Paddle Webhooks — Guía de Implementación

// Generated with: paddle-webhooks skill | CULTIVA IA
// Cliente: NutriPaw Pro — webhook handler v1.0.0

const crypto = require('crypto');
const { db } = require('../db');
const { sendEmail } = require('../email');

/** Verifica firma Paddle HMAC-SHA256 (soporta rotación de secretos) */
function verifyPaddleSignature(rawBody, header, secret) {
  const parts  = header.split(';');
  const ts     = parts.find(p => p.startsWith('ts='))?.slice(3);
  const sigs   = parts.filter(p => p.startsWith('h1=')).map(p => p.slice(3));
  if (!ts || !sigs.length) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}:${rawBody}`)
    .digest('hex');

  return sigs.some(sig => {
    try {
      return crypto.timingSafeEqual(
        Buffer.from(sig), Buffer.from(expected)
      );
    } catch { return false; }
  });
}

/** Enrutador de eventos (async, después del 200 OK) */
async function dispatchEvent(event) {
  switch (event.event_type) {

    case 'subscription.created': {
      const { id, customer_id, items } = event.data;
      await db.query(
        'INSERT INTO subscriptions (paddle_id,customer_id,plan,status) VALUES ($1,$2,$3,$4)',
        [id, customer_id, items[0].price.id, 'created']
      );
      await sendEmail({ to: event.data.customer.email, template: 'welcome' });
      break;
    }

    case 'subscription.activated': {
      await db.query(
        'UPDATE subscriptions SET status=$1 WHERE paddle_id=$2',
        ['active', event.data.id]
      );
      break;
    }

    case 'subscription.canceled': {
      await db.query(
        'UPDATE subscriptions SET status=$1,canceled_at=NOW() WHERE paddle_id=$2',
        ['canceled', event.data.id]
      );
      await sendEmail({ to: event.data.customer.email, template: 'retention' });
      break;
    }

    case 'transaction.completed': {
      await issueInvoice(event.data);
      break;
    }

    case 'transaction.payment_failed': {
      await sendEmail({ to: event.data.customer.email, template: 'payment_failed',
        data: { update_url: event.data.checkout.url }
      });
      break;
    }

    case 'customer.created': {
      await syncToCRM(event.data);
      break;
    }

    default:
      console.log(`[paddle] unhandled: ${event.event_type}`);
  }
}

/** Endpoint principal */
router.post('/webhooks/paddle',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const sig    = req.headers['paddle-signature'];
    const body   = req.body.toString();
    const secret = process.env.PADDLE_WEBHOOK_SECRET;

    // 1. Verificar firma
    if (!verifyPaddleSignature(body, sig, secret))
      return res.status(400).json({ error: 'invalid_signature' });

    const event = JSON.parse(body);

    // 2. Idempotencia: evitar reprocesamiento
    const { rowCount } = await db.query(
      'INSERT INTO processed_events(id) VALUES($1) ON CONFLICT DO NOTHING',
      [event.event_id]
    );
    if (rowCount === 0)
      return res.json({ received: true, duplicate: true });

    // 3. Responder 200 inmediato (antes de procesar)
    res.json({ received: true });

    // 4. Dispatch async (no bloquea la respuesta)
    dispatchEvent(event).catch(err =>
      console.error(`[paddle] dispatch error:`, err)
    );
  }
);