Günther Craft: Preview & Table of Contents

import { FastifyInstance } from 'fastify';
import Stripe from 'stripe';
import { config } from '../../config/index.js';
import { FulfillmentService } from '../../services/fulfillmentService.js';

export async function webhookRoutes(app: FastifyInstance) {
  // CRITICAL: Stripe requires raw unparsed buffer to compute HMAC-SHA256
  app.post('/webhooks/stripe', {
    config: { rawBody: true }
  }, async (request, reply) => {
    const signature = request.headers['stripe-signature'] as string;
    const rawBody = (request as any).rawBody;

    if (!signature || !rawBody) {
      return reply.code(400).send({ error: 'Missing signature or payload buffer' });
    }

    let event: Stripe.Event;
    try {
      event = stripe.webhooks.constructEvent(
        rawBody,
        signature,
        config.stripe.webhookSecret
      );
    } catch (err: any) {
      request.log.error(`Stripe signature verification failed: ${err.message}`);
      return reply.code(400).send({ error: 'Signature verification failed' });
    }

    // Acknowledge immediately to Stripe to prevent HTTP 504 timeouts
    reply.code(200).send({ received: true });

    if (event.type === 'checkout.session.completed') {
      const session = event.data.object as Stripe.Checkout.Session;
      await FulfillmentService.processStripeCheckout(session);
    }
  });
}