refactor: update AbacatePay webhook auth to use query param secret

- Replaced signature-based verification with secret validation using webhookSecret query parameter for improved compatibility
- Added CORS headers in next.config.ts for webhook API routes to handle external requests from varying IPs
- Updated abacatepay.ts verifyWebhookSignature method for backward compatibility, now delegating validation to route handler

app/api/webhooks/abacatepay/route.ts

@@ -4,15 +4,20 @@ import { abacatePay } from "@/lib/abacatepay";
 export async function POST(request: NextRequest) {
   try {
     const payload = await request.text();
-    const signature = request.headers.get("x-abacatepay-signature");
 
-    if (!signature || !abacatePay.verifyWebhookSignature(payload, signature)) {
-      return NextResponse.json(
-        { error: "Assinatura inválida" },
-        { status: 401 }
-      );
+    // AbacatePay envia webhookSecret como query param
+    const { searchParams } = new URL(request.url);
+    const webhookSecret = searchParams.get("webhookSecret");
+    const expectedSecret = process.env.ABACATEPAY_WEBHOOK_SECRET;
+
+    // Validar secret
+    if (!webhookSecret || !expectedSecret || webhookSecret !== expectedSecret) {
+      console.error("🔒 Webhook rejeitado: secret inválido ou ausente");
+      return NextResponse.json({ error: "Secret inválido" }, { status: 401 });
     }
 
+    console.log("✅ Webhook autenticado com sucesso");
+
     const event = JSON.parse(payload);
 
     console.log("🔔 Webhook recebido:", JSON.stringify(event, null, 2));