Guías de integración

{
  "id": "ap_chk_01HY8Q9A3Y9B5J7V2V0M9R4S8T",
  "sessionId": "ap_chk_01HY8Q9A3Y9B5J7V2V0M9R4S8T",
  "hostedUrl": "https://andorpay.com/checkout/ap_chk_01HY8Q9A3Y9B5J7V2V0M9R4S8T",
  "expiresAt": "2026-05-17T10:30:00.000Z",
  "request_id": "req_01HY8T2M0D6F4Q7F3K8A9V2N1C"
}

type CheckoutCustomer = {
  email: string
  name?: string
  billingDetails?: {
    line1?: string
    city?: string
    postal_code?: string
    country?: string
  }
  tax?: {
    value: string
    type: string
  }
}

type CreateCheckoutSessionInput = {
  externalCustomerId: string
  productId: string
  customer: CheckoutCustomer
  successUrl: string
  failUrl: string
  amount?: number
}

const andorpayApiUrl = process.env.ANDORPAY_API_URL ?? "https://api.andorpay.com"

export async function createAndorpayCheckout(input: CreateCheckoutSessionInput, idempotencyKey: string) {
  const response = await fetch(`${andorpayApiUrl}/v1/checkouts`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.ANDORPAY_API_KEY}`,
      "Content-Type": "application/json",
      "Andorpay-Version": "2026-01-01",
      "Idempotency-Key": idempotencyKey,
    },
    body: JSON.stringify(input),
  })

  const payload = await response.json()

  if (!response.ok) {
    throw new Error(`No se pudo crear el checkout de Andorpay: ${payload.code ?? response.status}`)
  }

  return payload as {
    id: string
    sessionId: string
    hostedUrl: string
    expiresAt?: string
  }
}

export function continueToAndorpayCheckout(checkout: { hostedUrl: string }) {
  window.location.assign(checkout.hostedUrl)
}

import crypto from "node:crypto"
import { NextRequest, NextResponse } from "next/server"

function verifyAndorpaySignature(rawBody: string, signatureHeader: string, secret: string) {
  const parts = new Map(signatureHeader.split(",").map((part) => {
    const [key, value] = part.split("=")
    return [key, value]
  }))
  const timestamp = parts.get("t")
  const signature = parts.get("v1")

  if (!timestamp || !signature) {
    return false
  }

  const timestampMs = Number(timestamp) * 1000
  if (!Number.isFinite(timestampMs) || Math.abs(Date.now() - timestampMs) > 5 * 60 * 1000) {
    return false
  }

  const payload = `${timestamp}.${rawBody}`
  const expected = crypto.createHmac("sha256", secret).update(payload).digest("hex")
  const signatureBuffer = Buffer.from(signature, "hex")
  const expectedBuffer = Buffer.from(expected, "hex")

  if (signatureBuffer.length !== expectedBuffer.length) {
    return false
  }

  return crypto.timingSafeEqual(signatureBuffer, expectedBuffer)
}

export async function POST(request: NextRequest) {
  const rawBody = await request.text()
  const signature = request.headers.get("Andorpay-Signature")

  if (!signature || !verifyAndorpaySignature(rawBody, signature, process.env.ANDORPAY_WEBHOOK_SECRET!)) {
    return NextResponse.json({ error: "Firma no válida" }, { status: 400 })
  }

  const event = JSON.parse(rawBody) as {
    id: string
    type: string
    customer?: { external_customer_id?: string }
    subscription?: { id?: string; status?: string; current_period_end?: string }
    payment?: { id?: string; status?: string }
  }

  // Guarda event.id antes de aplicar efectos. Ignora el evento si ya lo has procesado.
  switch (event.type) {
    case "payment.succeeded":
      // Marca el pago o pedido local como pagado. En suscripciones, actualiza el acceso desde eventos subscription.*.
      break
    case "payment.failed":
      // Mantén una política de gracia y pide al cliente que actualice o autentique el método de pago si hace falta.
      break
    case "subscription.created":
    case "subscription.updated":
    case "subscription.cancelled":
      break
    case "invoice.created":
    case "invoice.payment_failed":
      break
    case "refund.created":
    case "payment_method.updated":
    case "payment_method.updated_required":
    case "billing.operational_alert":
      break
    default:
      break
  }

  return NextResponse.json({ received: true })
}