import { NextRequest } from "next/server";
import { verifyPaypalWebhook } from "@/lib/billing/paypal";
import { handlePaypalEvent } from "@/lib/billing/webhooks/paypal";

export const dynamic = "force-dynamic";

const SIG_HEADERS = [
  "paypal-auth-algo",
  "paypal-cert-url",
  "paypal-transmission-id",
  "paypal-transmission-sig",
  "paypal-transmission-time",
];

export async function POST(req: NextRequest) {
  const body = await req.text();
  const headers: Record<string, string | undefined> = {};
  for (const h of SIG_HEADERS) headers[h] = req.headers.get(h) ?? undefined;

  const verified = await verifyPaypalWebhook(headers, body).catch(() => false);
  if (!verified) {
    console.error("[paypal webhook] verification failed");
    return new Response("Invalid signature", { status: 400 });
  }

  try {
    await handlePaypalEvent(JSON.parse(body));
  } catch (err) {
    console.error("[paypal webhook] handler error", err);
    return new Response("Handler error", { status: 500 });
  }
  return new Response("ok");
}