// GoCardless — create Instant Bank Pay billing request
if (url.pathname === '/gc/create-payment' && request.method === 'POST') {
  const cors = { 'Access-Control-Allow-Origin': '*', 'Content-Type': 'application/json' };
  try {
    const { amount_pence, currency, description, return_url } = await request.json();
    const base = 'https://api.gocardless.com'; // use api-sandbox.gocardless.com for testing
    const hdrs = {
      'Authorization': `Bearer ${env.GOCARDLESS_TOKEN}`,
      'GoCardless-Version': '2015-07-06',
      'Content-Type': 'application/json',
    };
    const br = await (await fetch(`${base}/billing_requests`, {
      method: 'POST', headers: hdrs,
      body: JSON.stringify({ billing_requests: {
        payment_request: { amount: amount_pence, currency: currency || 'GBP', description }
      }})
    })).json();
    if (br.error) return new Response(JSON.stringify({ error: br.error }), { status: 400, headers: cors });
    const flow = await (await fetch(`${base}/billing_request_flows`, {
      method: 'POST', headers: hdrs,
      body: JSON.stringify({ billing_request_flows: {
        redirect_uri: return_url,
        billing_request: { id: br.billing_requests.id }
      }})
    })).json();
    if (flow.error) return new Response(JSON.stringify({ error: flow.error }), { status: 400, headers: cors });
    return new Response(JSON.stringify({
      payment_url: flow.billing_request_flows.authorisation_url,
      billing_request_id: br.billing_requests.id
    }), { headers: cors });
  } catch (e) {
    return new Response(JSON.stringify({ error: e.message }), { status: 500,
      headers: { 'Access-Control-Allow-Origin': '*', 'Content-Type': 'application/json' } });
  }
}