Receive webhooks with the SDK

import { createFanvueCrypto, webhookSignatureContractFromEnv } from "@fanvue/builder-sdk";
import { createWebhookReceiverHandler } from "@fanvue/builder-sdk/nextjs/embedded-app";
import { db } from "@/lib/db";
import { enqueue } from "@/lib/queue";

export const dynamic = "force-dynamic";

const secrets = createFanvueCrypto({
  currentKey: process.env.TOKEN_ENC_KEY ?? "",
  previousKeys: process.env.TOKEN_ENC_PREVIOUS_KEYS ?? null,
}).withPurpose("fanvue-webhook-secrets");

export const { POST } = createWebhookReceiverHandler({
  findSubscriptionByRef: (ref) => db.webhookSubscriptions.findByRef(ref),
  decryptSigningSecret: async (ciphertext) => {
    const secret = await secrets.decrypt(ciphertext);
    if (secret.isErr()) throw new Error(secret.error.code);
    return secret.value;
  },
  insertEvent: (input) => db.webhookEvents.insertIdempotent(input),
  onEvent: ({ event, duplicate }) => {
    if (!duplicate) enqueue(event);
  },
  signatureContract: webhookSignatureContractFromEnv(),
});

import express from "express";
import {
  fanvueSignatureContract,
  isWebhookVerificationBody,
  resolveWebhookTopic,
  sanitizeWebhookDelivery,
  verifyWebhookHmac,
} from "@fanvue/builder-sdk";

const app = express();
const contract = fanvueSignatureContract();

app.post("/webhooks/fanvue/:ref", express.raw({ type: "*/*" }), async (req, res) => {
  const rawBody = new Uint8Array(req.body as Buffer);
  const headers = Object.fromEntries(
    Object.entries(req.headers).map(([key, value]) => [key, Array.isArray(value) ? value[0] : value]),
  );

  let raw: unknown;
  try {
    raw = JSON.parse(new TextDecoder().decode(rawBody));
  } catch {
    raw = null;
  }
  if (headers[contract.headerName.toLowerCase()] === undefined && isWebhookVerificationBody(raw)) {
    return res.status(200).json({ accepted: false, verification: true });
  }

  const subscription = await loadSubscription(req.params.ref);
  if (!subscription) return res.status(404).end();

  const verified = await verifyWebhookHmac({
    rawBody,
    headers,
    secret: subscription.signingSecret,
    contract,
    nowMs: null,
  });
  if (!verified) return res.status(401).end();

  const topic = resolveWebhookTopic(raw);
  if (topic === null) return res.status(200).json({ accepted: false, discarded: true, reason: "unsupported_topic" });

  let event;
  try {
    event = sanitizeWebhookDelivery(topic, raw);
  } catch {
    return res.status(200).json({ accepted: false, discarded: true, reason: "schema_mismatch" });
  }
  if (event.creatorUuid !== subscription.creatorUuid) {
    return res.status(200).json({ accepted: false, discarded: true, reason: "creator_mismatch" });
  }

  const { duplicate } = await storeEvent(subscription.id, event);
  return res.status(200).json({ accepted: true, duplicate });
});

import { describe, expect, it } from "vitest";
import {
  FIXTURE_PII_CANARY,
  fanvueSignatureContract,
  signWebhookFixture,
  tipDelivery,
} from "@fanvue/builder-sdk";
import { createWebhookReceiverHandler } from "@fanvue/builder-sdk/nextjs/embedded-app";

const signingSecret = "test-signing-secret";
const stored: unknown[] = [];

const { POST } = createWebhookReceiverHandler({
  findSubscriptionByRef: async () => ({
    id: "sub_1",
    creatorUuid: "creator-00000000-0000-4000-8000-000000000001",
    topics: ["tip.new"],
    signingSecretCiphertext: "plain",
    status: "ACTIVE",
    creatorStatus: "ACTIVE",
  }),
  decryptSigningSecret: () => signingSecret,
  insertEvent: async (input) => {
    stored.push(input.event);
    return { duplicate: false };
  },
  signatureContract: fanvueSignatureContract(),
});

describe("receiver", () => {
  it("stores a signed tip without personal data", async () => {
    const body = JSON.stringify(tipDelivery());
    const signature = await signWebhookFixture({ payload: body, signingSecret });
    const request = new Request("https://app.example/api/webhooks/fanvue/ref-1", {
      method: "POST",
      headers: { "content-type": "application/json", [signature.name]: signature.value },
      body,
    });

    const response = await POST(request, { params: Promise.resolve({ subscriptionRef: "ref-1" }) });

    expect(response.status).toBe(200);
    expect(await response.json()).toEqual({ accepted: true, duplicate: false });
    expect(JSON.stringify(stored).includes(FIXTURE_PII_CANARY)).toBe(false);
  });
});