Custom UI

curl -s -X POST "$BASE/oauth/token" \
  -u "$LACES_CLIENT_ID:$LACES_CLIENT_SECRET" \
  -d "grant_type=client_credentials"

curl -s "$BASE/events?limit=20" -H "Authorization: Bearer $TOKEN"
curl -s "$BASE/events/q3Zk9mVx" -H "Authorization: Bearer $TOKEN"

{
  "code": 201,
  "message": "Cart created successfully",
  "data": {
    "order": {
      "id": "Hk2mQ8vR",
      "order_code": "LC-7K2M9X",
      "event_id": "q3Zk9mVx",
      "status": "cart",
      "currency": "UGX",
      "subtotal": 50000,
      "discount_total": 0,
      "donation_total": 0,
      "laces_fee": 2400,
      "total": 52400,
      "ticket_count": 1,
      "buyer": { "name": "Amina Nakato", "email": "amina@example.com", "phone": "+256763494235" },
      "attribution": {
        "channel": "partner_api",
        "api_client_id": "LCSCLI-EXAMPLECLNT2345EXAMP",
        "checkout_session_id": null,
        "partner_reference": "cart-8841"
      },
      "hold_expires_at": "2026-10-09T08:29:03.000Z",
      "created_at": "2026-10-09T08:14:03.000Z"
    },
    "checkout_lines": [
      { "label": "Subtotal", "amount": 50000 },
      { "label": "Laces Service Fee", "amount": 2400 },
      { "label": "Total", "amount": 52400 }
    ],
    "is_free": false,
    "is_test_mode": false,
    "fee_rate": { "flat_fee": 0, "percent_fee": 0, "currency": "UGX", "payment_method": "momo" },
    "registrations": [ { "id": "rg_5TfK2", "ticket_type_id": "tt_10k", "distance_km": 10, "status": "pending" } ],
    "event_name": "Kampala City 10K",
    "event_when_label": "Sun 15 Nov 2026, 7:00 AM"
  }
}

async function waitForOutcome(orderId, { timeoutMs = 180_000 } = {}) {
  const until = Date.now() + timeoutMs;
  while (Date.now() < until) {
    const order = await laces("GET", `/orders/${orderId}`);
    if (!["cart", "payment_initiated", "prompt_sent"].includes(order.status)) return order;
    await new Promise((r) => setTimeout(r, 4000));
  }
  return null; // still pending: keep waiting for the webhook
}

// Node 18+. Server only.
import crypto from "node:crypto";

const BASE = process.env.LACES_BASE; // https://connect.laces.run/v1
const CLIENT_ID = process.env.LACES_CLIENT_ID;
const CLIENT_SECRET = process.env.LACES_CLIENT_SECRET;

let cached = { token: null, exp: 0 };
async function getLacesToken() {
  if (cached.token && Date.now() < cached.exp - 60_000) return cached.token;
  const basic = Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64");
  const r = await fetch(`${BASE}/oauth/token`, {
    method: "POST",
    headers: { Authorization: `Basic ${basic}`, "Content-Type": "application/x-www-form-urlencoded" },
    body: "grant_type=client_credentials",
  });
  const body = await r.json();
  if (!r.ok) throw new Error(`token: ${body.error}`);
  cached = { token: body.access_token, exp: Date.now() + body.expires_in * 1000 };
  return cached.token;
}

async function laces(method, path, { body, idempotencyKey } = {}) {
  const r = await fetch(`${BASE}${path}`, {
    method,
    headers: {
      Authorization: `Bearer ${await getLacesToken()}`,
      "Content-Type": "application/json",
      ...(idempotencyKey && { "Idempotency-Key": idempotencyKey }),
    },
    body: body && JSON.stringify(body),
  });
  const json = await r.json().catch(() => ({}));
  if (!r.ok) {
    const err = new Error(json.error_code ?? `http_${r.status}`);
    Object.assign(err, { status: r.status, code: json.error_code, body: json });
    throw err;
  }
  return json.data;
}

export async function checkout(cart, event) {
  // Keys are generated once and saved with the cart, so retries reuse them.
  cart.createKey ??= crypto.randomUUID();
  cart.payKey ??= crypto.randomUUID();
  await db.saveCart(cart);

  const { order } = await laces("POST", "/orders", {
    idempotencyKey: cart.createKey,
    body: {
      event_id: event.event_id,
      lines: cart.lines,
      buyer_name: cart.buyer.name,
      buyer_email: cart.buyer.email,
      buyer_phone: cart.buyer.phone,
      payment_method: cart.method, // "momo" | "airtel" (from event.payment_methods)
      ...(event.waiver_required && { waiver_accepted: true, waiver_version: event.waiver_version }),
      partner_reference: cart.id,
    },
  });

  const pay = await laces("POST", `/orders/${order.id}/pay`, {
    idempotencyKey: cart.payKey,
    body: order.total === 0 ? {} : { msisdn: cart.buyer.phone },
  });

  return { orderId: order.id, total: order.total, currency: order.currency, next: pay.next_action };
}