Merge pull request #79 from ScrawnDotDev/feat/auto-register-dodo-webhooks

feat: auto-register live/test dodo webhooks via SDK during onboarding

Author: SteakFisher

.env.example

@@ -2,6 +2,7 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/scrawn
 CLICKHOUSE_URL=http://default:clickhouse@localhost:8123/scrawn
 
 HMAC_SECRET=
+APP_URL=http://localhost:8060 # URL the Scrawn backend is hosted on
 
 # SENTRY_DSN=
 # LOG_LEVEL=info

.env.test

@@ -7,7 +7,6 @@ DODO_PAYMENTS_LIVE_API_KEY=
 DODO_PAYMENTS_TEST_API_KEY=test_dodo_key
 DODO_PAYMENTS_LIVE_PRODUCT_ID=
 DODO_PAYMENTS_TEST_PRODUCT_ID=prod_test
-DODO_PAYMENTS_WEBHOOK_SECRET=test-webhook-secret
 REDIRECT_URL=http://localhost:18070
 TEST_API_KEY=
 APP_URL=http://localhost:18070

docker-compose.yml

@@ -59,6 +59,7 @@ services:
       CLICKHOUSE_URL: http://default:clickhouse@clickhouse:8123/scrawn
       NODE_ENV: production
       HMAC_SECRET: ${HMAC_SECRET}
+      APP_URL: ${APP_URL}
 
   dashboard:
     profiles:

src/routes/gRPC/payment/paymentProvider.ts

@@ -29,7 +29,7 @@ export async function getDodoClient(
     liveClient = new DodoPayments({
       bearerToken: apiKey,
       environment: "live_mode",
-      webhookKey: metadata?.dodo_webhook_secret ?? undefined,
+      webhookKey: metadata?.dodo_live_webhook_secret ?? undefined,
     });
     return liveClient;
   }
@@ -45,7 +45,7 @@ export async function getDodoClient(
   testClient = new DodoPayments({
     bearerToken: apiKey,
     environment: "test_mode",
-    webhookKey: metadata?.dodo_webhook_secret ?? undefined,
+    webhookKey: metadata?.dodo_test_webhook_secret ?? undefined,
   });
   return testClient;
 }

src/routes/http/api/onboarding.ts

@@ -1,13 +1,14 @@
 import type { FastifyRequest, FastifyReply } from "fastify";
 import * as Sentry from "@sentry/bun";
 import { ZodError } from "zod";
-import { onboardingCronSchema } from "../../../zod/internals.ts";
+import DodoPayments from "dodopayments";
+import { onboardingSchema } from "../../../zod/internals.ts";
 import {
   createWideEventBuilder,
   generateRequestId,
 } from "../../../context/requestContext.ts";
 import { logger } from "../../../errors/logger.ts";
-import { AuthError } from "../../../errors/auth.ts";
+import { AuthError } from "../../../errors/auth";
 import { authenticateHttpApiKey } from "../../../utils/authenticateHttpApiKey.ts";
 import {
   upsertMetadata,
@@ -18,7 +19,7 @@ import { clearClients } from "../../gRPC/payment/paymentProvider.ts";
 export async function handleOnboarding(
   request: FastifyRequest,
   reply: FastifyReply
-): Promise<{ crons: string[] }> {
+): Promise<Record<string, never>> {
   const builder = createWideEventBuilder(
     generateRequestId(),
     request.method,
@@ -30,14 +31,65 @@ export async function handleOnboarding(
     await authenticateHttpApiKey(authHeader);
 
     const body = await request.body;
-    const validated = onboardingCronSchema.parse(body);
+    const validated = onboardingSchema.parse(body);
+
+    const appUrl = process.env.APP_URL;
+    if (!appUrl) {
+      builder.setError(500, {
+        type: "ConfigError",
+        message: "APP_URL environment variable is not set",
+      });
+      reply.code(500);
+      return {};
+    }
+
+    const liveClient = new DodoPayments({
+      bearerToken: validated.dodoLiveApiKey,
+      environment: "live_mode",
+    });
+    const testClient = new DodoPayments({
+      bearerToken: validated.dodoTestApiKey,
+      environment: "test_mode",
+    });
+
+    let liveSecret: string;
+    let testSecret: string;
+    try {
+      const liveWebhook = await liveClient.webhooks.create({
+        url: `${appUrl}/webhooks/payment/createdCheckout?mode=production`,
+        description: "Scrawn live payment webhook",
+        filter_types: ["payment.succeeded", "payment.failed"],
+      });
+      liveSecret = (await liveClient.webhooks.retrieveSecret(liveWebhook.id))
+        .secret;
+
+      const testWebhook = await testClient.webhooks.create({
+        url: `${appUrl}/webhooks/payment/createdCheckout?mode=test`,
+        description: "Scrawn test payment webhook",
+        filter_types: ["payment.succeeded", "payment.failed"],
+      });
+      testSecret = (await testClient.webhooks.retrieveSecret(testWebhook.id))
+        .secret;
+    } catch (error) {
+      const errMsg = error instanceof Error ? error.message : String(error);
+      Sentry.captureException(error, {
+        extra: { context: "dodo webhook registration during onboarding" },
+      });
+      builder.setError(400, {
+        type: "DodoApiError",
+        message: `Failed to register webhook with Dodo: ${errMsg}`,
+      });
+      reply.code(400);
+      return {};
+    }
 
     await upsertMetadata({
       dodo_live_api_key: validated.dodoLiveApiKey,
       dodo_test_api_key: validated.dodoTestApiKey,
       dodo_live_product_id: validated.dodoLiveProductId,
       dodo_test_product_id: validated.dodoTestProductId,
-      dodo_webhook_secret: validated.dodoWebhookSecret,
+      dodo_live_webhook_secret: liveSecret,
+      dodo_test_webhook_secret: testSecret,
       currency: validated.currency,
       redirect_url: validated.redirectUrl,
     });
@@ -47,7 +99,7 @@ export async function handleOnboarding(
     builder.setSuccess(200);
 
     reply.code(201);
-    return { crons: validated.crons };
+    return {};
   } catch (error) {
     Sentry.captureException(error, {
       extra: { context: "onboarding route handler" },
@@ -59,7 +111,7 @@ export async function handleOnboarding(
         message: error.message,
       });
       reply.code(401);
-      return { crons: [] };
+      return {};
     }
 
     if (error instanceof ZodError) {
@@ -71,7 +123,7 @@ export async function handleOnboarding(
         message: issues,
       });
       reply.code(400);
-      return { crons: [] };
+      return {};
     }
 
     const err = error instanceof Error ? error : new Error(String(error));
@@ -80,7 +132,7 @@ export async function handleOnboarding(
       message: err.message,
     });
     reply.code(500);
-    return { crons: [] };
+    return {};
   } finally {
     logger.emit(builder.build());
   }
@@ -122,7 +174,8 @@ export async function handleGetConfig(
       dodo_test_api_key: maskApiKey(metadata.dodo_test_api_key),
       dodo_live_product_id: metadata.dodo_live_product_id,
       dodo_test_product_id: metadata.dodo_test_product_id,
-      dodo_webhook_secret: maskApiKey(metadata.dodo_webhook_secret),
+      dodo_live_webhook_secret: maskApiKey(metadata.dodo_live_webhook_secret),
+      dodo_test_webhook_secret: maskApiKey(metadata.dodo_test_webhook_secret),
       currency: metadata.currency,
       redirect_url: metadata.redirect_url,
     };

src/routes/http/api/webhookEndpoints.ts

@@ -68,7 +68,7 @@ function toEndpointResponse(
 export async function handleCreateWebhookEndpoint(
   request: FastifyRequest,
   reply: FastifyReply
-): Promise<WebhookEndpointResponse | { error: string; crons?: never }> {
+): Promise<WebhookEndpointResponse | { error: string }> {
   const builder = createWideEventBuilder(
     generateRequestId(),
     request.method,

src/routes/http/createdCheckout.ts

@@ -71,10 +71,13 @@ export async function handleDodoWebhook(
   signature: string | undefined,
   timestamp: string | undefined,
   webhookId: string | undefined,
+  mode: "production" | "test",
   builder: WideEventBuilder
 ): Promise<WebhookResponse> {
   try {
-    const client = await getDodoClient();
+    const client = await getDodoClient(
+      mode === "production" ? "production" : "test"
+    );
     const headers = buildWebhookHeaders(signature, timestamp, webhookId);
     const webhookPayload = unwrapWebhookPayload(client, rawBody, headers);
 

src/routes/http/registerWebhookRoutes.ts

@@ -36,6 +36,17 @@ export async function registerWebhookRoutes(
       );
 
       try {
+        const mode = (request.query as Record<string, string>)?.mode;
+        if (mode !== "production" && mode !== "test") {
+          builder.setError(400, {
+            type: "ValidationError",
+            message:
+              "Invalid or missing 'mode' query parameter. Must be 'production' or 'test'.",
+          });
+          reply.code(400);
+          return { error: "Invalid mode query parameter" };
+        }
+
         const signatureHeader = request.headers["webhook-signature"];
         const timestampHeader = request.headers["webhook-timestamp"];
         const webhookIdHeader = request.headers["webhook-id"];
@@ -60,6 +71,7 @@ export async function registerWebhookRoutes(
           signature,
           timestamp,
           webhookId,
+          mode,
           builder
         );
 

src/storage/db/postgres/helpers/metadata.ts

@@ -9,7 +9,8 @@ export type UpsertMetadataInput = {
   dodo_test_api_key?: string;
   dodo_live_product_id?: string;
   dodo_test_product_id?: string;
-  dodo_webhook_secret?: string;
+  dodo_live_webhook_secret?: string;
+  dodo_test_webhook_secret?: string;
   currency?: string;
   redirect_url?: string;
 };
@@ -36,8 +37,10 @@ export async function upsertMetadata(
         setValues.dodo_live_product_id = input.dodo_live_product_id;
       if (input.dodo_test_product_id !== undefined)
         setValues.dodo_test_product_id = input.dodo_test_product_id;
-      if (input.dodo_webhook_secret !== undefined)
-        setValues.dodo_webhook_secret = input.dodo_webhook_secret;
+      if (input.dodo_live_webhook_secret !== undefined)
+        setValues.dodo_live_webhook_secret = input.dodo_live_webhook_secret;
+      if (input.dodo_test_webhook_secret !== undefined)
+        setValues.dodo_test_webhook_secret = input.dodo_test_webhook_secret;
       if (input.currency !== undefined) setValues.currency = input.currency;
       if (input.redirect_url !== undefined)
         setValues.redirect_url = input.redirect_url;

src/storage/db/postgres/schema.ts

@@ -264,7 +264,8 @@ export const metadataTable = pgTable("metadata", {
   dodo_test_api_key: text("dodo_test_api_key").notNull(),
   dodo_live_product_id: text("dodo_live_product_id").notNull(),
   dodo_test_product_id: text("dodo_test_product_id").notNull(),
-  dodo_webhook_secret: text("dodo_webhook_secret").notNull(),
+  dodo_live_webhook_secret: text("dodo_live_webhook_secret").notNull(),
+  dodo_test_webhook_secret: text("dodo_test_webhook_secret").notNull(),
   currency: text("currency").notNull().default("usd"),
   redirect_url: text("redirect_url").notNull(),
 });