Epicure/apps/web/app/api/webhooks/gitea/route.ts

import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";
import { db, supportTickets, supportTicketComments, processedGiteaEvents, eq } from "@epicure/db";
import { getSiteSetting } from "@/lib/site-settings";
import { verifyGiteaSignature } from "@/lib/gitea";

type GiteaIssuePayload = {
  action?: string;
  number?: number;
  issue?: { number?: number };
  comment?: { id?: number; body?: string };
};

export async function POST(req: NextRequest) {
  const secret = await getSiteSetting("GITEA_WEBHOOK_SECRET");
  if (!secret) {
    return NextResponse.json({ error: "Gitea webhook not configured" }, { status: 400 });
  }

  const rawBody = await req.text();
  const signature = req.headers.get("x-gitea-signature");
  if (!signature || !verifyGiteaSignature(rawBody, signature, secret)) {
    return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
  }

  // Gitea includes a per-delivery id that stays stable across redeliveries
  // of the same event, same dedupe pattern as the Stripe receiver.
  const deliveryId = req.headers.get("x-gitea-delivery");
  if (deliveryId) {
    const [inserted] = await db
      .insert(processedGiteaEvents)
      .values({ id: deliveryId })
      .onConflictDoNothing()
      .returning({ id: processedGiteaEvents.id });
    if (!inserted) {
      return NextResponse.json({ received: true, duplicate: true });
    }
  }

  const eventType = req.headers.get("x-gitea-event");
  let payload: GiteaIssuePayload;
  try {
    payload = JSON.parse(rawBody) as GiteaIssuePayload;
  } catch {
    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
  }

  const issueNumber = payload.issue?.number ?? payload.number;
  if (!issueNumber) {
    return NextResponse.json({ received: true });
  }

  const ticket = await db.query.supportTickets.findFirst({ where: eq(supportTickets.giteaIssueNumber, issueNumber) });
  if (!ticket) {
    return NextResponse.json({ received: true });
  }

  if (eventType === "issues") {
    if (payload.action === "closed" && ticket.status !== "closed") {
      await db.update(supportTickets).set({ status: "closed", updatedAt: new Date() }).where(eq(supportTickets.id, ticket.id));
    } else if (payload.action === "reopened" && ticket.status === "closed") {
      await db.update(supportTickets).set({ status: "open", updatedAt: new Date() }).where(eq(supportTickets.id, ticket.id));
    }
  } else if (eventType === "issue_comment" && payload.action === "created" && payload.comment?.body) {
    const giteaCommentId = payload.comment.id ?? null;
    // A comment Epicure just posted via the API already has a row here
    // (inserted synchronously when it was sent) — skip it so the webhook
    // delivery for our own comment doesn't create a duplicate.
    const existing = giteaCommentId
      ? await db.query.supportTicketComments.findFirst({ where: eq(supportTicketComments.giteaCommentId, giteaCommentId) })
      : null;
    if (!existing) {
      await db.insert(supportTicketComments).values({
        id: crypto.randomUUID(),
        ticketId: ticket.id,
        authorType: "gitea",
        authorId: null,
        body: payload.comment.body,
        giteaCommentId,
        createdAt: new Date(),
      });
    }
  }

  return NextResponse.json({ received: true });
}