Webhooks

npm install svix

import { Webhook } from 'svix';

function verifyWebhook(body, headers, secret) {
  const wh = new Webhook(secret);
  
  try {
    // Verify the webhook - throws on error
    const payload = wh.verify(body, headers);
    return { verified: true, payload };
  } catch (err) {
    return { verified: false, error: err.message };
  }
}

// Important: Use the raw request body
// Many frameworks parse JSON automatically - you need the raw string
app.use('/webhooks', express.raw({ type: 'application/json' }));

// Disable CSRF for webhook route
app.use('/webhooks', (req, res, next) => {
  req.csrfToken = () => ''; // Disable CSRF
  next();
});

import express from 'express';
import { Webhook } from 'svix';
import Redis from 'ioredis';

const app = express();
const redis = new Redis(process.env.REDIS_URL);
const webhookSecret = process.env.PAYGENTIC_WEBHOOK_SECRET;

// Webhook handler with all best practices
app.post('/webhooks/paygentic',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const svixId = req.headers['svix-id'];
    const svixTimestamp = req.headers['svix-timestamp'];
    const svixSignature = req.headers['svix-signature'];

    // Check required headers
    if (!svixId || !svixTimestamp || !svixSignature) {
      return res.status(400).send('Missing required headers');
    }

    try {
      // Verify webhook signature
      const wh = new Webhook(webhookSecret);
      const payload = wh.verify(req.body, {
        'svix-id': svixId,
        'svix-timestamp': svixTimestamp,
        'svix-signature': svixSignature
      });

      // Check for duplicate processing (idempotency)
      const processed = await redis.get(`webhook:${svixId}`);
      if (processed) {
        console.log(`Webhook ${svixId} already processed`);
        return res.status(200).send('Already processed');
      }

      // Mark as processed (with 24 hour expiry)
      await redis.setex(`webhook:${svixId}`, 86400, 'processed');

      // Respond immediately
      res.status(200).send('OK');

      // Process asynchronously
      setImmediate(async () => {
        try {
          await processWebhookEvent(payload);
        } catch (error) {
          console.error('Error processing webhook:', error);
          // Send to error tracking service
          // Consider implementing a retry queue
        }
      });

    } catch (err) {
      console.error('Webhook verification failed:', err);
      return res.status(400).send('Invalid webhook');
    }
  }
);

async function processWebhookEvent(payload) {
  const { eventType, data } = payload;
  
  console.log(`Processing event: ${eventType}`);
  
  switch (eventType) {
    case 'customer.created.v0':
      await handleCustomerCreated(data);
      break;
      
    case 'customer.creation_failed.v0':
      await handleCustomerCreationFailed(data);
      break;
      
    case 'subscription.created.v0':
      await handleSubscriptionCreated(data);
      break;
      
    case 'subscription.cancelled.v0':
      await handleSubscriptionCancelled(data);
      break;
      
    case 'subscription.updated.v0':
      await handleSubscriptionUpdated(data);
      break;
      
    case 'source_event.pending.v0':
      await handleSourceEventPending(data);
      break;
      
    default:
      console.log(`Unhandled event type: ${eventType}`);
  }
}

// Event handlers
async function handleCustomerCreated(data) {
  console.log('New customer created:', data.customerId);
  // Your business logic here
}

async function handleSubscriptionCreated(data) {
  console.log('New subscription created:', data.subscriptionId);
  // Your business logic here
}

async function handleSourceEventPending(data) {
  console.log('Source event requires manual processing:', data.sourceEventId);
  // Your business logic here
}

// ... implement other handlers