Tactforms server.js part of https://gist.github.com/elnygren/d0b22d085a3bef7dca139af94bc5a870

server.js

const Koa = require('koa')
const app = new Koa()
const _ = require('koa-route')
const bodyParser = require('koa-bodyparser')
const R = require('ramda')
const uuidv4 = require('uuid/v4')
const moment = require('moment')
const cors = require('koa-cors')

const {sendVerificationEmail} = require('./src/email.js')
const {createForwarder} = require('./src/db.js')

app.use(bodyParser())
app.use(cors())

// "signup" (The "start" button from the earlier screenshot)
app.use(_.post('/api/register', async ctx => {
  const {email} = ctx.request.body
  // UUIDv4 is a great tool. It's quite random and collisions practically never happen.
  // the forwarder's URL could be something shorter for a better UX though.
  const [secret, forwarder] = [uuidv4(), uuidv4()]
  if (!email) ctx.throw(400)
  
  // async/await is beautiful
  // these are essentially just wrappers for DB and HTTP API calls
  await createForwarder(email, forwarder, secret)
  await sendVerificationEmail(email, forwarder, secret)
  
  ctx.body = {
    forwarder_url: `/f/${forwarder}`,
    absolute_url: `https://tactforms.com/f/${forwarder}`
  }
}))

// "verification"
app.use(_.get('/secret/:forwarder/:secret', async (ctx, forwarder, secret) => {...}))
// submit form here
app.use(_.post('/f/:uuid', async (ctx, uuid) => {...}))
// submit payment here
app.use(_.post('/api/charge', async (ctx) => {...}))

// start & export for tests
if (!module.parent) app.listen(3000)
module.exports = app