Connect, payments & Pro auth

# Buyer funds with full Pro methods, then pays merchant
https://openpaypro.space/topup
https://openpaypro.space/pay/@shop?amount=250&asset=OUSD&note=order_9001

https://openpy.space/connect
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/openpay/callback
  &scope=profile%20balance
  &state=RANDOM_CSRF_TOKEN

<a href="https://openpy.space/connect?client_id=YOUR_CLIENT_ID&redirect_uri=https://yourapp.com/openpay/callback&scope=profile%20balance&state=xyz"
   style="display:inline-flex;align-items:center;gap:8px;background:#1652f0;color:#fff;
   padding:12px 20px;border-radius:10px;font-weight:600;text-decoration:none;">
  Connect with OpenPay
</a>

# Success
https://yourapp.com/openpay/callback?code=opc_...&state=...

# Cancel
https://yourapp.com/openpay/callback?error=access_denied

# Verify state matches what you stored

curl -X POST "https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "opc_...",
    "redirect_uri": "https://yourapp.com/openpay/callback",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "opk_live_YOUR_KEY"
  }'

curl -H "Authorization: Bearer opa_live_..." https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/user/me
curl -H "Authorization: Bearer opa_live_..." https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/user/balance

# Typical /user/me response
{
  "user_id": "...",
  "account_number": "OP...",
  "full_name": "...",
  "username": "...",
  "avatar_url": "...",
  "balance": 12.34,
  "currency": "OUSD",
  "scope": "profile balance"
}

OPENPAY_AUTH_PASSWORD_SECRET="long-random-string"
SUPABASE_URL="https://YOUR_PROJECT.supabase.co"
SUPABASE_PUBLISHABLE_KEY="eyJ..."
SUPABASE_SERVICE_ROLE_KEY="eyJ..."   # server only — admin.createUser

VITE_WEB3AUTH_CLIENT_ID="your-client-id"
WEB3AUTH_CLIENT_ID="your-client-id"
WEB3AUTH_CLIENT_SECRET="your-secret"   # never VITE_
WEB3AUTH_JWKS_URL="https://api-auth.web3auth.io/.well-known/jwks.json"

VITE_PHANTOM_APP_ID="your-app-id"
# Allowlist each origin + /auth/callback in Phantom Portal

import { startOpenPaySignIn } from "@/lib/openpay-auth"
import { startSolanaSignIn } from "@/lib/solana-auth"
import { startWalletConnectSignIn } from "@/lib/walletconnect-auth"
import { signInWithPi } from "@/lib/pi-network"

await startOpenPaySignIn({ redirectTo: "/dashboard" })
await startSolanaSignIn({ redirectTo: "/dashboard" })
await startWalletConnectSignIn({ redirectTo: "/dashboard" })

curl -X POST "https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/charges" \
  -H "Authorization: Bearer opk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 19.99,
    "currency": "OUSD",
    "description": "Order #1234",
    "reference": "order_1234",
    "success_url": "https://yourapp.com/thanks",
    "cancel_url": "https://yourapp.com/cart"
  }'
# → { id, checkout_url, status, expires_at }  · TTL 2 hours
# → redirect buyer to checkout_url or https://openpy.space/paybutton/CHARGE_ID

# Status: created | paid | canceled | expired
curl -H "Authorization: Bearer opk_live_YOUR_KEY" \
  https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/charges/CHARGE_ID

curl -X POST -H "Authorization: Bearer opk_live_YOUR_KEY" \
  https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/charges/CHARGE_ID/cancel

# List
curl -H "Authorization: Bearer opk_live_YOUR_KEY" \
  "https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/charges?status=paid"

https://openpy.space/pay/YOUR_USERNAME
  ?amount=25.00
  &currency=OUSD
  &note=order_1234
  &success_url=https://yourapp.com/thanks
  &cancel_url=https://yourapp.com/cart

# Success return: ?openpay_return=1&openpay_ref=order_1234&openpay_tx=...
# Cancel return:  ?openpay_cancel=1

# Resolve account
curl -H "Authorization: Bearer opk_live_YOUR_KEY" \
  https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/accounts/@satoshi

# Send payout
curl -X POST "https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/transfers" \
  -H "Authorization: Bearer opk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"to":"OP...","amount":10.00,"note":"Payout"}'

# Partner treasury
curl -H "Authorization: Bearer opk_live_YOUR_KEY" https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/me
curl -H "Authorization: Bearer opk_live_YOUR_KEY" https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api/balance

const API = process.env.OPENPAY_PARTNER_API_BASE || "https://araojncyittkahvvpdrn.supabase.co/functions/v1/partner-transfer-api";
const KEY = process.env.OPENPAY_PARTNER_API_KEY; // opk_live_…
const CLIENT_ID = process.env.OPENPAY_CLIENT_ID;
const REDIRECT = process.env.OPENPAY_REDIRECT_URI;

export function connectUrl(state) {
  const u = new URL("https://openpy.space/connect");
  u.searchParams.set("client_id", CLIENT_ID);
  u.searchParams.set("redirect_uri", REDIRECT);
  u.searchParams.set("scope", "profile balance");
  u.searchParams.set("state", state);
  return u.toString();
}

export async function exchangeCode(code) {
  const res = await fetch(`${API}/oauth/token`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      grant_type: "authorization_code",
      code,
      redirect_uri: REDIRECT,
      client_id: CLIENT_ID,
      client_secret: KEY,
    }),
  });
  if (!res.ok) throw new Error(await res.text());
  return res.json(); // { access_token: "opa_live_...", ... }
}

export async function createCharge({ amount, reference, success_url, cancel_url }) {
  const res = await fetch(`${API}/charges`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      amount,
      currency: "OUSD",
      description: reference,
      reference,
      success_url,
      cancel_url,
    }),
  });
  if (!res.ok) throw new Error(await res.text());
  return res.json(); // { id, checkout_url, ... }
}

export async function transfer({ to, amount, note, idempotencyKey }) {
  const res = await fetch(`${API}/transfers`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${KEY}`,
      "Content-Type": "application/json",
      "Idempotency-Key": idempotencyKey,
    },
    body: JSON.stringify({ to, amount, note }),
  });
  if (!res.ok) throw new Error(await res.text());
  return res.json();
}