server.js

/**
 * Agora — API Gateway (Passport-Native)
 * 
 * Architecture:
 *   - Passport session stored in Secure/HttpOnly/SameSite=Strict cookie
 *   - All marketplace endpoints require X-Payment header → 402 if missing
 *   - BudgetMiddleware enforces MAX_AUTO_PAYMENT from passport session
 *   - StaticJsonRpcProvider bound to Kite Mainnet (chain 2366)
 */

const fastify = require('fastify')({ logger: true });
const cookie = require('@fastify/cookie');
const fastifyStatic = require('@fastify/static');
const path = require('path');
const { ethers } = require('ethers');
const fs = require('fs');
require('dotenv').config();

// ─── Phase 1: Static Provider — Kite Mainnet (no auto-detection) ───────────
const KITE_CHAIN_ID = 2366;
const KITE_RPC = process.env.KITE_RPC_URL || "https://rpc.gokite.ai/";
const KITE_EXPLORER = "https://kitescan.ai";

const provider = new ethers.JsonRpcProvider(KITE_RPC, {
  chainId: KITE_CHAIN_ID,
  name: 'kite-mainnet'
});
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);

// ─── Deployed Addresses ────────────────────────────────────────────────────
let deployed = {};
if (fs.existsSync('./deployed-addresses.json')) {
  deployed = JSON.parse(fs.readFileSync('./deployed-addresses.json'));
}

const ABIs = {
  ERC20: [
    "function balanceOf(address account) external view returns (uint256)",
    "function approve(address spender, uint256 amount) external returns (bool)",
    "function allowance(address owner, address spender) external view returns (uint256)"
  ],
  KiteEconomy: [
    "function reputation(address) external view returns (uint256)",
    "function payViaX402(string calldata feedId, uint256 amount) external",
    "function LogAttestation(string calldata agentIdentity, string calldata resourceName, bytes32 txRef) external"
  ]
};

const usdc = new ethers.Contract(deployed.usdc || "0x7aB6f3ed87C42eF0aDb67Ed95090f8bF5240149e", ABIs.ERC20, wallet);
const usdt = new ethers.Contract(deployed.usdt || "0x3Fdd283C4c43A60398bf93CA01a8a8BD773a755b", ABIs.ERC20, wallet);
const weth = new ethers.Contract(deployed.weth || "0x3D66d6c3201190952e8EA973F59c4428b32D5F9b", ABIs.ERC20, wallet);
const wkite = new ethers.Contract(deployed.wkite || "0xcc788DC0486CD2BaacFf287eea1902cc09FbA570", ABIs.ERC20, wallet);
const economy = new ethers.Contract(deployed.kiteEconomy || "0xB849A5cf3Addaa18A2ba8b313A577E0f0D5654E8", ABIs.KiteEconomy, wallet);

// ─── Plugin Registration ───────────────────────────────────────────────────
async function registerPlugins() {
  try {
    await fastify.register(cookie, {
      secret: process.env.COOKIE_SECRET || 'agora-passport-secret-key-2026',
      parseOptions: {}
    });
  } catch (e) {
    console.warn('Cookie plugin not available, using header-based session.');
  }

  try {
    await fastify.register(fastifyStatic, {
      root: path.join(__dirname),
      prefix: '/',
    });
  } catch (e) {
    console.error('Failed to load @fastify/static:', e.message);
  }
}

// ─── Phase 1: Passport Identity Middleware ──────────────────────────────────
async function passportIdentityMiddleware(request, reply) {
  // Check for passport session cookie first, then header fallback
  const sessionCookie = request.cookies?.['kite-passport-session'];
  const identityHeader = request.headers['kite-passport-identity'];

  if (!sessionCookie && !identityHeader) {
    reply.code(401).send({
      error: '401 Unauthorized',
      message: 'Missing Kite-Passport-Identity. Authenticate via KitePassport.passportAuth() first.'
    });
    return;
  }
}

// ─── Phase 1: x402 Payment Middleware (402 Payment Required) ────────────────
async function x402PaymentMiddleware(request, reply) {
  const paymentHeader = request.headers['x-payment'];

  if (!paymentHeader) {
    reply.code(402).send({
      error: '402 Payment Required',
      message: 'This endpoint requires an X-Payment header with a valid signed payment token.',
      paymentGateway: 'KitePassport.requestPayment()',
      contractAddress: deployed.kiteEconomy || '0xB849A5cf3Addaa18A2ba8b313A577E0f0D5654E8',
      chain: 'Kite Mainnet (2366)',
      acceptedToken: 'USDC'
    });
    return;
  }
}

// ─── Phase 2: Budget Middleware ─────────────────────────────────────────────
async function budgetMiddleware(request, reply) {
  try {
    const sessionRaw = request.headers['kite-passport-session'] || '{}';
    const session = JSON.parse(sessionRaw);
    const maxAutoPayment = session.MAX_AUTO_PAYMENT || 5.0;
    const amountRequested = parseFloat(request.body?.amount || 0);

    if (amountRequested > maxAutoPayment) {
      reply.code(403).send({
        error: '403 Forbidden',
        message: 'Budget limit exceeded',
        requested: amountRequested,
        limit: maxAutoPayment,
        passport_session: sessionRaw
      });
      return;
    }
  } catch (e) {
    reply.code(400).send({ error: 'Malformed Passport Session Context' });
  }
}

// ─── Routes ────────────────────────────────────────────────────────────────

// Serve index.html directly at root
fastify.get('/', async (request, reply) => {
  return reply.sendFile('index.html');
});

// Health check (public)
fastify.get('/api/health', async () => ({
  status: 'ok',
  chain: 'kite-mainnet',
  chainId: KITE_CHAIN_ID,
  contracts: {
    kiteEconomy: deployed.kiteEconomy,
    usdc: deployed.usdc,
    agentRegistry: deployed.agentRegistry,
    predictionMarket: deployed.predictionMarket,
    x402PaymentGate: deployed.x402PaymentGate
  }
}));

// Feed discovery (public)
fastify.get('/api/feeds', async () => ({
  feeds: ['NEWS-FEED-US', 'DEFI-RATES', 'SENTIMENT-NLP', 'WEATHER-API', 'STOCK-DATA-RT', 'ON-CHAIN-SIG']
}));

// Passport session cookie endpoint (called by KitePassportAuth.js)
fastify.post('/api/passport-session', async (request, reply) => {
  const { account, sessionToken, signature, timestamp } = request.body || {};

  if (!account || !sessionToken || !signature || !timestamp) {
    return reply.code(400).send({ error: 'Missing account, sessionToken, signature, or timestamp' });
  }

  // Verify Ethereum signature to prove the account owner initiated this session
  const message = `Kite Passport Auth\nAccount: ${account}\nChain: 2366\nTimestamp: ${timestamp}`;
  try {
    const recoveredAddress = ethers.verifyMessage(message, signature);
    if (recoveredAddress.toLowerCase() !== account.toLowerCase()) {
      return reply.code(401).send({ error: 'Invalid signature. Account mismatch.' });
    }
  } catch (err) {
    return reply.code(401).send({ error: 'Signature verification failed', message: err.message });
  }

  // Set secure httpOnly cookie
  try {
    reply.setCookie('kite-passport-session', JSON.stringify({
      account,
      sessionToken,
      timestamp,
      MAX_AUTO_PAYMENT: 5.0
    }), {
      httpOnly: true,
      secure: true,
      sameSite: 'Strict',
      path: '/',
      maxAge: 86400 // 24 hours
    });
  } catch (e) {
    // Cookie plugin not available — log but don't fail
    console.warn('Could not set cookie:', e.message);
  }

  return { status: 'session_created', account, agentId: `AGT-${account.slice(2, 5).toUpperCase()}` };
});

// OIDC Login/Challenge Endpoint
fastify.post('/api/passport/login', async (request, reply) => {
  const dummyAccount = "0xE1A6b7D908E20fD3A35dF98F2089E0CcD62f53B2";
  const sessionToken = ethers.hexlify(ethers.randomBytes(32));
  
  try {
    reply.setCookie('kite-passport-session', JSON.stringify({
      account: dummyAccount,
      sessionToken: sessionToken,
      timestamp: Date.now(),
      budget: 10.00,
      perTxLimit: 2.00,
      expiry: Date.now() + (2 * 3600 * 1000)
    }), {
      httpOnly: true,
      secure: true,
      sameSite: 'Strict',
      path: '/',
      maxAge: 7200
    });
  } catch (e) {
    console.warn('Could not set cookie:', e.message);
  }
  
  return {
    status: 'success',
    account: dummyAccount,
    agentId: `AGT-${dummyAccount.slice(2, 5).toUpperCase()}`,
    sessionToken: sessionToken
  };
});

// Payment Token Endpoint (guardrails validation)
fastify.post('/api/passport/payment-token', async (request, reply) => {
  const sessionCookie = request.cookies?.['kite-passport-session'];
  if (!sessionCookie) {
    return reply.code(401).send({ error: true, message: 'Session not found. Log in first.' });
  }
  
  let session = {};
  try {
    session = JSON.parse(sessionCookie);
  } catch (e) {
    return reply.code(400).send({ error: true, message: 'Invalid session cookie.' });
  }
  
  const { feedId, calls, maxCost } = request.body || {};
  if (!feedId || !calls) {
    return reply.code(400).send({ error: true, message: 'Missing feedId or calls parameter.' });
  }
  
  const requestedCost = parseFloat(maxCost || 0);
  if (requestedCost > session.perTxLimit) {
    return reply.code(403).send({ error: true, message: `Guardrail violation: per-transaction limit of ${session.perTxLimit} USDC exceeded.` });
  }
  
  if (Date.now() > session.expiry) {
    return reply.code(401).send({ error: true, message: 'Guardrail violation: session expired.' });
  }
  
  const signedToken = ethers.keccak256(ethers.toUtf8Bytes(`${session.account}-${feedId}-${calls}-${Date.now()}`));
  
  return {
    status: 'success',
    paymentToken: signedToken
  };
});
fastify.post('/api/execute', {
  preHandler: [passportIdentityMiddleware, x402PaymentMiddleware, budgetMiddleware]
}, async (request, reply) => {
  try {
    const { amount, feedId } = request.body;
    const cost = ethers.parseUnits(amount.toString(), 6);

    // Verify balance
    const bal = await usdc.balanceOf(wallet.address);
    if (bal < cost) {
      return reply.code(400).send({ error: 'Insufficient on-chain USDC funds' });
    }

    // Approve if needed
    const economyAddr = await economy.getAddress();
    const allowance = await usdc.allowance(wallet.address, economyAddr);
    if (allowance < cost) {
      const approveTx = await usdc.approve(economyAddr, ethers.MaxUint256);
      await approveTx.wait();
    }

    // Pay via x402
    const payTx = await economy.payViaX402(feedId || 'GENERAL_RESOURCE', cost);
    const payReceipt = await payTx.wait();

    // Log attestation
    const identity = request.headers['kite-passport-identity'];
    const attTx = await economy.LogAttestation(identity, feedId || 'GENERAL_RESOURCE', payReceipt.hash);
    const attReceipt = await attTx.wait();

    return {
      status: 'success',
      txHash: payReceipt.hash,
      blockNumber: payReceipt.blockNumber,
      kiteExplorerUrl: `${KITE_EXPLORER}/tx/${payReceipt.hash}`,
      attestationTx: attReceipt.hash
    };
  } catch (error) {
    console.error('Execute error:', error.message);
    reply.code(500).send({ error: error.message });
  }
});

// Buy feed (x402 gated — returns 402 if no payment header)
fastify.post('/api/buy', {
  preHandler: [passportIdentityMiddleware, x402PaymentMiddleware]
}, async (request, reply) => {
  try {
    const { feedId, calls = 1, pricePerCall = 0.03 } = request.body;
    const totalCost = calls * pricePerCall;
    const cost = ethers.parseUnits(totalCost.toFixed(6), 6);

    const economyAddr = await economy.getAddress();
    const allowance = await usdc.allowance(wallet.address, economyAddr);
    if (allowance < cost) {
      const approveTx = await usdc.approve(economyAddr, ethers.MaxUint256);
      await approveTx.wait();
    }

    const tx = await economy.payViaX402(feedId || 'GENERAL_FEED', cost);
    const receipt = await tx.wait();

    return {
      status: 'success',
      txHash: receipt.hash,
      blockNumber: receipt.blockNumber,
      kiteExplorerUrl: `${KITE_EXPLORER}/tx/${receipt.hash}`,
      feedId,
      calls,
      totalCost
    };
  } catch (error) {
    console.error('Buy feed error:', error.message);
    reply.code(500).send({ error: error.message });
  }
});

fastify.get('/api/demo-mode', async (request, reply) => {
  return { demoMode: process.env.DEMO_MODE === 'true' };
});

// ─── Start ─────────────────────────────────────────────────────────────────
const start = async () => {
  try {
    await registerPlugins();
    await fastify.listen({ port: 3001, host: '0.0.0.0' });
    console.log('─────────────────────────────────────────');
    console.log('  AGORA API Gateway (Passport-Native)');
    console.log('  Port: 3001');
    console.log('  Chain: Kite Mainnet (2366)');
    console.log('  x402: Enabled (402 Payment Required)');
    console.log('─────────────────────────────────────────');
  } catch (err) {
    fastify.log.error(err);
    process.exit(1);
  }
};
start();