iOS (Swift)

import Foundation

/// Fetches a Blend session URL from your own backend.
/// Your backend holds the Blend key and secret, calls
/// POST https://api.blendapp.ai/api/v1/channel/session, and returns only { url }.
enum BlendSessionClient {
  /// The shape YOUR backend returns. Only the URL is needed by the app.
  private struct SessionResponse: Decodable {
    let url: String
  }

  /// Replace with the route on your API that mints a Blend session for the signed-in user.
  private static let sessionEndpoint = URL(string: "https://api.example.com/api/blend/session")!

  static func fetchSessionURL(appAuthToken: String) async throws -> URL {
    var request = URLRequest(url: sessionEndpoint)
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Accept")
    // Your app's normal user auth, so your backend knows who the buyer is.
    request.setValue("Bearer " + appAuthToken, forHTTPHeaderField: "Authorization")

    let (data, response) = try await URLSession.shared.data(for: request)
    guard let http = response as? HTTPURLResponse, (200.<300).contains(http.statusCode) else {
      throw URLError(.badServerResponse)
    }
    let body = try JSONDecoder().decode(SessionResponse.self, from: data)
    guard let url = URL(string: body.url) else { throw URLError(.badURL) }
    return url
  }
}

import UIKit
import WebKit

// MARK: - Charging (your rail, through YOUR backend)

/// Called with the orderId from the bridge. The amount from the bridge is NOT
/// what gets charged: your backend re-fetches the authoritative amount for
/// orderId from Blend, charges THAT on your rail, and then calls
/// POST /v1/channel/orders/confirm (signed, server-to-server).
enum PartnerPayments {
  private static let chargeEndpoint = URL(string: "https://api.example.com/api/blend/charge")!

  static func chargeBlendOrder(orderId: String,
                               displayAmount: Double,
                               displayCurrency: String,
                               appAuthToken: String) async throws {
    // displayAmount / displayCurrency are only for the label on your own
    // payment sheet ("You are about to pay 42.50 USD"). Show your sheet here
    // if your rail needs buyer interaction, then hand the orderId to your backend.
    var request = URLRequest(url: chargeEndpoint)
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Content-Type")
    request.setValue("Bearer " + appAuthToken, forHTTPHeaderField: "Authorization")
    request.httpBody = try JSONSerialization.data(withJSONObject: ["orderId": orderId])

    let (_, response) = try await URLSession.shared.data(for: request)
    guard let http = response as? HTTPURLResponse, (200.<300).contains(http.statusCode) else {
      throw URLError(.badServerResponse)
    }
    // Done. Do not touch the webview: the page polls Blend every 3 seconds for
    // up to 6 minutes and shows the ticket itself once the order is paid.
  }
}

// MARK: - Weak handler proxy

/// WKUserContentController retains its handlers strongly. Forwarding through
/// a weak proxy lets the view controller deallocate normally.
final class WeakScriptMessageHandler: NSObject, WKScriptMessageHandler {
  private weak var target: WKScriptMessageHandler?

  init(_ target: WKScriptMessageHandler) {
    self.target = target
  }

  func userContentController(_ userContentController: WKUserContentController,
                             didReceive message: WKScriptMessage) {
    target?.userContentController(userContentController, didReceive: message)
  }
}

// MARK: - The checkout screen

final class BlendCheckoutViewController: UIViewController {

  /// The handler name Blend's page looks for. It must be exactly this.
  private static let bridgeName = "blendChannelPay"

  /// blendapp.ai and every subdomain of it (checkout.blendapp.ai,
  /// tickets.blendapp.ai) are Blend. Everything else is not.
  static func isBlendHost(_ host: String?) -> Bool {
    guard let host = host?.lowercased() else { return false }
    return host == "blendapp.ai" || host.hasSuffix(".blendapp.ai")
  }

  private let appAuthToken: String
  private var webView: WKWebView!
  private let spinner = UIActivityIndicatorView(style: .large)
  private let errorView = UIStackView()
  private var hasLoadedOnce = false

  init(appAuthToken: String) {
    self.appAuthToken = appAuthToken
    super.init(nibName: nil, bundle: nil)
  }

  required init?(coder: NSCoder) {
    fatalError("Use init(appAuthToken:)")
  }

  override func viewDidLoad() {
    super.viewDidLoad()
    view.backgroundColor = .systemBackground
    title = "Checkout"
    navigationItem.leftBarButtonItem = UIBarButtonItem(
      title: "Back", style: .plain, target: self, action: #selector(backTapped))

    // A configuration OWNED by this screen. Never reuse it for a webview that
    // loads non-Blend content: any page on a webview sharing this controller
    // could post a "charge" message.
    let config = WKWebViewConfiguration()
    // Persistent store: the httpOnly session cookie must survive navigations.
    // .nonPersistent() would drop it and the buyer would lose the session.
    config.websiteDataStore = .default()
    // Register BEFORE load. The page checks for this handler when it renders
    // the Pay button; a handler added afterwards is not seen.
    config.userContentController.add(WeakScriptMessageHandler(self), name: Self.bridgeName)

    webView = WKWebView(frame: .zero, configuration: config)
    webView.navigationDelegate = self
    webView.uiDelegate = self
    webView.allowsBackForwardNavigationGestures = true
    // Leave customUserAgent unset. The seat map is touch-optimised; a desktop
    // user agent would get the pointer layout.

    // Pull-to-refresh reloads the CURRENT page, which is safe: the session
    // lives on the cookie, not on the original token URL.
    let refresh = UIRefreshControl()
    refresh.addTarget(self, action: #selector(pullToRefresh(_:)), for: .valueChanged)
    webView.scrollView.refreshControl = refresh

    layoutSubviews()
    loadFreshSession()
  }

  deinit {
    webView?.configuration.userContentController
      .removeScriptMessageHandler(forName: Self.bridgeName)
  }

  // MARK: Loading

  private func loadFreshSession() {
    showLoading()
    Task { @MainActor [weak self] in
      guard let self else { return }
      do {
        let url = try await BlendSessionClient.fetchSessionURL(appAuthToken: self.appAuthToken)
        self.webView.load(URLRequest(url: url))
      } catch {
        self.showError()
      }
    }
  }

  @objc private func retryTapped() {
    // A session URL is single use. If the first load failed part-way, the
    // token may already be consumed, so retry always mints a new session.
    loadFreshSession()
  }

  @objc private func pullToRefresh(_ sender: UIRefreshControl) {
    webView.reload()
    sender.endRefreshing()
  }

  @objc private func backTapped() {
    if webView.canGoBack {
      webView.goBack()
    } else {
      closeCheckout()
    }
  }

  private func closeCheckout() {
    if let nav = navigationController, nav.viewControllers.first !== self {
      nav.popViewController(animated: true)
    } else {
      dismiss(animated: true)
    }
  }

  // MARK: States

  private func showLoading() {
    spinner.startAnimating()
    errorView.isHidden = true
    webView.alpha = 0
  }

  private func showContent() {
    spinner.stopAnimating()
    errorView.isHidden = true
    webView.alpha = 1
  }

  private func showError() {
    spinner.stopAnimating()
    errorView.isHidden = false
    webView.alpha = 0
  }

  private func layoutSubviews() {
    webView.translatesAutoresizingMaskIntoConstraints = false
    spinner.translatesAutoresizingMaskIntoConstraints = false
    errorView.translatesAutoresizingMaskIntoConstraints = false
    view.addSubview(webView)
    view.addSubview(spinner)
    view.addSubview(errorView)

    errorView.axis = .vertical
    errorView.alignment = .center
    errorView.spacing = 12
    let label = UILabel()
    label.text = "Could not load the checkout."
    label.textColor = .secondaryLabel
    let retry = UIButton(type: .system)
    retry.setTitle("Try again", for: .normal)
    retry.addTarget(self, action: #selector(retryTapped), for: .touchUpInside)
    errorView.addArrangedSubview(label)
    errorView.addArrangedSubview(retry)

    NSLayoutConstraint.activate([
      webView.topAnchor.constraint(equalTo: view.safeAreaLayoutGuide.topAnchor),
      webView.bottomAnchor.constraint(equalTo: view.bottomAnchor),
      webView.leadingAnchor.constraint(equalTo: view.leadingAnchor),
      webView.trailingAnchor.constraint(equalTo: view.trailingAnchor),
      spinner.centerXAnchor.constraint(equalTo: view.centerXAnchor),
      spinner.centerYAnchor.constraint(equalTo: view.centerYAnchor),
      errorView.centerXAnchor.constraint(equalTo: view.centerXAnchor),
      errorView.centerYAnchor.constraint(equalTo: view.centerYAnchor),
    ])
  }
}

// MARK: - The bridge

extension BlendCheckoutViewController: WKScriptMessageHandler {
  func userContentController(_ userContentController: WKUserContentController,
                             didReceive message: WKScriptMessage) {
    guard message.name == Self.bridgeName else { return }

    // 1. Origin check. A script message handler is origin-blind: any script
    //    running in this webview can post to it. Only act when the webview is
    //    currently showing a Blend page. Discard anything else silently.
    guard Self.isBlendHost(message.webView?.url?.host) else { return }

    // 2. Read the hint. Only orderId is acted on. amount and currency are for
    //    the label on your own payment sheet and nothing else.
    guard let body = message.body as? [String: Any],
          body["type"] as? String == "charge",
          let orderId = body["orderId"] as? String,
          !orderId.isEmpty else { return }
    let displayAmount = (body["amount"] as? NSNumber)?.doubleValue ?? 0
    let displayCurrency = body["currency"] as? String ?? ""

    // 3. Charge through YOUR backend, which re-fetches the authoritative
    //    amount for this orderId from Blend and charges that.
    Task { @MainActor [weak self] in
      guard let self else { return }
      do {
        try await PartnerPayments.chargeBlendOrder(orderId: orderId,
                                                   displayAmount: displayAmount,
                                                   displayCurrency: displayCurrency,
                                                   appAuthToken: self.appAuthToken)
        // Nothing more to do. The page is already polling Blend for the outcome.
      } catch {
        // Your rail declined, or the buyer cancelled your sheet. The page's
        // polling ends on its own; show your own message if you want one.
      }
    }
  }
}

// MARK: - Navigation policy

extension BlendCheckoutViewController: WKNavigationDelegate {
  func webView(_ webView: WKWebView,
               decidePolicyFor navigationAction: WKNavigationAction,
               decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
    guard let url = navigationAction.request.url else {
      decisionHandler(.cancel)
      return
    }

    // Blend hosts stay in this webview. An external browser has neither the
    // session cookie nor the payment bridge, so the buyer would be lost there.
    if Self.isBlendHost(url.host) {
      decisionHandler(.allow)
      return
    }

    // Anything else leaves. This webview only ever renders Blend, which is
    // what keeps the bridge registration safe to hold.
    if let scheme = url.scheme?.lowercased(), ["http", "https", "mailto", "tel"].contains(scheme) {
      UIApplication.shared.open(url)
    }
    decisionHandler(.cancel)
  }

  func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
    hasLoadedOnce = true
    showContent()
  }

  func webView(_ webView: WKWebView,
               didFailProvisionalNavigation navigation: WKNavigation!,
               withError error: Error) {
    handleLoadError(error)
  }

  func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
    handleLoadError(error)
  }

  private func handleLoadError(_ error: Error) {
    // A navigation we cancelled ourselves is not a failure.
    if (error as NSError).code == NSURLErrorCancelled { return }
    // Before first paint: show the retry affordance. After it: the page is
    // still on screen and can recover on its own.
    if hasLoadedOnce { showContent() } else { showError() }
  }
}

// MARK: - New-window links

extension BlendCheckoutViewController: WKUIDelegate {
  /// The ticket and a few other links ask for a new window. Load them here
  /// instead; the navigation policy above still decides whether they stay.
  func webView(_ webView: WKWebView,
               createWebViewWith configuration: WKWebViewConfiguration,
               for navigationAction: WKNavigationAction,
               windowFeatures: WKWindowFeatures) -> WKWebView? {
    if navigationAction.targetFrame == nil || navigationAction.targetFrame?.isMainFrame == false {
      webView.load(navigationAction.request)
    }
    return nil
  }
}

import SwiftUI
import UIKit

struct BlendCheckoutView: UIViewControllerRepresentable {
  let appAuthToken: String

  func makeUIViewController(context: Context) -> UINavigationController {
    UINavigationController(rootViewController: BlendCheckoutViewController(appAuthToken: appAuthToken))
  }

  func updateUIViewController(_ controller: UINavigationController, context: Context) {}
}

// Present it full screen so the checkout owns the whole surface:
//
//   .fullScreenCover(isPresented: $showCheckout) {
//     BlendCheckoutView(appAuthToken: session.token)
//   }

window.webkit.messageHandlers.blendChannelPay.postMessage({
  type: 'charge',
  orderId: '<string>',
  amount: 42.5,
  currency: 'USD',
});