Wire it up once, earn everywhere.

import crypto from 'crypto';

function isValidCallback(fullUrl: string, serverKey: string): boolean {
  const url = new URL(fullUrl);
  const receivedHash = url.searchParams.get('hash');
  if (!receivedHash) return false;

  url.searchParams.delete('hash');
  const expected = crypto
    .createHmac('sha1', serverKey)
    .update(url.toString())
    .digest('hex');

  const a = Buffer.from(receivedHash);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express handler for your Reward Callback URL
app.get('/reward-callback', (req, res) => {
  const fullUrl = `${req.protocol}://${req.get('host')}${req.originalUrl}`;

  if (!isValidCallback(fullUrl, process.env.GOOLARR_SERVER_KEY!)) {
    return res.status(401).send('INVALID_HASH');
  }

  const { uid, tx, type, val } = req.query;
  const [appId, userId] = String(uid).split('--');

  if (await alreadyProcessed(tx as string)) {
    return res.status(200).send('OK'); // already credited, ignore
  }

  if (type === 'COMPLETE') {
    await creditUser(userId, Number(val));
  }

  await recordTransaction(tx as string);
  res.status(200).send('OK');
});