Cloudflare Worker

// Trendly conversion relay for Cloudflare Workers. Version 1.0.
// Docs: https://trendly.com.sa/developers/cloudflare
//
// What it does
//   1. Remembers the creator. A visit with ?trendly=CODE sets a first-party cookie
//      "trendly_ref" for COOKIE_DAYS days (30 by default), then serves the page as usual.
//   2. Forwards conversions. Your backend sends POST /trendly/conversion with the
//      header "X-Relay-Secret: <RELAY_SECRET>" and the order as JSON. The Worker reports it to
//      Trendly and answers with what Trendly recorded.
//
// Secrets (wrangler secret put NAME)
//   TRENDLY_API_KEY   Your Trendly key, trk_test_... while testing, trk_live_... in production.
//   RELAY_SECRET      Any long random string. Your backend sends it in X-Relay-Secret.
//
// Variables (wrangler.toml [vars])
//   TRENDLY_API_BASE  https://api.trendly.com.sa
//   TRENDLY_PROGRAM   (optional) your affiliate program id
//   COOKIE_DAYS       30

const LINK_PARAM = 'trendly';
const COOKIE = 'trendly_ref';
const CONVERSION_PATH = '/trendly/conversion';
const HEALTH_PATH = '/trendly/health';
const STATUSES = ['pending', 'confirmed', 'cancelled', 'refunded', 'partially_refunded', 'fraud'];

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    if (url.pathname === CONVERSION_PATH) return conversion(request, env);
    if (url.pathname === HEALTH_PATH) return health(request, env);
    return remember(request, env, url);
  },
};

// 1. Remember the creator whose link brought the visitor in.
async function remember(request, env, url) {
  const response = await fetch(request);
  const code = cleanCode(url.searchParams.get(LINK_PARAM));
  if (!code) return response;
  const days = Number(env.COOKIE_DAYS) > 0 ? Number(env.COOKIE_DAYS) : 30;
  const withCookie = new Response(response.body, response);
  withCookie.headers.append(
    'Set-Cookie',
    COOKIE + '=' + encodeURIComponent(code) + '; Max-Age=' + days * 86400 + '; Path=/; Secure; SameSite=Lax',
  );
  return withCookie;
}

// 2. Forward one conversion to Trendly.
async function conversion(request, env) {
  if (request.method !== 'POST') return json({ error: 'method_not_allowed' }, 405);
  if (!env.TRENDLY_API_KEY || !env.RELAY_SECRET) return json({ error: 'worker_not_configured' }, 500);
  if (!sameSecret(request.headers.get('X-Relay-Secret'), env.RELAY_SECRET)) return json({ error: 'unauthorized' }, 401);

  let body;
  try {
    body = await request.json();
  } catch (e) {
    return json({ error: 'invalid_json' }, 400);
  }

  const order = toTrendlyOrder(body, request, env);
  if (!order.order_id) return json({ error: 'order_id_required' }, 400);
  if (!STATUSES.includes(order.status)) return json({ error: 'unknown_status', allowed: STATUSES }, 400);
  if (!order.total_amount) return json({ error: 'total_amount_required' }, 400);

  const result = await sendToTrendly(env, '/v1/orders', order);
  return json(result.body, result.status);
}

// Checks the key and the connection, for your monitoring. Needs the relay secret too.
async function health(request, env) {
  if (!sameSecret(request.headers.get('X-Relay-Secret'), env.RELAY_SECRET)) return json({ error: 'unauthorized' }, 401);
  const result = await sendToTrendly(env, '/v1/ping');
  return json(result.body, result.status);
}

// Your fields in, Trendly's order out. Amounts are sent as strings, never as floats.
function toTrendlyOrder(body, request, env) {
  const total = money(body.total_amount ?? body.total ?? body.amount);
  const order = {
    order_id: str(body.order_id ?? body.id),
    order_number: str(body.order_number),
    status: str(body.status || 'confirmed').toLowerCase(),
    discount_code: cleanCode(body.code ?? body.coupon ?? body.discount_code) || cookieCode(body.cookie || request.headers.get('Cookie')),
    currency: str(body.currency).toUpperCase() || undefined,
    subtotal_amount: money(body.subtotal_amount ?? body.subtotal) || total,
    discount_amount: money(body.discount_amount),
    tax_amount: money(body.tax_amount ?? body.vat),
    shipping_amount: money(body.shipping_amount),
    total_amount: total,
    refunded_amount: money(body.refunded_amount),
    commissionable_amount: money(body.commissionable_amount),
    is_new_customer: typeof body.is_new_customer === 'boolean' ? body.is_new_customer : undefined,
    customer_ref: str(body.customer_ref) || undefined,
    placed_at: str(body.placed_at) || undefined,
    status_changed_at: str(body.status_changed_at) || undefined,
    metadata: { ...(body.metadata || {}), relay: 'cloudflare-worker/1.0' },
  };
  if (env.TRENDLY_PROGRAM && !String(env.TRENDLY_PROGRAM).startsWith('(')) order.program_id = env.TRENDLY_PROGRAM;
  Object.keys(order).forEach((key) => (order[key] === undefined || order[key] === '') && delete order[key]);
  return order;
}

// Three tries with a growing wait, for 429s, 5xx and network errors. The same order sent twice
// lands on one row at Trendly (orders are matched on order_id), so a retry is always safe.
async function sendToTrendly(env, path, payload) {
  const base = String(env.TRENDLY_API_BASE || 'https://api.trendly.com.sa').replace(/\/+$/, '');
  let last = { status: 502, body: { error: 'trendly_unreachable' } };
  for (let attempt = 0; attempt < 3; attempt += 1) {
    if (attempt > 0) await sleep(400 * 2 ** attempt);
    try {
      const response = await fetch(base + path, {
        method: payload ? 'POST' : 'GET',
        headers: {
          Authorization: 'Bearer ' + env.TRENDLY_API_KEY,
          'Content-Type': 'application/json',
          'User-Agent': 'trendly-cloudflare-worker/1.0',
        },
        body: payload ? JSON.stringify(payload) : undefined,
      });
      const text = await response.text();
      let parsed;
      try {
        parsed = text ? JSON.parse(text) : {};
      } catch (e) {
        parsed = { error: 'unexpected_response', body: text.slice(0, 300) };
      }
      last = { status: response.status, body: parsed };
      if (response.status !== 429 && response.status < 500) return last;
    } catch (e) {
      last = { status: 502, body: { error: 'trendly_unreachable', message: String(e && e.message) } };
    }
  }
  return last;
}

function cookieCode(cookieHeader) {
  const match = String(cookieHeader || '').match(new RegExp('(?:^|;\\s*)' + COOKIE + '=([^;]+)'));
  return match ? cleanCode(decodeURIComponent(match[1])) : '';
}

function cleanCode(value) {
  const code = String(value || '').trim();
  return /^[A-Za-z0-9_-]{2,64}$/.test(code) ? code : '';
}

function money(value) {
  if (value === undefined || value === null || value === '') return undefined;
  const n = Number(value);
  return Number.isFinite(n) ? n.toFixed(2) : undefined;
}

function str(value) {
  return value === undefined || value === null ? '' : String(value).trim();
}

function sameSecret(given, expected) {
  if (!given || !expected || given.length !== expected.length) return false;
  let diff = 0;
  for (let i = 0; i < given.length; i += 1) diff |= given.charCodeAt(i) ^ expected.charCodeAt(i);
  return diff === 0;
}

function json(body, status = 200) {
  return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
}

function sleep(ms) {
  return new Promise((resolve) => setTimeout(resolve, ms));
}

name = "trendly-relay"
main = "worker.js"
compatibility_date = "2025-01-01"

# The Worker runs on your site so it can remember which creator's link a visitor used.
# zone_name is the domain as it appears in your Cloudflare dashboard.
routes = [{ pattern = "example.com/*", zone_name = "example.com" }]

[vars]
TRENDLY_API_BASE = "https://api.trendly.com.sa"
# TRENDLY_PROGRAM = "your program id, when your key is not pinned to one program"
COOKIE_DAYS = "30"

# Secrets, set once with:
#   npx wrangler secret put TRENDLY_API_KEY
#   npx wrangler secret put RELAY_SECRET

curl -X POST https://example.com/trendly/conversion \
  -H "X-Relay-Secret: $RELAY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "SUB-20931",
    "status": "refunded",
    "total_amount": "149.00",
    "refunded_amount": "149.00",
    "currency": "SAR",
    "code": "NOURA10",
    "placed_at": "2026-11-10T14:05:00+03:00",
    "status_changed_at": "2026-11-18T09:30:00+03:00"
  }'

curl https://example.com/trendly/health \
  -H "X-Relay-Secret: $RELAY_SECRET"