Webhooks & On-Demand Revalidation

import { type NextRequest, NextResponse } from "next/server";
import { revalidatePath, revalidateTag as _revalidateTag } from "next/cache";

// Next.js 16 requires a second `profile` arg in its types, but route handlers
// have no valid profile to pass (updateTag is Server Actions only). Cast to the
// single-arg overload so the runtime's immediate-invalidation path is used.
const revalidateTag = _revalidateTag as (tag: string) => void;

export async function GET() {
  return NextResponse.json({ ok: true });
}

/**
 * Optimizely Graph webhook receiver.
 *
 * Register this URL via `npm run webhook:register` — the script appends
 * ?secret=OPTIMIZELY_REVALIDATE_SECRET to the registered URL, since Graph
 * webhook registration only controls the URL, not custom headers.
 *
 * Webhook payload types:
 *   - bulk.completed  – Graph finished processing a content sync
 *   - doc.updated     – a single content item was updated
 *   - doc.expired     – a content item reached its StopPublish date
 */
export async function POST(request: NextRequest) {
  const secret =
    request.nextUrl.searchParams.get("secret") ??
    request.headers.get("x-revalidate-secret");

  if (secret !== process.env.OPTIMIZELY_REVALIDATE_SECRET) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  try {
    const body = await request.json();

    console.log("[Optimizely Graph Webhook] Event received:", body);

    revalidatePath("/", "layout");
    revalidateTag("page");
    revalidateTag("navigation");
    revalidateTag("banner");
    revalidateTag("footer");
    revalidateTag("settings");
    revalidateTag("quotes");

    return NextResponse.json({ received: true, timestamp: Date.now() });
  } catch (error) {
    console.error("[Webhook] Failed to parse body:", error);
    return NextResponse.json({ error: "Failed to parse body" }, { status: 400 });
  }
}

/**
 * Registers an Optimizely Graph webhook pointing to /api/webhooks.
 *
 * Usage:
 *   npm run webhook:register
 *
 * You will be prompted for your public base URL (e.g. https://your-app.vercel.app
 * or an ngrok tunnel for local testing).
 *
 * Credentials are read from .env.local:
 *   OPTIMIZELY_APP_KEY
 *   OPTIMIZELY_APP_SECRET
 *   OPTIMIZELY_REVALIDATE_SECRET (appended to the URL so /api/webhooks can verify the sender)
 */

import { createInterface } from "readline";
import { config } from "dotenv";

config({ path: ".env.local" });

const APP_KEY = process.env.OPTIMIZELY_APP_KEY;
const APP_SECRET = process.env.OPTIMIZELY_APP_SECRET;

if (!APP_KEY || !APP_SECRET) {
  console.error(
    "Error: OPTIMIZELY_APP_KEY and OPTIMIZELY_APP_SECRET must be set in .env.local"
  );
  process.exit(1);
}

const rl = createInterface({ input: process.stdin, output: process.stdout });
const question = (prompt) =>
  new Promise((resolve) => rl.question(prompt, resolve));

const baseUrl = await question(
  "Enter your public base URL (e.g. https://your-app.vercel.app): "
);
rl.close();

const REVALIDATE_SECRET = process.env.OPTIMIZELY_REVALIDATE_SECRET;
if (!REVALIDATE_SECRET) {
  console.error(
    "Error: OPTIMIZELY_REVALIDATE_SECRET must be set in .env.local — the receiver at /api/webhooks rejects unauthenticated calls"
  );
  process.exit(1);
}

const webhookUrl = `${baseUrl.trim().replace(/\/$/, "")}/api/webhooks?secret=${encodeURIComponent(REVALIDATE_SECRET)}`;
const credentials = Buffer.from(`${APP_KEY}:${APP_SECRET}`).toString("base64");

console.log(`\nRegistering webhook → ${webhookUrl}`);

const response = await fetch("https://cg.optimizely.com/api/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Basic ${credentials}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    disabled: false,
    request: {
      url: webhookUrl,
      method: "post",
    },
    topic: ["*.*"],
  }),
});

const text = await response.text();

if (!response.ok) {
  console.error(`Failed to register webhook (HTTP ${response.status}):`, text);
  process.exit(1);
}

console.log("\nWebhook registered successfully!");
try {
  console.log(JSON.parse(text));
} catch {
  console.log(text);
}
console.log(
  "\nTo list all registered webhooks, run:\n" +
    "  curl -u '<app-key>:<app-secret>' https://cg.optimizely.com/api/webhooks"
);