Webhook HMAC Debugger & Zod Handler

{
  "provider": "shopify",
  "secret": "shpss_dummy_webhook_secret_key",
  "signature": "mK8mE0wY2/q61V7Q6O3pX0B+Z+M8k0W2U9x8n6G7y8M=",
  "timestamp": "1714500000",
  "payload": {
    "id": 820982911946154500,
    "email": "customer@example.com",
    "total_price": "149.99",
    "currency": "USD",
    "financial_status": "paid"
  }
}

// ============================================================================
// 🔍 WEBHOOK HMAC-SHA256 DIAGNOSTIC REPORT (100% Client-Side Verification)
// ============================================================================
// Provider Mode        : SHOPIFY
// Expected Shopify Hmac: 4hF7vA92c2mE45rL8tQ3k0jN5pX7vB1wZ9yM6cK4dQo=
// Expected GitHub Hmac : sha256=e2117bBc0f76736984e39acbe834934a6a7f97eff075c19f72cf9bc2b874a38d
// Expected Stripe Hmac : t=1714500000,v1=9f4a8b21c03d44e18a9b77c25d66e32f11a08b99c44d22e17a66b33c88d11e22
// ============================================================================

import { z } from "zod";

export const webhookPayloadSchema = z.object({
  id: z.number().int(),
  email: z.email(),
  total_price: z.string(),
  currency: z.string(),
  financial_status: z.string(),
});

export type WebhookPayload = z.infer<typeof webhookPayloadSchema>;

// Official Docs: https://shopify.dev/docs/apps/build/webhooks/subscribe/https#step-5-verify-the-webhook
import crypto from "node:crypto";
import { NextResponse } from "next/server";

export async function POST(req: Request) {
  // CRITICAL: Read raw text via req.text() — NEVER call req.json() before HMAC check!
  const rawBody = await req.text();
  const hmacHeader = req.headers.get("x-shopify-hmac-sha256") ?? "";
  const secret = process.env.SHOPIFY_WEBHOOK_SECRET ?? "";

  const computedBase64 = crypto
    .createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("base64");

  const a = Buffer.from(computedBase64, "utf8");
  const b = Buffer.from(hmacHeader, "utf8");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return NextResponse.json({ error: "Invalid Shopify HMAC signature" }, { status: 401 });
  }

  const parsed = webhookPayloadSchema.safeParse(JSON.parse(rawBody));
  if (!parsed.success) {
    return NextResponse.json({ error: "Invalid webhook payload", issues: parsed.error.issues }, { status: 400 });
  }

  return NextResponse.json({ received: true, data: parsed.data });
}