Webhooks

503 secret_store_unavailable
"Webhook secrets cannot be stored right now. Please try again later."

// browser ou servidor — endpoint público, sem secret key
const pago = await infi.pay.waitForPaid({ slug, invoiceId });
// true = pagou, false = timeout (default: 3s de intervalo, 10min de teto)

// servidor, leitura pontual
const inv = await infi.invoices.get(invoiceId);
inv.status; // "open" | "paid" | …

const endpoint = await infi.webhooks.create({
  url: "https://seu-app.com/api/webhooks/infi",
  events: ["payment.confirmed", "invoice.finalized"],
});

endpoint.secret; // ⚠️ só aparece aqui. Guarde no seu secret manager.

// app/api/webhooks/infi/route.ts
import { verifyWebhook, InfiError } from "@beinfi/sdk";
import type { PaymentConfirmedData } from "@beinfi/sdk";

export async function POST(req: Request) {
  const body = await req.text(); // texto cru: JSON.parse quebra a assinatura

  try {
    const event = verifyWebhook<PaymentConfirmedData>(
      {
        id: req.headers.get("x-webhook-id")!,
        timestamp: req.headers.get("x-webhook-timestamp")!,
        signature: req.headers.get("x-webhook-signature")!,
        eventType: req.headers.get("x-webhook-event-type")!,
        body,
      },
      process.env.INFI_WEBHOOK_SECRET!,
    );

    if (event.type === "payment.confirmed") {
      // event.data.invoiceId → libere o acesso (idempotente!)
    }
    return new Response("ok");
  } catch (err) {
    if (err instanceof InfiError) return new Response(err.code, { status: 400 });
    throw err;
  }
}

const chave = `invoice:${event.data.invoiceId}`;
if (await jaProcessado(chave)) return ok();
await marcarProcessado(chave);   // marque ANTES do efeito
await liberarAcesso(...);