Merchant backend billing

Merchant browser
  -> authenticated merchant POST /api/billing/checkout
  -> merchant backend derives the Nozle customer from the logged-in team
  -> merchant backend calls Nozle with its restricted sk_
  -> Nozle returns the provider checkout result

import { Nozle } from '@nozle-js/node'

const nozle = new Nozle({
  apiKey: process.env.NOZLE_SECRET_KEY!,
  baseUrl: 'https://api.nozle.app/engine',
})

const allowedPlans = new Set(['free', 'pro', 'max'])
const allowedReturnOrigins = new Set(['https://app.example.com'])

export async function postBillingCheckout(request: Request, user: AuthenticatedUser) {
  const body = await request.json() as Record<string, unknown>
  if ('customerId' in body || 'customer_id' in body) {
    return Response.json({ error: 'customer_id_not_allowed' }, { status: 400 })
  }

  const planCode = String(body.planCode ?? '')
  const returnUrl = new URL(String(body.returnUrl ?? ''))
  if (!allowedPlans.has(planCode)) {
    return Response.json({ error: 'invalid_plan' }, { status: 400 })
  }
  if (returnUrl.protocol !== 'https:' || !allowedReturnOrigins.has(returnUrl.origin)) {
    return Response.json({ error: 'invalid_return_url' }, { status: 400 })
  }

  // This mapping is server-owned. Never accept it from the browser.
  const nozleCustomerId = await lookupNozleCustomerForTeam(user.teamId)
  const checkout = await nozle.checkout(nozleCustomerId, planCode, returnUrl.toString())

  return Response.json(checkout)
}

import { BillingProvider, PricingTable } from '@nozle-js/react'

export function BillingPage({ csrfToken }: { csrfToken: string }) {
  return (
    <BillingProvider
      publishableKey={import.meta.env.VITE_NOZLE_PUBLISHABLE_KEY}
      createCheckout={async ({ planCode, returnUrl }) => {
        const response = await fetch('/api/billing/checkout', {
          method: 'POST',
          credentials: 'include',
          headers: {
            'Content-Type': 'application/json',
            'X-CSRF-Token': csrfToken,
          },
          body: JSON.stringify({ planCode, returnUrl }),
        })

        if (!response.ok) throw new Error('Checkout failed')
        return response.json()
      }}
    >
      <PricingTable returnUrl={window.location.href} />
    </BillingProvider>
  )
}