Selling with Lemon Squeezy

import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const KEYGATE = process.env.KEYGATE_URL; // https://licenses.example.com
const API_KEY = process.env.KEYGATE_API_KEY; // kg_live_... with licenses:write
const PRODUCT_ID = process.env.KEYGATE_PRODUCT_ID;
const SECRET = process.env.LEMONSQUEEZY_SIGNING_SECRET;

// Lemon Squeezy variant ID on the left, Keygate plan ID on the right.
const PLANS = {
  123456: "8c1e2b9a-...",
};

const headers = { Authorization: `Bearer ${API_KEY}`, "Content-Type": "application/json" };

// Each license remembers its Lemon Squeezy order in external_customer_id.
async function findLicense(orderId) {
  const url = `${KEYGATE}/api/v1/admin/licenses?external_customer_id=ls_order_${orderId}`;
  const body = await fetch(url, { headers }).then((r) => r.json());
  return body.data.licenses[0];
}

async function post(path, body = {}) {
  const res = await fetch(`${KEYGATE}/api/v1/admin/${path}`, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
  });
  if (!res.ok) throw new Error(`${path} answered ${res.status}`);
}

async function handle(event, data) {
  const a = data.attributes;

  if (event === "order_created") {
    const plan = PLANS[a.first_order_item.variant_id];
    if (!plan || (await findLicense(data.id))) return; // another product, or a repeated delivery
    await post("licenses", {
      product_id: PRODUCT_ID,
      plan_id: plan,
      email: a.user_email,
      external_customer_id: `ls_order_${data.id}`,
    });
  }

  // Sent for full and partial refunds alike.
  if (event === "order_refunded") {
    const license = await findLicense(data.id);
    if (license && license.status !== "revoked") await post(`licenses/${license.id}/revoke`);
  }

  // A canceled subscription expires at the end of the paid period.
  if (event === "subscription_expired") {
    const license = await findLicense(a.order_id);
    if (license?.status === "active") await post(`licenses/${license.id}/suspend`);
  }
}

createServer(async (req, res) => {
  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  const raw = Buffer.concat(chunks);

  const expected = Buffer.from(createHmac("sha256", SECRET).update(raw).digest("hex"));
  const given = Buffer.from(String(req.headers["x-signature"] ?? ""));
  if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
    res.writeHead(401).end();
    return;
  }

  const { meta, data } = JSON.parse(raw);
  try {
    await handle(meta.event_name, data);
    res.writeHead(200).end();
  } catch (err) {
    console.error(err);
    res.writeHead(500).end(); // Lemon Squeezy retries a few times
  }
}).listen(3000);