@odla-ai/chapter 0.43.0 → 0.43.2

package/dist/worker/index.js

@@ -4435,6 +4435,13 @@ async function startGiftIntent(db, input) {
   };
 }
 
+// src/stripe-webhook-secret.ts
+async function resolveStripeWebhookSecret(db, runtime) {
+  const scoped = await getVaultSecret(db, stripeWebhookSecretName(runtime));
+  if (scoped || !runtime) return scoped;
+  return getVaultSecret(db, "stripe_webhook_secret");
+}
+
 // src/payments-route-support.ts
 var paymentErrorCode = (error) => error && typeof error === "object" && typeof error.code === "string" ? error.code : "unknown";
 function paymentLineItems(group) {
@@ -4643,7 +4650,7 @@ async function startSubscription(req, env, ctx) {
 }
 async function ingestWebhook(req, env, ctx) {
   const db = ctx.makeDb(env);
-  const webhookSecret = await getVaultSecret(db, stripeWebhookSecretName(env.ODLA_RUNTIME));
+  const webhookSecret = await resolveStripeWebhookSecret(db, env.ODLA_RUNTIME);
   if (!webhookSecret) return json({ error: "webhook not configured" }, 503);
   const rawBody = await req.text();
   const ingest = await createStripeProvider({ webhookSecret }).ingestWebhook(rawBody, req.headers.get("stripe-signature") ?? "");
@@ -7101,9 +7108,10 @@ async function verifySource(req, db, ctx) {
   return null;
 }
 var handleBuilderLibraryControl = async (req, url, env, ctx) => {
-  if (req.method !== "POST" || url.pathname !== BUILDER_LIBRARY_CONTROL_PATH) return null;
+  if (url.pathname !== BUILDER_LIBRARY_CONTROL_PATH) return null;
   const settings = ctx.chapter.builderLibrary;
   if (!settings) return json({ error: "not found" }, 404);
+  if (req.method !== "POST") return json({ error: "unauthorized" }, 401);
   const db = ctx.makeDb(env);
   const verified = await verifySource(req, db, ctx);
   if (!verified) return json({ error: "unauthorized" }, 401);