Session Tokens

Browser                Your edge function           track.bitcompare.net
   │                            │                            │
   │  Page loads (no token      │                            │
   │  in initial HTML)          │                            │
   ├───────────────────────────►│                            │
   │  HTML with <a href="/c/X"> │                            │
   │◄───────────────────────────┤                            │
   │                            │                            │
   │  useEffect fires:          │                            │
   │  POST /api/bc-session      │                            │
   ├───────────────────────────►│                            │
   │                            │  POST /tracking/session    │
   │                            │  (attaches partner +       │
   │                            │   X-Real-IP)               │
   │                            ├───────────────────────────►│
   │                            │  { sessionToken,           │
   │                            │    expiresAt }             │
   │                            │◄───────────────────────────┤
   │  { sessionToken,           │                            │
   │    expiresAt }             │                            │
   │◄───────────────────────────┤                            │
   │                            │                            │
   │  Rewrites all              │                            │
   │  <a href> to include       │                            │
   │  &session=<token>          │                            │
   │                            │                            │
   │  User clicks               │                            │
   │  GET /c/<provider>?...     │                            │
   ├───────────────────────────►│                            │
   │                            │  GET /tracking/clicks/     │
   │                            │  <provider>/<code>?...     │
   │                            ├───────────────────────────►│
   │                            │                            │  Verifies session
   │                            │                            │  (sig + IP + TTL)
   │                            │                            │  → attributes to
   │                            │                            │    your consumer
   │                            │                            │  → 302 to provider

{
  "data": {
    "sessionToken": "v1.42.1778638400.abc123def456.0011223344556677889900aabbccddeeff",
    "expiresAt": "2026-05-13T02:03:23.000Z"
  }
}

<a
  href="https://track.bitcompare.net/api/v1/tracking/clicks/<provider>/<short_code>?partner=<your_token>&region=<visitor_country>"
  target="_blank"
  rel="noopener noreferrer sponsored"
>
  Provider Name
</a>

<a
  href="/c/<provider>?category=lending"
  target="_blank"
  rel="noopener sponsored"
  data-bc-link
>
  Provider Name
</a>

import { useEffect, useRef, useState } from 'react'

interface SessionToken {
  token: string
  expiresAtMs: number
}

export function useBitCompareSession() {
  const [session, setSession] = useState<SessionToken | null>(null)
  // sessionRef holds the latest token without re-running the effect on
  // every change — needed because the focus handler is registered once
  // and would otherwise close over a stale `session` value.
  const sessionRef = useRef<SessionToken | null>(null)
  sessionRef.current = session

  useEffect(() => {
    let cancelled = false

    async function mint() {
      try {
        const res = await fetch('/api/bc-session', { method: 'POST' })
        if (!res.ok) return
        const body = await res.json()
        if (cancelled) return
        setSession({
          token: body.data.sessionToken,
          expiresAtMs: new Date(body.data.expiresAt).getTime(),
        })
      } catch {
        // Mint failure → links remain un-tokenized. Click will not be
        // attributed but will still redirect to the provider.
      }
    }

    mint()

    const onFocus = () => {
      const current = sessionRef.current
      if (!current || current.expiresAtMs - Date.now() < 60_000) {
        mint()
      }
    }
    window.addEventListener('focus', onFocus)
    return () => {
      cancelled = true
      window.removeEventListener('focus', onFocus)
    }
  }, [])

  // Whenever we have a token, rewrite the placements' hrefs to include it.
  useEffect(() => {
    if (!session) return
    document
      .querySelectorAll<HTMLAnchorElement>('a[data-bc-link]')
      .forEach((a) => {
        const url = new URL(
          a.getAttribute('href') ?? '',
          window.location.origin,
        )
        url.searchParams.set('session', session.token)
        a.setAttribute('href', url.pathname + url.search)
      })
  }, [session])

  return session
}

function Layout({ children }: { children: React.ReactNode }) {
  useBitCompareSession()
  return <>{children}</>
}

// netlify/edge-functions/bc-proxy.ts
import type { Context } from '@netlify/edge-functions'

const PARTNER_TOKEN = Deno.env.get('BITCOMPARE_PARTNER_TOKEN')!
const PROVIDER_SHORT_CODES: Record<string, string> = {
  // Map each provider ID to the persistent short code from your BitCompare
  // dashboard. These are public per-link identifiers; only the partner
  // token needs to stay secret. Replace these placeholders with your
  // actual short codes before deploying.
  'provider-one': 'placeholder1',
  'provider-two': 'placeholder2',
  // ...
}

export default async function (
  request: Request,
  context: Context,
): Promise<Response> {
  const url = new URL(request.url)
  const visitorIp = context.ip

  // POST /api/bc-session — mint a session token via bitcompare
  if (url.pathname === '/api/bc-session' && request.method === 'POST') {
    const mintUrl = new URL(
      'https://track.bitcompare.net/api/v1/tracking/session',
    )
    mintUrl.searchParams.set('partner', PARTNER_TOKEN)

    const upstream = await fetch(mintUrl, {
      method: 'POST',
      headers: { 'X-Real-IP': visitorIp },
    })
    return new Response(await upstream.text(), {
      status: upstream.status,
      headers: { 'Content-Type': 'application/json' },
    })
  }

  // GET /c/<provider>?category=...&session=...
  // Redirect to track.bitcompare.net with the session token + region.
  const match = url.pathname.match(/^\/c\/([a-z0-9-]+)$/)
  if (match && request.method === 'GET') {
    const providerId = match[1]
    const shortCode = PROVIDER_SHORT_CODES[providerId]
    if (!shortCode) return new Response('Not found', { status: 404 })

    const trackUrl = new URL(
      `https://track.bitcompare.net/api/v1/tracking/clicks/${providerId}/${shortCode}`,
    )
    // Pass through caller-supplied params (category, coin, session, etc.)
    for (const [k, v] of url.searchParams) trackUrl.searchParams.set(k, v)
    // Attach the geo region from the edge (visitor's country)
    trackUrl.searchParams.set('region', context.geo?.country?.code ?? 'XX')

    return Response.redirect(trackUrl.toString(), 302)
  }

  return context.next()
}

export const config = { path: ['/api/bc-session', '/c/*'] }

{
  "providerId": "<provider-id>",
  "apiConsumerId": 42,
  "authMethod": "session"
}