yield-server.js

const express = require('express');
const cors = require('cors');
const axios = require('axios');
const fs = require('fs');
const path = require('path');

const app = express();
const PORT = 3457;

app.use(cors());
app.use(express.json());

// Cache for yield data
let yieldCache = {
  data: [],
  timestamp: null,
  ttl: 60000 // 60 seconds
};

// Signature tracking for replay protection
const usedSignatures = new Set();

// Risk scoring function
function calculateRisk(pool) {
  const tvl = pool.tvlUsd || 0;
  const apy = pool.apy || 0;
  let score = 0;
  
  // TVL scoring (lower TVL = higher risk)
  if (tvl < 500000) score += 4;
  else if (tvl < 1000000) score += 3;
  else if (tvl < 5000000) score += 1;
  
  // APY scoring (higher APY = higher risk)
  if (apy > 200) score += 4;
  else if (apy > 100) score += 2;
  else if (apy > 50) score += 1;
  
  return Math.min(score, 10);
}

function getRiskLabel(score) {
  if (score <= 2) return 'Low';
  if (score <= 5) return 'Medium';
  if (score <= 7) return 'High';
  return 'Very High';
}

// Fetch yield data from DefiLlama
async function fetchYields(refresh = false) {
  const now = Date.now();
  
  if (!refresh && yieldCache.data.length > 0 && (now - yieldCache.timestamp) < yieldCache.ttl) {
    return yieldCache.data;
  }
  
  try {
    console.log('Fetching fresh data from DefiLlama...');
    const response = await axios.get('https://yields.llama.fi/pools', {
      timeout: 15000,
      headers: { 'User-Agent': 'X-Money-Yield-API/1.0' }
    });
    
    // Filter for Base network, APY >= 15%, TVL >= $100k
    const filtered = response.data.data
      .filter(pool => 
        pool.chain === 'Base' && 
        pool.apy >= 15 && 
        pool.tvlUsd >= 100000
      )
      .map(pool => ({
        pool: pool.pool,
        symbol: pool.symbol,
        project: pool.project,
        apy: pool.apy,
        apyBase: pool.apyBase || 0,
        apyReward: pool.apyReward || 0,
        tvlUsd: pool.tvlUsd,
        riskScore: calculateRisk(pool),
        riskLabel: getRiskLabel(calculateRisk(pool)),
        chain: pool.chain,
        url: pool.url
      }))
      .sort((a, b) => b.apy - a.apy);
    
    yieldCache = { data: filtered, timestamp: now };
    console.log(`Cached ${filtered.length} pools`);
    return filtered;
  } catch (error) {
    console.error('Error fetching yields:', error.message);
    if (yieldCache.data.length > 0) {
      return yieldCache.data; // Return stale data on error
    }
    throw error;
  }
}

// Payment validation middleware
function validatePayment(req, res, next) {
  const paymentHeader = req.headers['x-402-payment'];
  
  if (!paymentHeader) {
    return res.status(402).json({
      success: false,
      error: 'Payment required. Send X-402-Payment header or subscribe for $5/month',
      paymentInfo: {
        recipient: '0x6d15eE39fB46Eb439d7B19ACed5d36A4A327eAa2',
        amount: '10000 micros ($0.01)',
        header: 'X-402-Payment: scheme=ethereum; signature=0x...; amount=10000'
      }
    });
  }
  
  // Parse payment header
  const parts = paymentHeader.split(';').map(p => p.trim());
  const payment = {};
  parts.forEach(part => {
    const [key, value] = part.split('=').map(s => s.trim());
    if (key && value) payment[key] = value;
  });
  
  // Basic validation
  if (!payment.scheme || !payment.signature || !payment.amount) {
    return res.status(402).json({
      success: false,
      error: 'Invalid payment header format'
    });
  }
  
  // Check amount (10000 micros = $0.01)
  const amount = parseInt(payment.amount);
  if (amount < 10000) {
    return res.status(402).json({
      success: false,
      error: 'Insufficient payment. Minimum: 10000 micros ($0.01)'
    });
  }
  
  // Replay protection
  if (usedSignatures.has(payment.signature)) {
    return res.status(402).json({
      success: false,
      error: 'Signature already used (replay protection)'
    });
  }
  usedSignatures.add(payment.signature);
  
  // Clean old signatures (keep last 1000)
  if (usedSignatures.size > 1000) {
    const arr = Array.from(usedSignatures);
    usedSignatures.clear();
    arr.slice(-500).forEach(sig => usedSignatures.add(sig));
  }
  
  console.log(`Payment validated: ${payment.signature.substring(0, 16)}...`);
  next();
}

// ============ PUBLIC ENDPOINTS (No Payment) ============

app.get('/', (req, res) => {
  res.sendFile(path.join(__dirname, 'landing.html'));
});

app.get('/api-docs.md', (req, res) => {
  res.sendFile(path.join(__dirname, 'api-docs.md'));
});

app.get('/api/health', async (req, res) => {
  try {
    const data = await fetchYields(false);
    res.json({
      status: 'ok',
      timestamp: new Date().toISOString(),
      poolsCached: data.length,
      lastUpdate: new Date(yieldCache.timestamp).toISOString(),
      endpoints: {
        free: ['/api/health', '/api/pricing'],
        paid: ['/api/yields', '/api/top', '/api/alerts', '/api/risk']
      }
    });
  } catch (error) {
    res.json({
      status: 'degraded',
      timestamp: new Date().toISOString(),
      error: error.message
    });
  }
});

app.get('/api/pricing', (req, res) => {
  res.json({
    pricing: {
      perRequest: '$0.01',
      monthly: '$5.00',
      features: [
        'Real-time Base DeFi yields',
        'Risk scoring (0-10)',
        'TVL filtering',
        'Protocol filtering',
        '60s cache TTL'
      ]
    },
    payment: {
      method: 'x402',
      header: 'X-402-Payment',
      recipient: '0x6d15eE39fB46Eb439d7B19ACed5d36A4A327eAa2',
      minAmount: '10000 micros ($0.01)'
    },
    endpoints: {
      '/api/yields': 'All filtered yields',
      '/api/top': 'Top N yields with filters',
      '/api/alerts': 'High yield alerts',
      '/api/risk': 'Low-risk pools only'
    }
  });
});

// ============ PAID ENDPOINTS ============

app.get('/api/yields', validatePayment, async (req, res) => {
  try {
    const refresh = req.query.refresh === 'true';
    const minApy = parseFloat(req.query.minApy) || 15;
    const minTvl = parseFloat(req.query.minTvl) || 100000;
    
    const data = await fetchYields(refresh);
    const filtered = data.filter(p => p.apy >= minApy && p.tvlUsd >= minTvl);
    
    res.json({
      success: true,
      timestamp: new Date().toISOString(),
      count: filtered.length,
      filters: { minApy, minTvl },
      data: filtered
    });
  } catch (error) {
    res.status(500).json({
      success: false,
      error: error.message
    });
  }
});

app.get('/api/top', validatePayment, async (req, res) => {
  try {
    const limit = parseInt(req.query.limit) || 10;
    const minApy = parseFloat(req.query.minApy) || 15;
    
    const data = await fetchYields();
    const filtered = data.filter(p => p.apy >= minApy).slice(0, limit);
    
    res.json({
      success: true,
      timestamp: new Date().toISOString(),
      count: filtered.length,
      filters: { limit, minApy },
      data: filtered
    });
  } catch (error) {
    res.status(500).json({
      success: false,
      error: error.message
    });
  }
});

app.get('/api/alerts', validatePayment, async (req, res) => {
  try {
    const threshold = parseFloat(req.query.threshold) || 50;
    
    const data = await fetchYields();
    const alerts = data.filter(p => p.apy >= threshold);
    
    res.json({
      success: true,
      timestamp: new Date().toISOString(),
      threshold,
      count: alerts.length,
      data: alerts
    });
  } catch (error) {
    res.status(500).json({
      success: false,
      error: error.message
    });
  }
});

app.get('/api/risk', validatePayment, async (req, res) => {
  try {
    const maxRisk = parseInt(req.query.maxRisk) || 3;
    
    const data = await fetchYields();
    const safe = data.filter(p => p.riskScore <= maxRisk);
    
    res.json({
      success: true,
      timestamp: new Date().toISOString(),
      maxRisk,
      count: safe.length,
      data: safe
    });
  } catch (error) {
    res.status(500).json({
      success: false,
      error: error.message
    });
  }
});

// Start server
app.listen(PORT, () => {
  console.log(`🚀 X-Money Yield API running on port ${PORT}`);
  console.log(`📊 Health: http://localhost:${PORT}/api/health`);
  console.log(`💰 Landing: http://localhost:${PORT}/`);
});

// Serve landing page
app.get('/', (req, res) => {
    res.sendFile(path.join(__dirname, 'landing.html'));
});