import { MedusaRequest, MedusaResponse } from "@medusajs/framework"
import { Modules, PaymentWebhookEvents } from "@medusajs/framework/utils"

export async function POST(req: MedusaRequest, res: MedusaResponse) {
  const webhookSecret = process.env.XENDIT_WEBHOOK_SECRET
  const apiKey = req.headers["x-api-key"] as string | undefined
  const logger = req.scope.resolve("logger") as any

  if (webhookSecret && apiKey !== webhookSecret) {
    logger.warn("Xendit webhook: invalid API key")
    return res.status(401).json({ error: "Unauthorized" })
  }

  const body = req.body as any
  logger.info(`Xendit webhook received: ${body?.status} for invoice ${body?.id}`)

  const event = {
    provider: "xendit_xendit",
    payload: {
      data: req.body,
      rawData: req.rawBody as string,
      headers: req.headers,
    },
  }

  const eventBus = req.scope.resolve(Modules.EVENT_BUS)
  await eventBus.emit({
    name: PaymentWebhookEvents.WebhookReceived,
    data: event,
  }, {
    delay: 5000,
    attempts: 3,
  })

  return res.sendStatus(200)
}