Webhooks

// app/api/webhooks/route.ts
import { NextResponse } from "next/server";
import crypto from "crypto";

export const runtime = "nodejs";

export async function POST(request: Request) {
  const raw = await request.text();
  const signature = request.headers.get("x-credibill-signature") || "";
  const timestamp = request.headers.get("x-credibill-timestamp") || "";
  const webhookSecret = process.env.CREDIBILL_WEBHOOK_SECRET || "";

  // Construct payload and expected signature
  const payload = `${timestamp}.${raw}`;
  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(payload)
    .digest("hex");

  let isValid = false;
  try {
    isValid = crypto.timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(signature)
    );
  } catch (err) {
    isValid = false;
  }

  // Validate signature and timestamp (prevent replay attacks)
  const now = Math.floor(Date.now() / 1000);
  const ts = parseInt(timestamp || "0", 10);
  if (!isValid || Math.abs(now - ts) > 5 * 60) {
    return NextResponse.json(
      { error: "Invalid or stale webhook signature" },
      { status: 401 }
    );
  }

  // Parse event and handle idempotently
  const event = JSON.parse(raw);

  // Idempotency example (pseudo-code): ensure event.id is processed once
  // Example with Prisma:
  // const existing = await prisma.webhookEvent.findUnique({ where: { id: event.id } });
  // if (existing) return NextResponse.json({ received: true });
  // await prisma.webhookEvent.create({ data: { id: event.id, type: event.type, payload: raw } });

  switch (event.type) {
    case "invoice.paid": {
      const invoice = event.data.object;
      // handle the invoice in an idempotent way
      // await fulfillOrder(invoice);
      break;
    }
    default:
      console.log(`Unhandled event type ${event.type}`);
  }

  return NextResponse.json({ received: true });
}