Widgets

// app/api/cadenya/widget-session/route.ts
import Cadenya from "@cadenya/cadenya";

export const runtime = "nodejs"; // The server SDK needs Node, not the Edge runtime.
export const dynamic = "force-dynamic"; // Never cache a minted token.

// The SDK reads CADENYA_API_KEY and CADENYA_WORKSPACE_ID from the environment.
// Module scope lets the route reuse the client across requests.
const client = new Cadenya();

export async function POST() {
  // Identify the visitor from your own auth, not from the request body.
  // const user = await getSession();
  // if (!user) return new Response("Unauthorized", { status: 401 });

  const result = await client.widgetSessions.create({
    spec: {
      widgetId: process.env.CADENYA_WIDGET_ID!,
      // tenant: { id: user.orgId, name: user.orgName },
      // subject: { id: user.id, name: user.name },
    },
  });

  if (!result.info?.host) {
    return new Response("Widget Session did not include a host", { status: 502 });
  }

  return Response.json(
    {
      token: result.spec.token,
      host: result.info.host,
      tokenExpiresAt: result.spec.tokenExpiresAt,
    },
    { headers: { "Cache-Control": "no-store" } },
  );
}

// src/routes/widget-session.ts
import Cadenya from "@cadenya/cadenya";
import type { FastifyPluginAsync } from "fastify";

const client = new Cadenya();

const widgetSessionRoutes: FastifyPluginAsync = async (app) => {
  app.post("/api/cadenya/widget-session", async (_request, reply) => {
    // Identify the visitor from your own auth, not from the request body.
    // const user = await requireUser(request);

    const result = await client.widgetSessions.create({
      spec: {
        widgetId: process.env.CADENYA_WIDGET_ID!,
        // tenant: { id: user.orgId, name: user.orgName },
        // subject: { id: user.id, name: user.name },
      },
    });

    if (!result.info?.host) {
      return reply.code(502).send({
        error: "Widget Session did not include a host",
      });
    }

    reply.header("Cache-Control", "no-store");
    return {
      token: result.spec.token,
      host: result.info.host,
      tokenExpiresAt: result.spec.tokenExpiresAt,
    };
  });
};

export default widgetSessionRoutes;

module Api
  module Cadenya
    class WidgetSessionsController < ApplicationController
      def create
        # Identify the visitor from your own auth, not from params.
        # user = current_user!

        client = ::Cadenya::Client.new
        widget_session = client.widget_sessions.create(
          spec: {
            widget_id: ENV.fetch("CADENYA_WIDGET_ID"),
            # tenant: { id: user.org_id, name: user.org_name },
            # subject: { id: user.id, name: user.name },
          },
        )

        if widget_session.info&.host.to_s.empty?
          return render(
            json: { error: "Widget Session did not include a host" },
            status: :bad_gateway,
          )
        end

        response.headers["Cache-Control"] = "no-store"
        render json: {
          token: widget_session.spec.token,
          host: widget_session.info.host,
          tokenExpiresAt: widget_session.spec.token_expires_at,
        }
      end
    end
  end
end

package widgets

import (
	"encoding/json"
	"net/http"
	"os"

	cadenya "go.cadenya.com/cadenya-go"
)

// Register this handler at POST /api/cadenya/widget-session.
func WidgetSessionHandler(client *cadenya.Client) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPost {
			w.WriteHeader(http.StatusMethodNotAllowed)
			return
		}

		// Identify the visitor from your own auth, not from the request body.
		// user := UserFromContext(r.Context())

		result, err := client.WidgetSessions().Create(
			r.Context(),
			(&cadenya.WidgetSessionCreateBuilder{}).
				Spec(&cadenya.WidgetSessionSpecParam{
					WidgetID: os.Getenv("CADENYA_WIDGET_ID"),
					// Tenant: &cadenya.TenantAssertion{ID: user.OrgID},
					// Subject: &cadenya.SubjectAssertion{ID: user.ID},
				}).
				ToParams(),
		)
		if err != nil {
			http.Error(w, "Could not create a Widget Session", http.StatusBadGateway)
			return
		}
		if result.Info == nil || result.Info.Host == "" || result.Spec == nil {
			http.Error(w, "Widget Session did not include a host", http.StatusBadGateway)
			return
		}

		w.Header().Set("Cache-Control", "no-store")
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{
			"token":          result.Spec.Token,
			"host":           result.Info.Host,
			"tokenExpiresAt": result.Spec.TokenExpiresAt,
		})
	}
}