added some updates

Author: emdevelopa

backend/.env.example

@@ -31,10 +31,15 @@ USDC_ISSUER=your_usdc_issuer
 
 # x402 pay-per-request config
 # Charge applied to POST /api/create-payment and POST /api/sessions
+# Note: charged endpoints still require merchant API key auth.
 X402_PROVIDER_PUBLIC_KEY=your_stellar_public_key
 X402_JWT_SECRET=replace_with_random_secret
 X402_TOKEN_EXPIRY_SECONDS=60
 X402_CREATE_PAYMENT_AMOUNT=0.01
+# Optional: when false, x402 is opt-in per request via header/query.
+# true  => every create-payment/sessions call is challenged when token missing
+# false => only requests with x-pluto-pricing-mode: x402 (or ?pricing_mode=x402) are challenged
+X402_ENFORCE_DEFAULT=false
 
 # Webhook signing – shared secret used to produce Stellar-Signature: sha256=<hmac>
 # Generate a strong random value, e.g.: openssl rand -hex 32

backend/scripts/demoAgent.js

@@ -16,14 +16,13 @@ import prometheusRouter from "./routes/prometheus.js";
 import sep0001Router from "./routes/sep0001.js";
 import paymentDetailsRouter from "./routes/paymentDetails.js";
 import x402Router from "./routes/x402.js";
-import demoRouter from "./routes/demo.js";
+import authRouter from "./routes/auth.js";
 
 import { requireApiKeyAuth } from "./lib/auth.js";
 import { isHorizonReachable } from "./lib/stellar.js";
 import { supabase } from "./lib/supabase.js";
 import { pool } from "./lib/db.js";
 import { x402Middleware } from "./middleware/x402.js";
-import { x402AuthBridge } from "./middleware/x402-auth.js";
 
 import { idempotencyMiddleware } from "./lib/idempotency.js";
 import { setupSentryErrorHandler } from "./lib/sentry.js";
@@ -218,12 +217,14 @@ export async function createApp({ redisClient }) {
   const x402Provider = process.env.X402_PROVIDER_PUBLIC_KEY;
   const x402Enabled = Boolean(x402Provider && process.env.X402_JWT_SECRET);
   const x402CreatePaymentAmount = process.env.X402_CREATE_PAYMENT_AMOUNT || "0.01";
+  const x402EnforceDefault = String(process.env.X402_ENFORCE_DEFAULT || "false").toLowerCase() === "true";
 
   if (x402Enabled) {
     const requireCreatePaymentCharge = x402Middleware({
       amount: x402CreatePaymentAmount,
       recipient: x402Provider,
       memo_prefix: "pluto-create",
+      enforceByDefault: x402EnforceDefault,
     });
 
     app.use("/api/create-payment", requireCreatePaymentCharge);
@@ -232,13 +233,11 @@ export async function createApp({ redisClient }) {
 
   app.use(
     "/api/create-payment",
-    x402Enabled ? x402AuthBridge() : (_req, _res, next) => next(),
     requireApiKeyAuth(),
     idempotencyMiddleware
   );
   app.use(
     "/api/sessions",
-    x402Enabled ? x402AuthBridge() : (_req, _res, next) => next(),
     requireApiKeyAuth(),
     idempotencyMiddleware
   );
@@ -249,6 +248,7 @@ export async function createApp({ redisClient }) {
 
   app.use("/api", createPaymentsRouter({ verifyPaymentRateLimit }));
   app.use("/api", createMerchantsRouter({ merchantRegistrationRateLimit }));
+  app.use("/api", authRouter);
   app.use("/api", metricsRouter);
   app.use("/api", webhooksRouter);
   app.use("/api/payments", paymentDetailsRouter); // NEW — GET /api/payments/:id
@@ -262,9 +262,6 @@ export async function createApp({ redisClient }) {
   // x402 pay-per-request verification (public — agents call this)
   app.use("/api", x402Router);
 
-  // Demo routes showing x402 in action
-  app.use("/api", demoRouter);
-
   // Sentry error handler — must come after all routes, before custom error handler
   setupSentryErrorHandler(app);
 

backend/src/app.js

@@ -11,7 +11,7 @@
  *   4. Client retries with X-Payment-Token: <jwt> → gets access
  */
 
-import { createHmac, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import jwt from "jsonwebtoken";
 
 const USDC_ISSUER = process.env.USDC_ISSUER ||
@@ -26,6 +26,7 @@ const USDC_ISSUER = process.env.USDC_ISSUER ||
  * @param {string} [config.asset]         - Asset code, defaults to "USDC"
  * @param {string} [config.plutoVerifyUrl] - URL of /api/verify-x402
  * @param {string} [config.memo_prefix]   - Memo prefix, defaults to "x402"
+ * @param {boolean} [config.enforceByDefault] - If true, always challenge when token is absent
  */
 export function x402Middleware(config) {
   const {
@@ -34,6 +35,7 @@ export function x402Middleware(config) {
     asset = "USDC",
     plutoVerifyUrl = `${process.env.PAYMENT_LINK_BASE?.replace(":3000", ":4000") || "http://localhost:4000"}/api/verify-x402`,
     memo_prefix = "x402",
+    enforceByDefault = false,
   } = config;
 
   const jwtSecret = process.env.X402_JWT_SECRET;
@@ -43,6 +45,13 @@ export function x402Middleware(config) {
 
   return function requirePayment(req, res, next) {
     const token = req.headers["x-payment-token"];
+    const modeHeader = String(req.headers["x-pluto-pricing-mode"] || "")
+      .trim()
+      .toLowerCase();
+    const modeQueryRaw = req.query?.pricing_mode;
+    const modeQuery =
+      typeof modeQueryRaw === "string" ? modeQueryRaw.trim().toLowerCase() : "";
+    const requestedX402 = modeHeader === "x402" || modeQuery === "x402";
 
     if (token) {
       try {
@@ -54,6 +63,13 @@ export function x402Middleware(config) {
       }
     }
 
+    // Dual-mode behavior:
+    // - Subscription/API-key mode: pass through
+    // - x402 mode: challenge with 402
+    if (!enforceByDefault && !requestedX402) {
+      return next();
+    }
+
     const requestId = randomUUID().replace(/-/g, "");
     const separator = "-";
     const maxMemoBytes = 28;

backend/src/middleware/x402.js

@@ -93,7 +93,7 @@ router.post("/auth/login", async (req, res, next) => {
   }
 });
 
-
+/*
  *   post:
  *     summary: Generate a SEP-0010 challenge transaction
  *     tags: [Auth]