// Next.js App Router (src/app/api/webhook/route.ts)
import { NextRequest, NextResponse } from 'next/server';
import crypto from 'crypto';

export async function POST(req: NextRequest) {
  // CRITICAL: Must read raw text to avoid JSON mutation
  const rawBody = await req.text();
  const signature = req.headers.get('stripe-signature') || '';
  const secret = process.env.WEBHOOK_SECRET!;

  // Parse Stripe header: t=...,v1=...
  const parts = Object.fromEntries(signature.split(',').map(p => p.split('=')));
  const expectedSig = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  const isValid = crypto.timingSafeEqual(Buffer.from(parts.v1 || ''), Buffer.from(expectedSig));

  if (!isValid) {
    return NextResponse.json({ error: 'Invalid HMAC signature' }, { status: 401 });
  }

  // Safe to process verified event
  const payload = JSON.parse(rawBody);
  return NextResponse.json({ received: true });
}