Secure your paymaster

// POST /api/paymaster
// Your endpoint is what the Startale App calls. Your credential never leaves it.
export async function POST(request: Request) {
  const rpc = await request.json()

  if (rpc.method !== 'pm_getPaymasterStubData' && rpc.method !== 'pm_getPaymasterData') {
    return jsonRpcError(rpc.id, -32601, 'Method not supported')
  }

  const [userOp, entryPoint, chainId, context] = rpc.params

  // Stub requests carry a placeholder operation, not the user's, so let them through.
  // Apply your policy to the operation you are asked to sign.
  if (rpc.method === 'pm_getPaymasterData' && !isSponsorable(userOp)) {
    return jsonRpcError(rpc.id, -32602, 'Operation not eligible for sponsorship')
  }

  // Add the context your provider needs (for example a policy id) to the
  // context the Startale App sent, without dropping its fields.
  const params = [userOp, entryPoint, chainId, { ...context, policyId: process.env.PAYMASTER_POLICY_ID }]

  const upstream = await fetch(process.env.PAYMASTER_URL!, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ ...rpc, params }),
  })

  return new Response(await upstream.text(), {
    headers: { 'content-type': 'application/json' },
  })
}