PAYBYTE GOLDEN SWORD WEBHOOK DEMO
=================================

Purpose
-------
This is a real PBE-PAY merchant fulfilment example. A customer pays 25 PBE,
PBE watches the exact payment tuple, and the merchant grants a fake Golden
Sword only after a signed payment.confirmed webhook reaches 12 confirmations.

This demo is deliberately webhook-driven. The browser reads only the merchant
MySQL tables. It does not decide whether the customer paid.

Requirements
------------
- PBE Core 0.0.1 or a compatible PBE-PAY v1 node
- MySQL deployment of PBE
- PHP cURL enabled
- HTTPS for the public webhook callback
- Commerce webhooks enabled in config/config.php
- commerce.webhooks.manageToken configured (32+ characters)
- commerce.webhooks.signingSecret configured (different 32+ character secret)

1. Install the folder
---------------------
Place this complete folder under the PBE /web directory, for example:

D:\xampp\htdocs\paybyte.org\web\Paybyte-Golden-Sword-Webhook-Test\

The demo intentionally reads database credentials and webhook secrets from the
existing PBE config/config.php. Do NOT copy credentials into this folder.

2. Import database.sql MANUALLY
-------------------------------
The demo does not create tables automatically.

Import database.sql into the same MySQL database configured for your PBE node.
You can use phpMyAdmin (Import) or the MySQL CLI, for example:

mysql -u YOUR_USER -p YOUR_PBE_DATABASE < database.sql

It creates only these disposable demo tables:
- demo_game_orders
- demo_game_inventory
- demo_game_webhook_events

If the tables are missing, the demo will stop with an explicit message asking
you to import database.sql. It will never CREATE TABLE during a web request.

3. Configure the public demo values
-----------------------------------
Edit demo-config.php. The shipped recipient value is intentionally invalid so
you cannot accidentally pay a historical/test address. Replace it with your
own pbe1... mainnet wallet address.

At minimum review:
- recipient       Merchant PBE receiving address
- amountPbe       Demo price
- confirmations   Merchant confirmation threshold
- nodeUrl         PBE node that exposes the Commerce API
- callbackUrl     Public HTTPS URL of this folder's webhook.php

Secrets do not belong in demo-config.php.

4. Open the demo
----------------
Example:
https://your-domain.example/web/Paybyte-Golden-Sword-Webhook-Test/

Expected flow
-------------
1. Merchant backend creates a unique MySQL order.
2. Backend creates the PBE-PAY request.
3. Backend registers an authenticated Commerce webhook watch.
4. Paybyte wallet opens with recipient, amount and reference locked.
5. Customer signs locally and broadcasts.
6. PBE sends payment.pending / payment.confirming events.
7. At the configured depth PBE sends payment.confirmed.
8. webhook.php validates HMAC, chain, reference, recipient, amount and depth.
9. Merchant inserts Golden Sword into demo_game_inventory exactly once.
10. A payment.reorged event removes the demo item until reconfirmation.

Security notes
--------------
- Never expose commerce.webhooks.manageToken to JavaScript.
- Never expose commerce.webhooks.signingSecret to JavaScript.
- Verify the raw request body before decoding webhook JSON.
- Treat webhook delivery as at-least-once and fulfil idempotently.
- Keep the unique source_order_ref protection when adapting this example.
- PBE currently reports hardFinality=false; confirmation depth is a merchant
  risk policy, not absolute irreversible finality.

Cleanup
-------
When finished with the demo you may remove its tables:

DROP TABLE IF EXISTS demo_game_webhook_events;
DROP TABLE IF EXISTS demo_game_inventory;
DROP TABLE IF EXISTS demo_game_orders;

Documentation
-------------
Current Paybyte developer documentation and refreshed example downloads live at:
https://paybyte.org/web/developers/
