codalware-auth/src/lib/stripeWebhook.ts

Complete authentication system with enterprise security, attack protection, team workspaces, waitlist, billing, UI components, 2FA, and account recovery - production-ready in 5 minutes. Enhanced CLI with verification, rollback, and App Router scaffolding.

import { getRawBody } from './webhooks';
import { IncomingMessage } from 'http';
type NodeRequire = NodeJS.Require;

// Use dynamic require so the project can build without stripe installed. If stripe is available, use it.
export function createStripeClient() {
  try {
    const dynamicRequire = eval('require') as NodeRequire;
    const Stripe = dynamicRequire?.('stripe');
    if (!Stripe) return null;
    const key = process.env.STRIPE_SECRET_KEY || '';
    return new Stripe(key, { apiVersion: '2022-11-15' });
  } catch {
    return null;
  }
}

export async function verifyStripeEvent(req: IncomingMessage): Promise<{ event?: unknown; error?: string }> {
  try {
    const raw = await getRawBody(req);
    const requestHeaders = req.headers as Record<string, string | string[] | undefined>;
    const sig = requestHeaders['stripe-signature'];
    const stripeSigningSecret = process.env.STRIPE_SIGNING_SECRET;
    if (!sig || !stripeSigningSecret) return { error: 'missing signature or signing secret' };
    const stripe = createStripeClient();
    if (!stripe) return { error: 'stripe package not installed' };
    const event = stripe.webhooks.constructEvent(raw, sig, stripeSigningSecret);
    return { event };
  } catch (error) {
    const message = error instanceof Error ? error.message : 'invalid stripe event';
    return { error: message };
  }
}