Latest

[edgardoparaiso790-byte]

// SIDV Edge Function: revoke-str
// Revokes an active STR (Security Transaction Reference) code.
// Deploy via Supabase Dashboard (Edge Functions > Deploy a new function > Via Editor)
// or CLI: supabase functions deploy revoke-str
//
// Auth: Admin-only. Expects a valid admin/service Bearer token (sk_live_ / sk_test_).
// Mirrors the CORS/error helper conventions used in verify-str and str-webhook.

import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

// ---- Shared CORS headers (same pattern as verify-str / str-webhook) ----
const corsHeaders = {
'Access-Control-Allow-Origin': '*', // tighten to your production domain(s) if needed
'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
'Access-Control-Allow-Methods': 'POST, OPTIONS',
}

// ---- Shared error response helper ----
function errorResponse(code: string, message: string, status = 400) {
return new Response(
JSON.stringify({
error: {
code,
message,
},
}),
{
status,
headers: { ...corsHeaders, 'Content-Type': 'application/json' },
}
)
}

function successResponse(data: Record<string, unknown>, status = 200) {
return new Response(JSON.stringify({ data }), {
status,
headers: { ...corsHeaders, 'Content-Type': 'application/json' },
})
}

Deno.serve(async (req: Request) => {
// Handle CORS preflight
if (req.method === 'OPTIONS') {
return new Response('ok', { headers: corsHeaders })
}

if (req.method !== 'POST') {
return errorResponse('METHOD_NOT_ALLOWED', 'Only POST is supported', 405)
}

try {
// ---- Auth check: admin-only ----
const authHeader = req.headers.get('Authorization')
if (!authHeader || !authHeader.startsWith('Bearer ')) {
return errorResponse('UNAUTHORIZED', 'Missing or invalid Authorization header', 401)
}

const token = authHeader.replace('Bearer ', '').trim()

// Only admin/service-level keys may revoke. Adjust prefix check to match
// your actual admin key issuance scheme.
if (!token.startsWith('sk_live_') && !token.startsWith('sk_test_')) {
  return errorResponse('FORBIDDEN', 'Revocation requires an admin API key', 403)
}

// ---- Parse request body ----
let body: { str_code?: string; reason?: string }
try {
  body = await req.json()
} catch {
  return errorResponse('INVALID_REQUEST', 'Request body must be valid JSON', 400)
}

const { str_code, reason } = body

if (!str_code || typeof str_code !== 'string') {
  return errorResponse('INVALID_REQUEST', 'str_code is required', 400)
}

// Basic format check for SIDV-XXXX-XXXX-XXXX
const strFormat = /^SIDV-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$/
if (!strFormat.test(str_code)) {
  return errorResponse('INVALID_STR_FORMAT', 'str_code does not match expected format', 400)
}

// ---- Connect to Supabase with service role (bypasses RLS) ----
const supabase = createClient(
  Deno.env.get('SUPABASE_URL') ?? '',
  Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') ?? ''
)

// ---- Look up the STR record ----
const { data: strRecord, error: fetchError } = await supabase
  .from('sidv_transactions')
  .select('id, status, str_code')
  .eq('str_code', str_code)
  .single()

if (fetchError || !strRecord) {
  return errorResponse('STR_NOT_FOUND', 'No matching STR code found', 404)
}

if (strRecord.status === 'revoked') {
  return errorResponse('STR_REVOKED', 'This STR code has already been revoked', 409)
}

if (strRecord.status === 'expired') {
  return errorResponse('STR_EXPIRED', 'This STR code has expired', 409)
}

if (strRecord.status === 'used') {
  return errorResponse('STR_USED', 'This STR code has already been used', 409)
}

// ---- Perform revocation ----
const { error: updateError } = await supabase
  .from('sidv_transactions')
  .update({
    status: 'revoked',
    revoked_at: new Date().toISOString(),
    revoked_reason: reason ?? null,
  })
  .eq('id', strRecord.id)

if (updateError) {
  return errorResponse('REVOCATION_FAILED', 'Failed to revoke STR code', 500)
}

// ---- Audit log entry ----
await supabase.from('sidv_audit_log').insert({
  event_type: 'str_revoked',
  str_code,
  metadata: { reason: reason ?? null },
  created_at: new Date().toISOString(),
})

return successResponse({
  str_code,
  status: 'revoked',
  revoked_at: new Date().toISOString(),
})

} catch (err) {
console.error('revoke-str error:', err)
return errorResponse('INTERNAL_ERROR', 'An unexpected error occurred', 500)
}
})

[edgardoparaiso790-byte]

-383+;;*+#(#!$!

[edgardoparaiso790-byte]

This a worker custom