Обработка вебхуков: проверка подписи, быстрый ответ и вынесение долгой работы

export async function handler(event) {
  const rawBody = event.body ?? '';
  if (!stripe.webhooks.verifySignature(rawBody, event.headers['stripe-signature'], process.env.STRIPE_WEBHOOK_SECRET)) {
    return { statusCode: 400, body: 'invalid signature' };
  }
  const evt = JSON.parse(rawBody);
  // Persist evt.id BEFORE side effects — idempotency key
  const isNew = await db.upsertWebhookEvent(evt.id, evt.type);
  if (!isNew) return { statusCode: 200, body: 'duplicate' };
  // Ack Stripe fast, continue fulfillment asynchronously
  await global.durable.startNew('process-payment', undefined, { eventId: evt.id, type: evt.type, obj: evt.data.object });
  return { statusCode: 200, body: 'ok' };
}

import { createHmac } from 'node:crypto';

export async function handler(event) {
  const rawBody = event.body ?? '';
  const hmac = event.headers['x-shopify-hmac-sha256'];
  const digest = createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET).update(rawBody).digest('base64');
  if (hmac !== digest) return { statusCode: 401, body: 'invalid signature' };
  const topic = event.headers['x-shopify-topic']; // e.g. 'orders/create'
  const order = JSON.parse(rawBody);
  await global.durable.startNew('process-order', undefined, { topic, orderId: order.id });
  return { statusCode: 200, body: '' };
}