Inna
389dac68c4
- app/api/stripe/webhook: verifica firma (constructEventAsync) y en checkout.session.completed registra la IP de Stripe (como Django) y ENTREGA el servicio. Idempotente frente a la página de éxito. - lib/stripe.ts: claimPaidCheckout ahora es ATÓMICO (UPDATE ... WHERE fulfilled=0 + affectedRows) para evitar doble entrega entre webhook y página de éxito; nuevo recordStripeIp. - lib/fulfill.ts: fulfillCheckoutSession compartido (reclama + resuelve servicio desde metadata.service + ejecuta). checkout guarda `service` en metadata. - service-success: usa la entrega compartida y distingue entregado/ya-procesado/error. - i18n: Paid.alreadyProcessed. Requiere configurar STRIPE_WEBHOOK_SECRET en .env.local (endpoint apuntando a /api/stripe/webhook, evento checkout.session.completed). Verificado: build OK, webhook 400 sin firma / firma inválida. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
2.3 KiB
TypeScript
58 lines
2.3 KiB
TypeScript
import { getSession } from '@/lib/session'
|
|
import { getGameCharacters } from '@/lib/characters'
|
|
import { createCheckoutSession } from '@/lib/stripe'
|
|
import { getPaidService } from '@/lib/paid-services'
|
|
|
|
export async function POST(request: Request, { params }: { params: Promise<{ service: string }> }) {
|
|
const { service } = await params
|
|
const cfg = getPaidService(service)
|
|
if (!cfg) return Response.json({ success: false, error: 'invalidService' }, { status: 404 })
|
|
|
|
const session = await getSession()
|
|
if (!session.accountId) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
|
|
|
|
let body: Record<string, string> = {}
|
|
try {
|
|
body = await request.json()
|
|
} catch {
|
|
return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
|
|
}
|
|
const character = String(body.character ?? '')
|
|
if (!character) return Response.json({ success: false, error: 'invalidCharacter' })
|
|
|
|
const chars = await getGameCharacters(session.accountId)
|
|
if (!chars.find((c) => c.name === character)) {
|
|
return Response.json({ success: false, error: 'invalidCharacter' })
|
|
}
|
|
|
|
// Campos extra del servicio (gold_amount, destination_account...) -> metadata.
|
|
// `service` va en metadata para que el webhook sepa qué entregar sin la URL.
|
|
const metadata: Record<string, string> = { service }
|
|
for (const f of cfg.extraFields) {
|
|
const v = String(body[f] ?? '').trim()
|
|
if (!v) return Response.json({ success: false, error: 'missingFields' })
|
|
metadata[f] = v
|
|
}
|
|
|
|
const price = await cfg.price(metadata)
|
|
if (!price || price <= 0) return Response.json({ success: false, error: 'invalidRequest' })
|
|
|
|
const site = process.env.SITE_URL || ''
|
|
const ip = (request.headers.get('x-forwarded-for') || '').split(',')[0].trim() || '0.0.0.0'
|
|
|
|
const r = await createCheckoutSession({
|
|
accountId: session.accountId,
|
|
username: session.username || '',
|
|
email: session.bnetEmail || '',
|
|
acoreIp: ip,
|
|
amount: price,
|
|
characterName: character,
|
|
productName: cfg.productName(character, metadata),
|
|
successUrl: `${site}/service-success?service=${service}`,
|
|
cancelUrl: `${site}/${service}`,
|
|
metadata,
|
|
})
|
|
if (!r.success || !r.url) return Response.json({ success: false, error: 'stripeError' })
|
|
return Response.json({ success: true, url: r.url })
|
|
}
|