Webhooks

// From: ~/workspace/source/src/packages/server/src/routes/webhooks.ts:79-102

import { Router } from 'express';
import crypto from 'crypto';
import { prisma } from '../../../database/client';

router.post('/paystack', async (req, res) => {
  const secret = process.env.PAYSTACK_SECRET_KEY;
  
  if (!secret) {
    return res.status(500).json({ error: 'Server configuration error' });
  }

  // 1. Verify webhook signature
  const signature = req.headers['x-paystack-signature'];
  
  if (!signature) {
    return res.status(401).json({ error: 'No signature' });
  }

  const hash = crypto
    .createHmac('sha512', secret)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (hash !== signature) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // 2. Process event
  const event = req.body;
  
  if (event.event === 'charge.success') {
    const order = await prisma.order.findFirst({
      where: { paystackReference: event.data.reference }
    });

    if (order) {
      await finalizeOrder(order.id, String(event.data.id));
    }
  }

  // 3. Acknowledge receipt
  res.json({ ok: true });
});

// From: ~/workspace/source/src/packages/server/src/routes/webhooks.ts:104-123

import { Router } from 'express';
import { validateFlutterwaveWebhook } from '../utils/flutterwave';

router.post('/flutterwave', async (req, res) => {
  // 1. Verify webhook signature
  const signature = req.headers['verif-hash'] as string;
  
  if (!signature || !validateFlutterwaveWebhook(signature, req.body)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // 2. Process event
  const { event, data } = req.body;

  if (event === 'charge.completed' && data.status === 'successful') {
    const order = await prisma.order.findFirst({
      where: { flutterwaveReference: data.tx_ref }
    });

    if (order) {
      await finalizeOrder(order.id, String(data.id));
    }
  }

  // 3. Acknowledge receipt
  res.json({ ok: true });
});

// From: ~/workspace/source/src/packages/server/src/routes/webhooks.ts:13-77

import { mintTicketsFor } from '../utils/blockchain';
import { prisma } from '../../../database/client';
import { logger } from '../utils/logger';

async function finalizeOrder(orderId: string, txId: string) {
  // 1. Find order
  const order = await prisma.order.findUnique({
    where: { id: orderId },
    include: { event: true }
  });

  if (!order || order.paymentStatus === 'COMPLETED') {
    return; // Already processed
  }

  // 2. Update payment status
  await prisma.order.update({
    where: { id: order.id },
    data: {
      paymentStatus: 'COMPLETED',
      paymentTxId: txId,
      updatedAt: new Date()
    }
  });

  // 3. Mint NFT tickets
  const user = await prisma.user.findUnique({
    where: { id: order.userId }
  });
  
  const walletAddress = user?.walletAddress;
  const event = order.event;

  if (walletAddress && event.contractAddress) {
    try {
      const abi = [
        'function mintFor(address to, uint256 quantity) external',
        'function tokenCounter() view returns (uint256)'
      ];
      
      const { txHash, tokenIds } = await mintTicketsFor(
        event.contractAddress,
        abi,
        walletAddress,
        order.quantity
      );

      // Save blockchain transaction
      await prisma.order.update({
        where: { id: order.id },
        data: { blockchainTxHash: txHash }
      });

      // Create ticket records
      for (const tokenId of tokenIds) {
        await prisma.ticket.create({
          data: {
            tokenId,
            contractAddress: event.contractAddress,
            chainId: event.chainId,
            txHash,
            eventId: order.eventId,
            orderId: order.id
          }
        });
      }
    } catch (err) {
      logger.error(`Blockchain minting failed for order ${order.id}:`, err);
      // Don't fail the order - tickets can be minted later
    }
  }

  // 4. Send notification
  await prisma.notification.create({
    data: {
      userId: order.userId,
      title: 'Ticket Purchase Successful',
      message: `You successfully purchased ${order.quantity} ticket(s) for ${event.title}.`,
      type: 'SUCCESS'
    }
  });

  logger.info(`Order ${order.id} finalized successfully`);
}

# Generate signature
SECRET="sk_test_your_secret_key"
PAYLOAD='{"event":"charge.success","data":{"reference":"GP-test-123","id":12345}}'
SIGNATURE=$(echo -n "$PAYLOAD" | openssl dgst -sha512 -hmac "$SECRET" | awk '{print $2}')

# Send webhook
curl -X POST https://api.gatepass.app/api/webhooks/paystack \
  -H "Content-Type: application/json" \
  -H "x-paystack-signature: $SIGNATURE" \
  -d "$PAYLOAD"