The Smarter Way to Verify Cards

async function checkBinAndBlockIfPrepaid(bin, opts = {}) {
  // Validate input parameters
  if (!bin || typeof bin !== 'string') {
    return { blocked: true, error: 'Invalid bin argument' };
  }

  const apiKey = opts.apiKey;
  const userId = opts.userId;
  const timeoutMs = typeof opts.timeoutMs === 'number' ? opts.timeoutMs : 5000;
  const treatSubstring = opts.treatSubstring !== undefined ? opts.treatSubstring : true;

  // Security: Never embed API keys in client-side code
  if (!apiKey) {
    return { blocked: true, error: 'Missing apiKey, do not place real keys in client-side code' };
  }

  const controller = new AbortController();
  const id = setTimeout(() => controller.abort(), timeoutMs);

  const url = 'https://api.binsearchlookup.com/lookup?bin=' + encodeURIComponent(bin);

  try {
    const res = await fetch(url, {
      method: 'GET',
      headers: {
        'X-API-Key': apiKey,
        ...(userId ? { 'X-User-ID': userId } : {})
      },
      signal: controller.signal
    });

    clearTimeout(id);

    if (!res.ok) {
      return { blocked: true, error: 'Lookup failed, HTTP ' + res.status };
    }

    const body = await res.json();

    if (!body || !body.success || !body.data) {
      return { blocked: true, raw: body, error: 'Unexpected lookup response' };
    }

    const categoryRaw = body.data.Category;
    const category = typeof categoryRaw === 'string' ? categoryRaw.trim() : '';

    if (!category) {
      // Conservative blocking when category is missing
      return { blocked: true, category, raw: body, error: 'Missing category' };
    }

    const normalized = category.toUpperCase();
    const isPrepaid = treatSubstring ? normalized.includes('PREPAID') : normalized === 'PREPAID';

    return { blocked: !!isPrepaid, category, raw: body };
  } catch (err) {
    clearTimeout(id);
    const message = err && err.name === 'AbortError' ? 'Lookup timeout' : (err && err.message) || 'Network error';
    // Conservative blocking on network errors
    return { blocked: true, error: message };
  }
}

export { checkBinAndBlockIfPrepaid };