Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-02 13:42:34 -04:00
parent 969d5d4c8a
commit c9968531e4
282 changed files with 41530 additions and 4013 deletions
@@ -0,0 +1,89 @@
+import { NextResponse } from "next/server"
+import { verifyPaypalWebhook } from "@/lib/paypal/webhook"
+import { decodeCustomId, getSubscription } from "@/lib/paypal/checkout"
+import { fulfillSubscription, fulfillLifetime, markPaypalSubscriptionInactive } from "@/lib/paypal/fulfill"
+
+// Inbound PayPal webhook. Signature is verified via PayPal's API using
+// PAYPAL_WEBHOOK_ID; unverified events are rejected.
+export async function POST(request: Request) {
+  const body = await request.text()
+
+  const valid = await verifyPaypalWebhook(request.headers, body)
+  if (!valid) return NextResponse.json({ error: "invalid signature" }, { status: 400 })
+
+  let event: { event_type?: string; resource?: Record<string, unknown> }
+  try {
+    event = JSON.parse(body)
+  } catch {
+    return NextResponse.json({ ok: true })
+  }
+
+  const type = event.event_type ?? ""
+  const resource = (event.resource ?? {}) as Record<string, any>
+
+  try {
+    switch (type) {
+      case "BILLING.SUBSCRIPTION.ACTIVATED":
+      case "BILLING.SUBSCRIPTION.UPDATED": {
+        const decoded = decodeCustomId(resource.custom_id)
+        if (decoded && resource.id) {
+          await fulfillSubscription(
+            decoded.userId,
+            decoded.plan,
+            resource.id,
+            resource.billing_info?.next_billing_time,
+            "active"
+          )
+        }
+        break
+      }
+
+      case "PAYMENT.SALE.COMPLETED": {
+        // A recurring payment cleared — refresh status + next billing date.
+        const subId = resource.billing_agreement_id as string | undefined
+        if (subId) {
+          const sub = await getSubscription(subId)
+          const decoded = decodeCustomId(sub?.custom_id)
+          if (sub && decoded) {
+            await fulfillSubscription(
+              decoded.userId,
+              decoded.plan,
+              subId,
+              sub.billing_info?.next_billing_time,
+              "active"
+            )
+          }
+        }
+        break
+      }
+
+      case "BILLING.SUBSCRIPTION.CANCELLED":
+      case "BILLING.SUBSCRIPTION.EXPIRED": {
+        if (resource.id) {
+          await markPaypalSubscriptionInactive(
+            resource.id,
+            type.endsWith("CANCELLED") ? "canceled" : "expired",
+            true
+          )
+        }
+        break
+      }
+
+      case "BILLING.SUBSCRIPTION.SUSPENDED": {
+        if (resource.id) await markPaypalSubscriptionInactive(resource.id, "suspended", false)
+        break
+      }
+
+      case "PAYMENT.CAPTURE.COMPLETED": {
+        // Lifetime order capture (backup to the return handler).
+        const decoded = decodeCustomId(resource.custom_id)
+        if (decoded && decoded.plan === "lifetime") await fulfillLifetime(decoded.userId)
+        break
+      }
+    }
+  } catch {
+    // Never loop forever on a handler bug — PayPal retries non-2xx.
+  }
+
+  return NextResponse.json({ received: true })
+}