|
| 1 | +/** |
| 2 | + * POST /api/webhooks/transak |
| 3 | + * |
| 4 | + * Receives server-side order status updates from Transak. |
| 5 | + * Verifies the X-Transak-Signature HMAC-SHA256 header, then upserts |
| 6 | + * the order into transak_orders. |
| 7 | + * |
| 8 | + * Setup: |
| 9 | + * 1. In the Transak dashboard, set the webhook URL to: |
| 10 | + * https://<your-domain>/api/webhooks/transak |
| 11 | + * 2. Copy the webhook secret into TRANSAK_WEBHOOK_SECRET env var. |
| 12 | + * |
| 13 | + * Signature format (Transak): |
| 14 | + * X-Transak-Signature: <hex-encoded HMAC-SHA256(secret, rawBody)> |
| 15 | + */ |
| 16 | + |
| 17 | +import { createHmac, timingSafeEqual } from "crypto"; |
| 18 | +import { NextResponse } from "next/server"; |
| 19 | +import { sql } from "@vercel/postgres"; |
| 20 | +import type { TransakWebhookPayload } from "@/types/transak"; |
| 21 | + |
| 22 | +function verifyTransakSignature( |
| 23 | + signature: string, |
| 24 | + rawBody: string, |
| 25 | + secret: string |
| 26 | +): boolean { |
| 27 | + const expected = createHmac("sha256", secret) |
| 28 | + .update(rawBody) |
| 29 | + .digest("hex"); |
| 30 | + |
| 31 | + try { |
| 32 | + return timingSafeEqual(Buffer.from(expected), Buffer.from(signature)); |
| 33 | + } catch { |
| 34 | + return false; |
| 35 | + } |
| 36 | +} |
| 37 | + |
| 38 | +export async function POST(req: Request) { |
| 39 | + const rawBody = await req.text(); |
| 40 | + const signature = req.headers.get("x-transak-signature"); |
| 41 | + const webhookSecret = process.env.TRANSAK_WEBHOOK_SECRET; |
| 42 | + |
| 43 | + if (webhookSecret) { |
| 44 | + if (!signature) { |
| 45 | + console.error("❌ [transak webhook] Missing X-Transak-Signature header"); |
| 46 | + return NextResponse.json({ error: "Missing signature" }, { status: 401 }); |
| 47 | + } |
| 48 | + if (!verifyTransakSignature(signature, rawBody, webhookSecret)) { |
| 49 | + console.error("❌ [transak webhook] Invalid signature"); |
| 50 | + return NextResponse.json({ error: "Invalid signature" }, { status: 401 }); |
| 51 | + } |
| 52 | + } else { |
| 53 | + console.warn( |
| 54 | + "⚠️ TRANSAK_WEBHOOK_SECRET not set — skipping signature verification (set it in production)" |
| 55 | + ); |
| 56 | + } |
| 57 | + |
| 58 | + let payload: TransakWebhookPayload; |
| 59 | + try { |
| 60 | + payload = JSON.parse(rawBody); |
| 61 | + } catch { |
| 62 | + return NextResponse.json({ error: "Invalid JSON" }, { status: 400 }); |
| 63 | + } |
| 64 | + |
| 65 | + const order = payload?.webhookData; |
| 66 | + if (!order?.id || !order?.status) { |
| 67 | + console.error("❌ [transak webhook] Missing order data in payload", payload); |
| 68 | + return NextResponse.json({ error: "Invalid payload" }, { status: 400 }); |
| 69 | + } |
| 70 | + |
| 71 | + console.log(`🔔 Transak webhook: order ${order.id} → ${order.status}`); |
| 72 | + |
| 73 | + try { |
| 74 | + // Resolve the StreamFi user by wallet address so we can associate the order. |
| 75 | + // wallet_address is the Stellar public key the user provided to Transak. |
| 76 | + const userResult = await sql` |
| 77 | + SELECT id FROM users WHERE wallet = ${order.walletAddress} LIMIT 1 |
| 78 | + `; |
| 79 | + const userId: string | null = |
| 80 | + userResult.rows.length > 0 ? userResult.rows[0].id : null; |
| 81 | + |
| 82 | + await sql` |
| 83 | + INSERT INTO transak_orders ( |
| 84 | + id, user_id, status, crypto_amount, crypto_currency, |
| 85 | + fiat_amount, fiat_currency, wallet_address, tx_hash, |
| 86 | + created_at, updated_at |
| 87 | + ) |
| 88 | + VALUES ( |
| 89 | + ${order.id}, |
| 90 | + ${userId}, |
| 91 | + ${order.status}, |
| 92 | + ${order.cryptoAmount ?? null}, |
| 93 | + ${order.cryptoCurrency ?? null}, |
| 94 | + ${order.fiatAmount ?? null}, |
| 95 | + ${order.fiatCurrency ?? null}, |
| 96 | + ${order.walletAddress ?? null}, |
| 97 | + ${order.transactionHash ?? null}, |
| 98 | + now(), |
| 99 | + now() |
| 100 | + ) |
| 101 | + ON CONFLICT (id) DO UPDATE SET |
| 102 | + status = EXCLUDED.status, |
| 103 | + crypto_amount = COALESCE(EXCLUDED.crypto_amount, transak_orders.crypto_amount), |
| 104 | + tx_hash = COALESCE(EXCLUDED.tx_hash, transak_orders.tx_hash), |
| 105 | + updated_at = now() |
| 106 | + `; |
| 107 | + |
| 108 | + console.log(`✅ [transak webhook] Upserted order ${order.id}`); |
| 109 | + return NextResponse.json({ received: true }); |
| 110 | + } catch (err) { |
| 111 | + console.error("❌ [transak webhook] DB error:", err); |
| 112 | + return NextResponse.json( |
| 113 | + { error: "Failed to process webhook" }, |
| 114 | + { status: 500 } |
| 115 | + ); |
| 116 | + } |
| 117 | +} |
| 118 | + |
| 119 | +// Health check |
| 120 | +export async function GET() { |
| 121 | + return NextResponse.json({ |
| 122 | + status: "ok", |
| 123 | + message: "Transak webhook endpoint is active", |
| 124 | + }); |
| 125 | +} |
0 commit comments