API Reference

import { createClient } from '@supabase/supabase-js';
import crypto from 'crypto';

export async function POST(req: Request) {
  const signature = req.headers.get('stripe-signature');
  const body = await req.text();

  // 1. Verify webhook signature
  const isValid = crypto
    .createHmac('sha256', process.env.STRIPE_WEBHOOK_SECRET!)
    .update(body)
    .digest('hex') === signature;

  if (!isValid) {
    return new Response('Invalid signature', { status: 401 });
  }

  const event = JSON.parse(body);

  // 2. Check for duplicate using event ID (idempotency)
  const supabase = createClient(
    process.env.SUPABASE_URL!,
    process.env.SUPABASE_ANON_KEY!
  );

  const { data: existing } = await supabase
    .from('webhook_events')
    .select('id')
    .eq('external_event_id', event.id)
    .single();

  if (existing) {
    console.log('Duplicate webhook ignored:', event.id);
    return new Response('OK', { status: 200 }); // Return 200 to prevent retry
  }

  // 3. Store event to prevent future duplicates
  await supabase.from('webhook_events').insert({
    external_event_id: event.id,
    source: 'stripe',
    event_type: event.type,
    received_at: new Date().toISOString()
  });

  // 4. Process webhook asynchronously (queue recommended)
  await fetch(`${process.env.SUPABASE_URL}/functions/v1/brainos-webhook`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.SUPABASE_ANON_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      source: 'stripe',
      organizationId: 'org_123',
      event: event
    })
  });

  // 5. Always return 200 OK quickly (< 5 seconds)
  return new Response('OK', { status: 200 });
}