From 634a5bc40ba079755ab107a470c4bab606031ba0 Mon Sep 17 00:00:00 2001
From: Evandro Fonseca Junior <asemlk54@hotmail.com>
Date: Sun, 26 Oct 2025 21:53:39 -0300
Subject: [PATCH] refactor: update AbacatePay webhook auth to use query param
 secret

- Replaced signature-based verification with secret validation using webhookSecret query parameter for improved compatibility
- Added CORS headers in next.config.ts for webhook API routes to handle external requests from varying IPs
- Updated abacatepay.ts verifyWebhookSignature method for backward compatibility, now delegating validation to route handler
---
 app/api/webhooks/abacatepay/route.ts | 17 +++++++++++------
 lib/abacatepay.ts                    |  4 +---
 next.config.ts                       | 22 ++++++++++++++++++++++
 3 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/app/api/webhooks/abacatepay/route.ts b/app/api/webhooks/abacatepay/route.ts
index 85b81ef..d6dfab7 100644
--- a/app/api/webhooks/abacatepay/route.ts
+++ b/app/api/webhooks/abacatepay/route.ts
@@ -4,15 +4,20 @@ import { abacatePay } from "@/lib/abacatepay";
 export async function POST(request: NextRequest) {
   try {
     const payload = await request.text();
-    const signature = request.headers.get("x-abacatepay-signature");
 
-    if (!signature || !abacatePay.verifyWebhookSignature(payload, signature)) {
-      return NextResponse.json(
-        { error: "Assinatura inválida" },
-        { status: 401 }
-      );
+    // AbacatePay envia webhookSecret como query param
+    const { searchParams } = new URL(request.url);
+    const webhookSecret = searchParams.get("webhookSecret");
+    const expectedSecret = process.env.ABACATEPAY_WEBHOOK_SECRET;
+
+    // Validar secret
+    if (!webhookSecret || !expectedSecret || webhookSecret !== expectedSecret) {
+      console.error("🔒 Webhook rejeitado: secret inválido ou ausente");
+      return NextResponse.json({ error: "Secret inválido" }, { status: 401 });
     }
 
+    console.log("✅ Webhook autenticado com sucesso");
+
     const event = JSON.parse(payload);
 
     console.log("🔔 Webhook recebido:", JSON.stringify(event, null, 2));
diff --git a/lib/abacatepay.ts b/lib/abacatepay.ts
index e905304..fe701f5 100644
--- a/lib/abacatepay.ts
+++ b/lib/abacatepay.ts
@@ -166,9 +166,7 @@ class AbacatePayClient {
   }
 
   verifyWebhookSignature(payload: string, signature: string): boolean {
-    // Implementar verificação de assinatura conforme documentação do AbacatePay
-    // Por enquanto, retorna true para desenvolvimento
-    // Em produção, implementar a verificação real
+    // Método mantido para compatibilidade, mas validação agora é feita via query param
     return true;
   }
 }
diff --git a/next.config.ts b/next.config.ts
index 7a48280..18ee50d 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -5,6 +5,28 @@ const withNextIntl = createNextIntlPlugin("./i18n/request.ts");
 
 const nextConfig: NextConfig = {
   /* config options here */
+  async headers() {
+    return [
+      {
+        // Aplicar CORS apenas para rotas de API
+        source: "/api/webhooks/:path*",
+        headers: [
+          {
+            key: "Access-Control-Allow-Origin",
+            value: "*", // AbacatePay envia de IPs variados
+          },
+          {
+            key: "Access-Control-Allow-Methods",
+            value: "POST, GET, OPTIONS",
+          },
+          {
+            key: "Access-Control-Allow-Headers",
+            value: "Content-Type, Authorization",
+          },
+        ],
+      },
+    ];
+  },
 };
 
 export default withNextIntl(nextConfig);