// Good: Server-side
const secretKey = process.env.FLONK_SECRET_KEY;

// Bad: Client-side (NEVER do this)
const secretKey = 'sk_live_xxxxx'; // Exposed in browser

# .env (never commit to git)
FLONK_SECRET_KEY=sk_live_xxxxxxxxxxxx
KYC_WEBHOOK_SECRET=whsec_xxxxxxxxxxxx

.env
.env.local
.env.*.local

import { FlonkKYCServer } from '@flonkid/kyc/server';

const flonk = new FlonkKYCServer({
  secretKey: process.env.FLONK_SECRET_KEY!,
});

// SDK handles both signature formats automatically
const event = flonk.webhooks.constructEvent(
  rawBody,
  req.headers['x-signature-256'],
  process.env.FLONK_WEBHOOK_SECRET!,
);

function verifySignature(payload: Buffer, signature: string): boolean {
  if (!signature?.startsWith('sha256=')) {
    return false;
  }

  const sigHex = signature.slice(7);
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(sigHex),
    Buffer.from(expected)
  );
}

// NestJS
@Post('webhook')
handleWebhook(@Req() req: RawBodyRequest<Request>) {
  const isValid = verifySignature(
    req.rawBody,
    req.get('X-Signature-256')
  );
}

// Good: Store minimal data
await db.user.update({
  where: { id: userId },
  data: {
    kycVerified: true,
    kycVerifiedAt: new Date()
  }
});

// Avoid: Storing all extracted data unnecessarily

const encryptedData = encrypt(JSON.stringify(extractedData));
await db.kycData.create({
  data: { userId, encryptedData }
});

// Good
const apiUrl = 'https://api.flonk.id/v1';

// Bad
const apiUrl = 'http://api.flonk.id/v1';