import express from 'express';
import { createReceiptMiddleware, MemoryReceiptStore } from '@mcpaid/sdk';

const app = express();
const store = new MemoryReceiptStore();

// Protect any downstream endpoint with 1 line of middleware:
app.post('/api/sync', 
  createReceiptMiddleware({
    secret: process.env.MCPAID_RECEIPT_SECRET,
    expectedServer: 'server-id',
    expectedTool: 'your_paid_tool',
    store,
  }), 
  (req, res) => {
    // req.mcpaidReceipt contains verified receipt payload!
    res.json({ success: true, processedBy: req.mcpaidReceipt.agentWallet });
  }
);

# Zero third-party dependencies — Python standard library:
import hmac, hashlib, json, time, base64

# NOTE: this in-memory set only protects a single process. In production,
# persist claimed nonces in Redis/Postgres with a UNIQUE constraint and a
# periodic DELETE-WHERE-expired sweep.
claimed_nonces = set()

def verify_mcpaid_receipt(receipt_b64: str, secret: str, expected_tool: str,
                           expected_server: str = None) -> bool:
    if not receipt_b64 or not secret: return False
    try:
        payload = json.loads(base64.urlsafe_b64decode(
            receipt_b64 + '=' * (-len(receipt_b64) % 4)))
    except Exception:
        return False
    sig = payload.pop("sig", "")
    now = time.time()
    if (payload.get("toolName") != expected_tool
            or (expected_server and payload.get("serverId") != expected_server)
            or now > payload.get("exp", 0) + 60
            or payload.get("settledAt", 0) > now + 60
            or not sig):
        return False
    canonical = json.dumps(payload, separators=(',', ':'), sort_keys=True)
    expected_sig = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected_sig):
        return False
    nonce = payload.get("challengeNonce")
    if not nonce or nonce in claimed_nonces:
        return False
    claimed_nonces.add(nonce)
    return True