Files

56 lines
2.1 KiB
JavaScript

/**
* Stripe — Retrieve Checkout Session status
* -----------------------------------------
* The success return page calls this with the `session_id` Stripe appended to
* the success_url. We retrieve the session server-side (using the secret key)
* and return a trimmed, safe status object the UI can render and record.
*
* Returning here does NOT replace the webhook — the webhook is the authoritative
* record of truth (it fires even if the customer closes the tab). This endpoint
* just gives the returning customer immediate, verified confirmation.
*
* Env: STRIPE_SECRET_KEY
*/
export default async function handler(req, res) {
if (req.method !== 'GET') {
return res.status(405).json({ error: 'Method not allowed' });
}
const secretKey = (process.env.STRIPE_SECRET_KEY || '').trim();
if (!secretKey) {
return res.status(503).json({
error: 'Stripe is not configured.',
code: 'stripe_not_configured',
});
}
const sessionId = req.query?.session_id;
if (!sessionId) {
return res.status(400).json({ error: 'session_id is required' });
}
try {
const Stripe = (await import('stripe')).default;
const stripe = new Stripe(secretKey, { apiVersion: '2024-06-20' });
const session = await stripe.checkout.sessions.retrieve(sessionId);
return res.status(200).json({
id: session.id,
// status: open | complete | expired
status: session.status,
// payment_status: paid | unpaid | no_payment_required
paymentStatus: session.payment_status,
amountTotal: session.amount_total,
currency: session.currency,
customerEmail: session.customer_details?.email || null,
invoiceId: session.metadata?.invoiceId || null,
created: session.created ? session.created * 1000 : null,
});
} catch (err) {
console.error('[session-status] error:', err.message);
return res.status(500).json({ error: err.message || 'Failed to retrieve session' });
}
}