API для разработчиков

# 1. How much to buy for this transfer
curl -X POST https://api.enralo.com/v1/transfer-estimate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"from_address":"SENDER","to_address":"RECIPIENT"}'
# -> {"amount":65000,"required_energy":65000,"available_energy":0,
#     "purchase_needed":true,"basis":"onchain","resource_type":"energy","duration":"1h"}

# 2. Quote (amount and target_address come from the estimate)
curl -X POST https://api.enralo.com/v1/quotes \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"resource_type":"energy","amount":65000,"duration":"1h","target_address":"SENDER"}'

# 3. Execute quote (idempotent)
curl -X POST https://api.enralo.com/v1/orders \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: my-unique-key-1" \
  -d '{"quote_id":"QUOTE_ID"}'

# 4. Status
curl https://api.enralo.com/v1/orders/ORDER_ID -H "Authorization: Bearer YOUR_API_KEY"

const API = 'https://api.enralo.com';
const KEY = process.env.TRXPORTAL_API_KEY;

const call = (path, body, extraHeaders = {}) =>
  fetch(`${API}${path}`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${KEY}`, 'Content-Type': 'application/json', ...extraHeaders },
    body: JSON.stringify(body),
  }).then(r => r.json());

// sender pays the USDT, recipient receives it
async function coverTransferFee(sender, recipient) {
  const estimate = await call('/v1/transfer-estimate', {
    from_address: sender,
    to_address: recipient,
  });

  // The sender already has enough resource — nothing to buy
  if (!estimate.purchase_needed) return null;

  const quote = await call('/v1/quotes', {
    resource_type: estimate.resource_type,
    amount: estimate.amount,
    duration: estimate.duration,
    target_address: sender,
  });

  return call('/v1/orders', { quote_id: quote.quote_id }, {
    'Idempotency-Key': `cover-${sender}-${Date.now()}`,
  }); // statuses via webhook, or poll GET /v1/orders/{id}
}

// Verify incoming webhook signature (Node.js / Express)
const crypto = require('crypto');

app.post('/webhooks/trxportal', express.raw({ type: '*/*' }), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.TRXPORTAL_WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');
  if (req.headers['x-tp-signature'] !== expected) return res.status(401).end();

  // Delivery headers: X-Tp-Event-Id (dedupe), X-Tp-Timestamp
  const event = JSON.parse(req.body);
  // event.event_type: order.submitted | order.delegated | order.completed |
  //                   order.failed | order.refunded | deposit.credited |
  //                   balance.low | webhook.test
  res.status(200).end();
});