async function handleConnectAndSignIn() {
  if (!window.xrpl) {
    window.open('https://dropfi.app', '_blank');
    return;
  }
  const address = await connectXrpl?.();
  if (!address) throw new Error('User canceled request');

  const message = `Welcome to My App!\nSign this message to prove ownership:\n\nWallet: ${address}\nTimestamp: ${new Date().toISOString()}`;
  const { signature, publicKey } = await signMessage?.(message);
  if (!signature || !publicKey) throw new Error('User rejected message');

  await fetch('/api/auth/sign', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    credentials: 'include',
    body: JSON.stringify({ message, publicKey, signature }),
  });
  // Then refetch user state or redirect
}

import { verify, deriveAddress } from 'ripple-keypairs';
import jwt from 'jsonwebtoken';
import dayjs from 'dayjs';

// POST /api/auth/sign
const { message, publicKey, signature } = await request.json();

// 1. Parse and validate timestamp (replay protection)
const timestampLine = message.split('\n').find((line) => line.startsWith('Timestamp:'));
const timestampStr = timestampLine?.replace('Timestamp:', '').trim();
if (!timestampStr || !dayjs(timestampStr).isValid()) {
  throw new Error('Invalid timestamp');
}
const MAX_AGE_SECONDS = 60;
const age = dayjs().diff(dayjs(timestampStr), 'second');
if (age > MAX_AGE_SECONDS) {
  throw new Error('Signature expired');
}

// 2. Verify signature (message must be UTF-8, then hex for verify)
const messageHex = Buffer.from(message, 'utf8').toString('hex');
if (!verify(messageHex, signature, publicKey)) {
  throw new Error('Invalid signature');
}

// 3. Derive wallet address from public key
const wallet_address = deriveAddress(publicKey);

// 4. Create or find user in your DB, then issue session
const access_token = jwt.sign(
  { wallet_address },
  process.env.ACCESS_TOKEN_SECRET,
  { expiresIn: '240h' }
);

// 5. Set cookie or return token
const headers = new Headers();
headers.append(
  'Set-Cookie',
  `session=${access_token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${60 * 60 * 24 * 10}`
);
return new Response(JSON.stringify({ success: true }), { status: 200, headers });