Authentication

import crypto from 'node:crypto';

const API_KEY = process.env.STABLEMINT_API_KEY;
const API_SECRET = process.env.STABLEMINT_API_SECRET;
const PRIVATE_KEY = process.env.STABLEMINT_PRIVATE_KEY; // PEM, matches the uploaded public key
const BASE_URL = 'https://api.stablemint.net';

// encodeURIComponent leaves !'()* unescaped; RFC 3986 requires them escaped.
function encodeRfc3986(value) {
  return encodeURIComponent(value).replace(
    /[!'()*]/g,
    (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase(),
  );
}

// Plain < / > on strings compares by code unit, which is the byte order the
// server expects. Do not use localeCompare — it is case-insensitive by default
// and will sort 'a' before 'Z'.
function canonicalQuery(searchParams) {
  const pairs = [...searchParams.entries()].sort(
    (a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0),
  );
  return pairs.map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`).join('&');
}

export async function call(method, path, body) {
  const url = new URL(path, BASE_URL);
  const rawBody = body === undefined ? '' : JSON.stringify(body);

  const timestamp = Math.floor(Date.now() / 1000).toString();
  const nonce = crypto.randomUUID();
  const bodyHash = crypto.createHash('sha256').update(rawBody, 'utf8').digest('hex');

  const canonical = [
    method.toUpperCase(),
    url.pathname,
    canonicalQuery(url.searchParams),
    timestamp,
    nonce,
    API_SECRET,
    bodyHash,
  ].join('\n');

  const signature = crypto
    .sign('sha256', Buffer.from(canonical, 'utf8'), {
      key: PRIVATE_KEY,
      padding: crypto.constants.RSA_PKCS1_PADDING,
    })
    .toString('base64');

  const response = await fetch(url, {
    method,
    headers: {
      'Content-Type': 'application/json',
      ApiKey: API_KEY,
      Timestamp: timestamp,
      Nonce: nonce,
      Signature: signature,
      // Do not set Authorization.
    },
    // Send exactly the bytes you hashed — do not re-serialise.
    body: rawBody === '' ? undefined : rawBody,
  });

  if (!response.ok) {
    throw new Error(`${response.status} ${await response.text()}`);
  }
  return response.json();
}

import base64, hashlib, json, os, time, uuid
from urllib.parse import quote, urlsplit, parse_qsl

import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

API_KEY = os.environ["STABLEMINT_API_KEY"]
API_SECRET = os.environ["STABLEMINT_API_SECRET"]
BASE_URL = "https://api.stablemint.net"

private_key = serialization.load_pem_private_key(
    os.environ["STABLEMINT_PRIVATE_KEY"].encode(), password=None
)

def canonical_query(query: str) -> str:
    pairs = sorted(parse_qsl(query, keep_blank_values=True))
    return "&".join(f"{quote(k, safe='')}={quote(v, safe='')}" for k, v in pairs)

def call(method: str, path: str, body=None):
    parts = urlsplit(path)
    raw_body = "" if body is None else json.dumps(body, separators=(",", ":"))

    timestamp = str(int(time.time()))
    nonce = str(uuid.uuid4())
    body_hash = hashlib.sha256(raw_body.encode()).hexdigest()

    canonical = "\n".join(
        [
            method.upper(),
            parts.path,
            canonical_query(parts.query),
            timestamp,
            nonce,
            API_SECRET,
            body_hash,
        ]
    )

    signature = base64.b64encode(
        private_key.sign(canonical.encode(), padding.PKCS1v15(), hashes.SHA256())
    ).decode()

    response = requests.request(
        method,
        BASE_URL + path,
        headers={
            "Content-Type": "application/json",
            "ApiKey": API_KEY,
            "Timestamp": timestamp,
            "Nonce": nonce,
            "Signature": signature,
        },
        data=raw_body or None,
    )
    response.raise_for_status()
    return response.json()