Method HandleWebhook

internal/payment/webhook.go:38–65

HandleWebhook is the HTTP handler for POST /webhook/stripe.

(w http.ResponseWriter, r *http.Request)

// HandleWebhook is the HTTP handler for POST /webhook/stripe.
func (d *WebhookDeps) HandleWebhook(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(io.LimitReader(r.Body, 65536))
	if err != nil {
		http.Error(w, "read body failed", http.StatusBadRequest)
		return
	}

	event, err := ConstructEventAuto(body, r.Header.Get("Stripe-Signature"), d.Settings, d.EnvWebhookSecret)
	if err != nil {
		log.Printf("payment: webhook signature error: %v", err)
		http.Error(w, "invalid signature", http.StatusBadRequest)
		return
	}

	// 幂等性和并发安全由数据库层保证（状态检查 + UpsertOrder），不依赖进程内锁。
	switch event.Type {
	case "checkout.session.completed":
		d.handleCheckoutCompleted(event)
	case "invoice.paid":
		d.handleInvoicePaid(event)
	case "invoice.payment_failed":
		d.handleInvoicePaymentFailed(event)
	case "customer.subscription.deleted":
		d.handleSubscriptionDeleted(event)
	}

	w.WriteHeader(http.StatusOK)
}

func (d *WebhookDeps) handleCheckoutCompleted(event stripe.Event) {
	var sess stripe.CheckoutSession