// app/api/webhook/route.ts
import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";

const WEBHOOK_SECRET = process.env.GENUKA_WEBHOOK_SECRET!;

function verifySignature(rawBody: string, signature: string): boolean {
  const computed = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(rawBody, "utf8")
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(computed),
    Buffer.from(signature)
  );
}

export async function POST(req: NextRequest) {
  const signature = req.headers.get("x-genuka-signature");
  const rawBody = await req.text(); // must read as text for exact raw body

  if (!signature || !verifySignature(rawBody, signature)) {
    return NextResponse.json(
      { error: "Invalid signature" },
      { status: 401 }
    );
  }

  const event = JSON.parse(rawBody);

  switch (event.event) {
    case "order.created":
      console.log("✅ New order received:", event.data);
      break;
    case "order.completed":
      console.log("🎉 Order completed:", event.data);
      break;
    default:
      console.log("⚠️ Unhandled event:", event.event);
  }

  return NextResponse.json({ received: true }, { status: 200 });
}