Automated branded email receipts for Paddle billing webhooks

import { NextRequest, NextResponse } from 'next/server';
import crypto from 'node:crypto';
import { SadaSend } from 'sadasend';
import { render } from '@react-email/render';
import { ReceiptEmail } from '@/emails/ReceiptEmail';

const sadasend = new SadaSend({ apiKey: process.env.SADASEND_API_KEY! });

export async function POST(req: NextRequest) {
  const signature = req.headers.get('paddle-signature') || '';
  const rawBody = await req.text();

  // 1. Verify Paddle webhook HMAC signature
  const hmac = crypto.createHmac('sha256', process.env.PADDLE_WEBHOOK_SECRET!);
  const digest = hmac.update(rawBody).digest('hex');

  // Constant-time comparison prevents timing attacks
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(digest)
  );

  if (!isValid) {
    return NextResponse.json({ error: 'Invalid webhook signature' }, { status: 401 });
  }

  const event = JSON.parse(rawBody);

  // 2. Process successful payment receipt
  if (event.event_type === 'transaction.completed') {
    const { customer, details, currency_code } = event.data;

    // 3. Render responsive React Email
    const emailHtml = await render(
      <ReceiptEmail
        customerName={customer.name}
        amount={details.totals.total}
        currency={currency_code}
        items={event.data.items}
      />
    );

    // 4. Dispatch via SadaSend API
    await sadasend.emails.send({
      from: 'billing@yourdomain.com',
      to: customer.email,
      subject: `Your Receipt for Order #${event.data.id}`,
      html: emailHtml,
    });
  }

  return NextResponse.json({ received: true });
}