Next.js integration

export async function POST(request: Request) {
  const order = await resolveOrder(await request.json());
  const idempotencyKey = `checkout-${order.id}`;
  const controller = new AbortController();
  const timeout = setTimeout(() => controller.abort(), 10_000);
  try {
    const response = await fetch(
      "https://merchant-demo.zahlo.eu/api/v1/checkout-sessions",
      {
        signal: controller.signal,
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "x-api-key": process.env.ZAHLO_API_KEY!,
          "Idempotency-Key": idempotencyKey,
        },
        body: JSON.stringify({
          mode: "embedded",
          amountMinor: order.totalMinor,
          currency: order.currency,
          method: "card",
          orderId: order.id,
        }),
      }
    );
    const body = await response.json();
    return Response.json(body, {
      headers: { "Cache-Control": "no-store" },
      status: response.status,
    });
  } catch (error) {
    if (error instanceof DOMException && error.name === "AbortError") {
      return Response.json(
        {
          error: {
            code: "timeout",
            message: "Retry with the same Idempotency-Key.",
            retryable: true,
          },
        },
        { status: 504 }
      );
    }
    throw error;
  } finally {
    clearTimeout(timeout);
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request) {
  const rawBody = Buffer.from(await request.arrayBuffer());
  const received = request.headers.get("x-zahlo-signature") ?? "";
  const expected = createHmac("sha256", process.env.ZAHLO_WEBHOOK_SECRET!)
    .update(rawBody)
    .digest("hex");
  const signature = received.replace(/^sha256=/, "");
  const valid =
    /^[a-f0-9]{64}$/i.test(signature) &&
    timingSafeEqual(
      Buffer.from(expected, "hex"),
      Buffer.from(signature, "hex")
    );
  if (!valid) return new Response("Unauthorized", { status: 401 });
  const event = JSON.parse(rawBody.toString("utf8"));
  await recordOnceAndEnqueue(event.id, event);
  return Response.json({ received: true });
}