37 lines
1.2 KiB
TypeScript
37 lines
1.2 KiB
TypeScript
|
import { paypalFetch } from "./client"
|
||
|
|
|
||
|
|
// Verify an inbound PayPal webhook using PayPal's verify-webhook-signature API.
|
||
|
|
// Requires PAYPAL_WEBHOOK_ID (from the webhook you create in the PayPal app).
|
||
|
|
// Returns false (reject) when the id is missing or verification doesn't succeed.
|
||
|
|
export async function verifyPaypalWebhook(headers: Headers, rawBody: string): Promise<boolean> {
|
||
|
|
const webhookId = process.env.PAYPAL_WEBHOOK_ID
|
||
|
|
if (!webhookId) return false
|
||
|
|
|
||
|
|
let event: unknown
|
||
|
|
try {
|
||
|
|
event = JSON.parse(rawBody)
|
||
|
|
} catch {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
try {
|
||
|
|
const res = await paypalFetch("/v1/notifications/verify-webhook-signature", {
|
||
|
|
method: "POST",
|
||
|
|
body: JSON.stringify({
|
||
|
|
auth_algo: headers.get("paypal-auth-algo"),
|
||
|
|
cert_url: headers.get("paypal-cert-url"),
|
||
|
|
transmission_id: headers.get("paypal-transmission-id"),
|
||
|
|
transmission_sig: headers.get("paypal-transmission-sig"),
|
||
|
|
transmission_time: headers.get("paypal-transmission-time"),
|
||
|
|
webhook_id: webhookId,
|
||
|
|
webhook_event: event,
|
||
|
|
}),
|
||
|
|
})
|
||
|
|
if (!res.ok) return false
|
||
|
|
const json = (await res.json()) as { verification_status?: string }
|
||
|
|
return json.verification_status === "SUCCESS"
|
||
|
|
} catch {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
}
|