// DON'T: Hardcode keys
const paygate = new PayGate('sk_live_abc123...')

// DON'T: Use keys in client-side code
// <script>const key = 'sk_live_...'</script>

// DO: Use environment variables
const paygate = new PayGate(process.env.PAYGATE_SECRET_KEY)

// DO: Keep keys out of version control
// .gitignore
// .env
// .env.local
// .env.production

// Always verify signatures
const event = Webhook.constructEvent(payload, signature, secret)

// Use HTTPS endpoints only
// PayGate won't deliver to HTTP in live mode

// Return 200 quickly
app.post('/webhooks', (req, res) => {
  res.json({ received: true }) // Acknowledge immediately
  processEventAsync(event) // Process in background
})

// Don't log sensitive data
console.log(payment) // DON'T log full payment objects

console.log({
  id: payment.id,
  status: payment.status,
  amount: payment.amount
}) // DO: log only what you need

// Mask phone numbers in logs
const maskedPhone = phone.replace(/(\d{3})\d{4}(\d{3})/, '$1****$2')

try {
  const payment = await paygate.payments.create(params)
} catch (error) {
  if (error instanceof PayGateError) {
    switch (error.type) {
      case 'authentication_error':
        // Check API key
        logger.error('Authentication failed')
        throw new Error('Payment service configuration error')

      case 'invalid_request_error':
        // Validation failed
        throw new Error(getUserFriendlyMessage(error.code))

      case 'payment_error':
        // Payment-specific error
        throw new Error(getPaymentErrorMessage(error.code))

      case 'rate_limit_error':
        // Too many requests
        await sleep(60000)
        return retry()

      case 'api_error':
        // Server error
        logger.error('PayGate server error', { error })
        throw new Error('Payment service temporarily unavailable')
    }
  }

  // Network or unknown error
  logger.error('Unknown payment error', { error })
  throw new Error('Unable to process payment. Please try again.')
}

const errorMessages = {
  // Payment errors
  'insufficient_funds': 'Your mobile money balance is too low. Please top up and try again.',
  'phone_unreachable': 'We couldn\'t reach your phone. Make sure it\'s on and has network.',
  'timeout': 'The payment timed out. Please try again.',
  'transaction_declined': 'The payment was declined. Please check your PIN and try again.',
  'daily_limit_exceeded': 'You\'ve reached your daily limit. Try again tomorrow.',

  // Validation errors
  'invalid_phone': 'Please enter a valid Ghana phone number.',
  'amount_too_small': 'The minimum payment amount is GHS 1.00.',
  'amount_too_large': 'The amount exceeds the maximum allowed.',

  // Generic
  'default': 'Something went wrong. Please try again or contact support.'
}

function getUserFriendlyMessage(code) {
  return errorMessages[code] || errorMessages.default
}

import { metrics } from './monitoring'

// Track payment outcomes
async function createPayment(params) {
  const start = Date.now()

  try {
    const payment = await paygate.payments.create(params)
    metrics.increment('payments.created')
    metrics.timing('payments.latency', Date.now() - start)
    return payment
  } catch (error) {
    metrics.increment('payments.failed', { code: error.code })
    throw error
  }
}

// Track webhook processing
app.post('/webhooks', async (req, res) => {
  metrics.increment('webhooks.received')

  try {
    const event = Webhook.constructEvent(...)
    await processEvent(event)
    metrics.increment('webhooks.processed')
  } catch (error) {
    metrics.increment('webhooks.failed')
  }

  res.json({ received: true })
})