import { timingSafeEqual } from "node:crypto";
import { NextResponse } from "next/server";
import { processAsaasEvent } from "@/lib/billing/webhook";

function validToken(received: string | null) {
  const expected = process.env.ASAAS_WEBHOOK_TOKEN;
  if (!received || !expected) return false;
  const a = Buffer.from(received); const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

export async function POST(request: Request) {
  if (!validToken(request.headers.get("asaas-access-token"))) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
  try { const result = await processAsaasEvent(await request.json()); return NextResponse.json(result); }
  catch (error) { console.error("asaas_webhook_failed", error); return NextResponse.json({ error: "processing_failed" }, { status: 500 }); }
}