text": "Subtotal",
      "amount": 2000
    },
    {
      "type": "fulfillment",
      "display_text": "Shipping",
      "amount": 150
    },
    {
      "type": "tax",
      "display_text": "Tax",
      "amount": 100
    },
    {
      "type": "total",
      "display_text": "Total",
      "amount": 2250
    }
  ]
}

// Delegated Payment Processing with Stripe
// When AI platform sends payment token

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

async function processACPPayment(checkoutSession, paymentData) {
  // Payment data from AI platform includes delegated token
  const { payment_method } = paymentData;
  
  if (payment_method.type === 'delegated_token') {
    // Use Stripe's Shared Payment Token
    const paymentIntent = await stripe.paymentIntents.create({
      amount: checkoutSession.totals.find(t => t.type === 'total').amount,
      currency: checkoutSession.currency,
      payment_method: payment_method.token, // spt_xxx from AI platform
      confirm: true,
      metadata: {
        checkout_id: checkoutSession.id,
        ai_platform: 'chatgpt'
      }
    });

    if (paymentIntent.status === 'succeeded') {
      // Create order in your system
      const order = await createOrder({
        checkout_id: checkoutSession.id,
        customer: checkoutSession.buyer,
        items: checkoutSession.line_items,
        total: checkoutSession.totals.find(t => t.type === 'total').amount,
        payment_intent_id: paymentIntent.id
      });

      return {
        status: 'completed',
        order_id: order.id,
        confirmation_number: order.confirmation_number
      };
    }
  }
  
  throw new Error('Payment processing failed');
}

// Webhook endpoint to handle instant checkout events
app.post('/webhooks/acp-checkout', async (req, res) => {
  const event = req.body;
  
  // Verify webhook signature
  const signature = req.headers['x-acp-signature'];
  if (!verifySignature(event, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  switch (event.type) {
    case 'checkout.session.created':
      await handleCheckoutCreated(event.data);
      break;
    case 'checkout.session.completed':
      await handleCheckoutCompleted(event.data);
      break;
    case 'checkout.session.failed':
      await handleCheckoutFailed(event.data);
      break;
  }
  
  res.json({ received: true });
});

// Security best practices for ACP Instant Checkout

// 1. Authentication with Bearer Token
app.post('/checkouts', async (req, res) => {
  const authHeader = req.headers.authorization;
  
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  const token = authHeader.substring(7);
  const isValid = await verifyACPToken(token);
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid token' });
  }
  
  // Process checkout...
});

// 2. Verify webhook HMAC signatures
function verifyWebhookSignature(payload, signature, timestamp) {
  const crypto = require('crypto');
  
  // Construct signed payload
  const signedPayload = `${timestamp}.${JSON.stringify(payload)}`;
  
  // Calculate HMAC
  const hmac = crypto
    .createHmac('sha256', process.env.ACP_WEBHOOK_SECRET)
    .update(signedPayload)
    .digest('hex');
  
  // Compare signatures
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(hmac)
  );
}

// 3. Inventory validation before checkout
async function validateInventory(items) {
  for (const item of items) {
    const product = await db.products.findById(item.id);
    
    if (!product) {
      throw new Error(`Product ${item.id} not found`);
    }
    
    if (product.availability !== 'in_stock') {
      throw new Error(`Product ${item.id} is not available`);
    }
    
    if (product.stock_quantity < item.quantity) {
      throw new Error(`Insufficient stock for ${item.id}`);
    }
  }
  
  return true;
}

// 4. PCI Compliance - Never log sensitive data
function sanitizeLogData(data) {
  const sanitized = { ...data };
  
  // Remove sensitive fields
  delete sanitized.payment_method;
  delete sanitized.card_number;
  delete sanitized.cvv;
  
  return sanitized;
}