Webhooks

{
  "id": "evt_01JQ8R3D4P7N7QGJ9M2K3W8X6B",
  "type": "payment.succeeded",
  "occurred_at": "2026-08-23T10:42:18.000Z",
  "merchant_id": "ap_mer_01JQ8ANDORPAY",
  "customer": {
    "id": "ap_cus_123",
    "external_customer_id": "customer_42",
    "email": "ana@example.com"
  },
  "product": {
    "id": "ap_prod_starter_monthly"
  },
  "payment": {
    "id": "ap_pay_123",
    "rail": "redsys",
    "status": "succeeded"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto"
import { NextResponse } from "next/server"

export const runtime = "nodejs"

function validSignature(rawBody: string, header: string, secret: string) {
  const values = new Map(header.split(",").map((part) => part.trim().split("=", 2)))
  const timestamp = values.get("t")
  const signature = values.get("v1")

  if (!timestamp || !signature || !/^[a-f0-9]{64}$/i.test(signature)) return false
  const timestampSeconds = Number(timestamp)
  if (!Number.isFinite(timestampSeconds)) return false
  if (Math.abs(Date.now() / 1000 - timestampSeconds) > 300) return false

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex")
  const receivedBuffer = Buffer.from(signature, "hex")
  const expectedBuffer = Buffer.from(expected, "hex")

  return receivedBuffer.length === expectedBuffer.length && timingSafeEqual(receivedBuffer, expectedBuffer)
}

export async function POST(request: Request) {
  const rawBody = await request.text()
  const signature = request.headers.get("Andorpay-Signature")
  const secret = process.env.ANDORPAY_WEBHOOK_SECRET

  if (!signature || !secret || !validSignature(rawBody, signature, secret)) {
    return NextResponse.json({ code: "invalid_signature" }, { status: 400 })
  }

  const event = JSON.parse(rawBody) as { id: string; type: string }
  await acceptVerifiedAndorpayEvent(event)
  return NextResponse.json({ received: true })
}