Update features and dependencies

apps/web/app/api/webhooks/stripe/route.ts

@@ -1,19 +1,93 @@
 import { NextRequest, NextResponse } from "next/server";
+import crypto from "node:crypto";
 
-// Stripe webhook stub — wire up when adding Stripe
-// Verifies stripe-signature header (using raw body), handles:
+// Stripe webhook handler — verifies stripe-signature header using HMAC-SHA256.
+// Handles:
 // - checkout.session.completed → upgrade user to pro
 // - customer.subscription.deleted → downgrade user to free
+
+const STRIPE_TOLERANCE_SECONDS = 300; // 5 minutes
+
+function verifyStripeSignature(
+  rawBody: string,
+  sigHeader: string,
+  secret: string
+): { valid: boolean; payload: string | null } {
+  // sigHeader format: "t=<timestamp>,v1=<hmac>[,v1=<hmac>...]"
+  const parts = sigHeader.split(",");
+  const tPart = parts.find((p) => p.startsWith("t="));
+  const v1Parts = parts.filter((p) => p.startsWith("v1="));
+
+  if (!tPart || v1Parts.length === 0) {
+    return { valid: false, payload: null };
+  }
+
+  const timestamp = tPart.slice(2);
+  const tsNum = parseInt(timestamp, 10);
+  if (isNaN(tsNum)) return { valid: false, payload: null };
+
+  // Reject stale webhooks
+  const nowSec = Math.floor(Date.now() / 1000);
+  if (Math.abs(nowSec - tsNum) > STRIPE_TOLERANCE_SECONDS) {
+    return { valid: false, payload: null };
+  }
+
+  const signedPayload = `${timestamp}.${rawBody}`;
+  const expected = crypto
+    .createHmac("sha256", secret)
+    .update(signedPayload, "utf8")
+    .digest();
+
+  const matched = v1Parts.some((v1Part) => {
+    const provided = v1Part.slice(3); // strip "v1="
+    let providedBuf: Buffer;
+    try {
+      providedBuf = Buffer.from(provided, "hex");
+    } catch {
+      return false;
+    }
+    if (providedBuf.length !== expected.length) return false;
+    return crypto.timingSafeEqual(expected, providedBuf);
+  });
+
+  return { valid: matched, payload: matched ? rawBody : null };
+}
+
 export async function POST(req: NextRequest) {
   const body = await req.text();
   const sig = req.headers.get("stripe-signature");
+  const webhookSecret = process.env["STRIPE_WEBHOOK_SECRET"];
 
-  if (!sig || !process.env["STRIPE_WEBHOOK_SECRET"]) {
+  if (!sig || !webhookSecret) {
     return NextResponse.json({ error: "Stripe not configured" }, { status: 400 });
   }
 
-  // TODO: const event = stripe.webhooks.constructEvent(body, sig, process.env["STRIPE_WEBHOOK_SECRET"]);
-  // For now just return 200 to acknowledge receipt
-  console.log("[stripe-webhook] received event, sig:", sig.slice(0, 20));
+  const { valid } = verifyStripeSignature(body, sig, webhookSecret);
+  if (!valid) {
+    return NextResponse.json({ error: "Invalid signature" }, { status: 400 });
+  }
+
+  let event: { type: string; data: { object: Record<string, unknown> } };
+  try {
+    event = JSON.parse(body) as typeof event;
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
+  // TODO: wire up DB calls when Stripe billing is fully configured
+  switch (event.type) {
+    case "checkout.session.completed":
+      // upgrade user to pro
+      console.log("[stripe-webhook] checkout.session.completed", event.data.object["id"]);
+      break;
+    case "customer.subscription.deleted":
+      // downgrade user to free
+      console.log("[stripe-webhook] customer.subscription.deleted", event.data.object["id"]);
+      break;
+    default:
+      // ignore unhandled event types
+      break;
+  }
+
   return NextResponse.json({ received: true });
 }