Android (Kotlin)

<uses-permission android:name="android.permission.INTERNET" />

<application .>
  <activity
    android:name=".blend.BlendCheckoutActivity"
    android:exported="false"
    android:configChanges="orientation|screenSize|keyboardHidden" />
</application>

package com.example.app.blend

import org.json.JSONObject
import java.io.BufferedReader
import java.net.HttpURLConnection
import java.net.URL

/**
 * Asks your own backend for a Blend session URL. Your backend holds the Blend
 * key and secret, calls POST https://api.blendapp.ai/api/v1/channel/session,
 * and returns only { "url": "." }.
 */
object BlendSessionClient {
    /** Replace with the route on your API that mints a Blend session for the signed-in user. */
    private const val SESSION_ENDPOINT = "https://api.example.com/api/blend/session"

    /** Blocking. Call from Dispatchers.IO. */
    fun fetchSessionUrl(appAuthToken: String): String {
        val conn = (URL(SESSION_ENDPOINT).openConnection() as HttpURLConnection).apply {
            requestMethod = "POST"
            setRequestProperty("Accept", "application/json")
            // Your app's normal user auth, so your backend knows who the buyer is.
            setRequestProperty("Authorization", "Bearer $appAuthToken")
            connectTimeout = 15_000
            readTimeout = 15_000
        }
        try {
            if (conn.responseCode !in 200.299) {
                throw IllegalStateException("Session request failed: " + conn.responseCode)
            }
            val body = conn.inputStream.bufferedReader().use(BufferedReader::readText)
            return JSONObject(body).getString("url")
        } finally {
            conn.disconnect()
        }
    }
}

/**
 * Called with the orderId from the bridge. The amount from the bridge is NOT
 * what gets charged: your backend re-fetches the authoritative amount for
 * orderId from Blend, charges THAT on your rail, and then calls
 * POST /v1/channel/orders/confirm (signed, server-to-server).
 */
object PartnerPayments {
    private const val CHARGE_ENDPOINT = "https://api.example.com/api/blend/charge"

    /** Blocking. Call from Dispatchers.IO. */
    fun chargeBlendOrder(
        orderId: String,
        displayAmount: Double,
        displayCurrency: String,
        appAuthToken: String,
    ) {
        // displayAmount / displayCurrency are only for the label on your own
        // payment sheet ("You are about to pay 42.50 USD"). Show your sheet
        // first if your rail needs buyer interaction, then send orderId on.
        val conn = (URL(CHARGE_ENDPOINT).openConnection() as HttpURLConnection).apply {
            requestMethod = "POST"
            doOutput = true
            setRequestProperty("Content-Type", "application/json")
            setRequestProperty("Authorization", "Bearer $appAuthToken")
            connectTimeout = 15_000
            readTimeout = 30_000
        }
        try {
            val payload = JSONObject().put("orderId", orderId).toString()
            conn.outputStream.use { it.write(payload.toByteArray()) }
            if (conn.responseCode !in 200.299) {
                throw IllegalStateException("Charge failed: " + conn.responseCode)
            }
            // Done. Do not touch the WebView: the page polls Blend every 3 seconds
            // for up to 6 minutes and shows the ticket itself once the order is paid.
        } finally {
            conn.disconnect()
        }
    }
}

package com.example.app.blend

import android.annotation.SuppressLint
import android.content.Intent
import android.net.Uri
import android.os.Bundle
import android.view.Gravity
import android.view.View
import android.view.ViewGroup.LayoutParams.MATCH_PARENT
import android.view.ViewGroup.LayoutParams.WRAP_CONTENT
import android.webkit.CookieManager
import android.webkit.JavascriptInterface
import android.webkit.WebView
import android.webkit.WebViewClient
import android.widget.Button
import android.widget.FrameLayout
import android.widget.LinearLayout
import android.widget.ProgressBar
import android.widget.TextView
import androidx.activity.OnBackPressedCallback
import androidx.appcompat.app.AppCompatActivity
import androidx.lifecycle.lifecycleScope
import androidx.swiperefreshlayout.widget.SwipeRefreshLayout
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.launch
import kotlinx.coroutines.withContext
import org.json.JSONObject

class BlendCheckoutActivity : AppCompatActivity() {

    private lateinit var webView: WebView
    private lateinit var swipeRefresh: SwipeRefreshLayout
    private lateinit var progress: ProgressBar
    private lateinit var errorView: LinearLayout
    private var hasLoadedOnce = false

    /** Your app's own user auth, passed in by whoever starts this Activity. */
    private val appAuthToken: String by lazy {
        intent.getStringExtra(EXTRA_APP_AUTH_TOKEN).orEmpty()
    }

    @SuppressLint("SetJavaScriptEnabled")
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        webView = WebView(this)
        buildLayout()

        // Required. The checkout and the bridge are JavaScript, and the page
        // keeps transient checkout state in DOM storage (off by default).
        webView.settings.javaScriptEnabled = true
        webView.settings.domStorageEnabled = true
        // Leave settings.userAgentString alone. The seat map is touch-optimised;
        // a desktop user agent gets the pointer layout.

        // Cookies must persist across navigations. Blend sets an httpOnly
        // session cookie scoped to /channel; losing it loses the session.
        CookieManager.getInstance().setAcceptCookie(true)
        CookieManager.getInstance().setAcceptThirdPartyCookies(webView, true)

        // Register BEFORE loadUrl. The page checks for window.BlendChannelPay
        // when it renders the Pay button; an interface added afterwards is not
        // seen. The name must be exactly this.
        webView.addJavascriptInterface(BlendChannelPayBridge(), BRIDGE_NAME)

        // Multiple-window support stays off (the default), so links that ask
        // for a new window - the ticket, for one - open in this WebView.
        webView.webViewClient = BlendWebViewClient()

        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
            override fun handleOnBackPressed() {
                if (webView.canGoBack()) webView.goBack() else finish()
            }
        })

        swipeRefresh.setOnRefreshListener {
            // Reloading the CURRENT page is safe: the session lives on the
            // cookie, not on the original token URL.
            webView.reload()
            swipeRefresh.isRefreshing = false
        }

        loadFreshSession()
    }

    override fun onDestroy() {
        webView.removeJavascriptInterface(BRIDGE_NAME)
        webView.destroy()
        super.onDestroy()
    }

    // -- Session ---------------------------------------------------------------

    private fun loadFreshSession() {
        showLoading()
        lifecycleScope.launch {
            try {
                val url = withContext(Dispatchers.IO) {
                    BlendSessionClient.fetchSessionUrl(appAuthToken)
                }
                webView.loadUrl(url)
            } catch (e: Exception) {
                showError()
            }
        }
    }

    // -- The bridge ------------------------------------------------------------

    private inner class BlendChannelPayBridge {
        /**
         * The page calls window.BlendChannelPay.postMessage(JSON.stringify({.})).
         * Android bindings accept primitives only, so the message is a JSON string.
         * This runs on a WebView background thread: hop to main before touching views.
         */
        @JavascriptInterface
        fun postMessage(message: String) {
            webView.post { handleBridgeMessage(message) }
        }
    }

    private fun handleBridgeMessage(message: String) {
        // 1. Origin check. A JavaScript interface is origin-blind: any script
        //    running in this WebView can call it. Only act when the WebView is
        //    currently showing a Blend page. Discard anything else silently.
        val currentHost = Uri.parse(webView.url ?: "").host
        if (!isBlendHost(currentHost)) return

        // 2. Read the hint. Only orderId is acted on. amount and currency are
        //    for the label on your own payment sheet and nothing else.
        val json = try {
            JSONObject(message)
        } catch (e: Exception) {
            return
        }
        if (json.optString("type") != "charge") return
        val orderId = json.optString("orderId")
        if (orderId.isEmpty()) return
        val displayAmount = json.optDouble("amount", 0.0)
        val displayCurrency = json.optString("currency")

        // 3. Charge through YOUR backend, which re-fetches the authoritative
        //    amount for this orderId from Blend and charges that.
        lifecycleScope.launch {
            try {
                withContext(Dispatchers.IO) {
                    PartnerPayments.chargeBlendOrder(
                        orderId, displayAmount, displayCurrency, appAuthToken,
                    )
                }
                // Nothing more to do. The page is already polling Blend for the outcome.
            } catch (e: Exception) {
                // Your rail declined, or the buyer cancelled your sheet. The
                // page's polling ends on its own; show your own message if you want one.
            }
        }
    }

    // -- Navigation ------------------------------------------------------------

    private inner class BlendWebViewClient : WebViewClient() {

        // The String overload is called directly below API 24 and forwarded to
        // by the WebResourceRequest overload from API 24, so one override covers
        // every supported level.
        @Deprecated("Overridden on purpose: covers API < 24; the newer overload forwards here.")
        override fun shouldOverrideUrlLoading(view: WebView, url: String): Boolean {
            // Blend hosts stay in this WebView. An external browser has neither
            // the session cookie nor the payment bridge.
            if (isBlendHost(Uri.parse(url).host)) return false

            // Anything else leaves, so this WebView only ever renders Blend.
            // That is what keeps the bridge registration safe to hold.
            try {
                startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url)))
            } catch (e: Exception) {
                // No app can open it. Nothing to do.
            }
            return true
        }

        override fun onPageFinished(view: WebView, url: String?) {
            hasLoadedOnce = true
            showContent()
        }

        // Same pattern: the newer overload forwards main-frame errors here.
        @Deprecated("Overridden on purpose: covers API < 23; the newer overload forwards here.")
        override fun onReceivedError(
            view: WebView,
            errorCode: Int,
            description: String?,
            failingUrl: String?,
        ) {
            // Before first paint: show the retry affordance. After it: the page
            // is still on screen and can recover on its own.
            if (hasLoadedOnce) showContent() else showError()
        }
    }

    // -- States and layout -----------------------------------------------------

    private fun showLoading() {
        progress.visibility = View.VISIBLE
        errorView.visibility = View.GONE
        swipeRefresh.visibility = View.INVISIBLE
    }

    private fun showContent() {
        progress.visibility = View.GONE
        errorView.visibility = View.GONE
        swipeRefresh.visibility = View.VISIBLE
    }

    private fun showError() {
        progress.visibility = View.GONE
        errorView.visibility = View.VISIBLE
        swipeRefresh.visibility = View.INVISIBLE
    }

    private fun buildLayout() {
        swipeRefresh = SwipeRefreshLayout(this).apply {
            addView(webView, MATCH_PARENT, MATCH_PARENT)
        }
        progress = ProgressBar(this)
        errorView = LinearLayout(this).apply {
            orientation = LinearLayout.VERTICAL
            gravity = Gravity.CENTER
            addView(TextView(context).apply { text = "Could not load the checkout." })
            addView(Button(context).apply {
                text = "Try again"
                // A session URL is single use. If the first load failed part-way
                // the token may be consumed, so retry always mints a new session.
                setOnClickListener { loadFreshSession() }
            })
        }

        val root = FrameLayout(this)
        root.addView(swipeRefresh, FrameLayout.LayoutParams(MATCH_PARENT, MATCH_PARENT))
        root.addView(progress, FrameLayout.LayoutParams(WRAP_CONTENT, WRAP_CONTENT, Gravity.CENTER))
        root.addView(errorView, FrameLayout.LayoutParams(MATCH_PARENT, MATCH_PARENT))
        setContentView(root)
    }

    companion object {
        const val EXTRA_APP_AUTH_TOKEN = "appAuthToken"

        /** The interface name Blend's page looks for. It must be exactly this. */
        private const val BRIDGE_NAME = "BlendChannelPay"

        /**
         * blendapp.ai and every subdomain of it (checkout.blendapp.ai,
         * tickets.blendapp.ai) are Blend. Everything else is not.
         */
        fun isBlendHost(host: String?): Boolean {
            val h = host?.lowercase() ?: return false
            return h == "blendapp.ai" || h.endsWith(".blendapp.ai")
        }
    }
}

startActivity(
    Intent(this, BlendCheckoutActivity::class.java)
        .putExtra(BlendCheckoutActivity.EXTRA_APP_AUTH_TOKEN, session.token)
)

window.BlendChannelPay.postMessage(JSON.stringify({
  type: 'charge',
  orderId: '<string>',
  amount: 42.5,
  currency: 'USD',
}));