Integrating Stripe in a French SaaS: VAT, Invoices, Webhooks

// src/lib/stripe.ts
import Stripe from "stripe";
 
export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: "2026-02-25.clover",
  typescript: true,
});

// Example of programmatic creation
const product = await stripe.products.create({
  name: "HeartCo Pro",
  tax_code: "txcd_10103001", // SaaS - Software as a Service
});
 
const price = await stripe.prices.create({
  product: product.id,
  unit_amount: 3400, // €34 excl. VAT
  currency: "eur",
  recurring: { interval: "month" },
  tax_behavior: "exclusive", // VAT added on top
});

// src/server/api/routers/billing.ts
export const billingRouter = createTRPCRouter({
  createCheckout: staffProcedure
    .input(z.object({ priceId: z.string() }))
    .mutation(async ({ ctx, input }) => {
      const session = await stripe.checkout.sessions.create({
        customer_email: ctx.session.user.email,
        mode: "subscription",
        line_items: [{ price: input.priceId, quantity: 1 }],
        automatic_tax: { enabled: true },
        tax_id_collection: { enabled: true },
        success_url: `${env.NEXT_PUBLIC_APP_URL}/dashboard/billing?success=true`,
        cancel_url: `${env.NEXT_PUBLIC_APP_URL}/dashboard/billing`,
        metadata: {
          organizationId: ctx.session.user.organizationId,
        },
      });
 
      return { url: session.url };
    }),
});

// src/app/api/stripe/webhook/route.ts
import { headers } from "next/headers";
import crypto from "crypto";
 
export async function POST(req: Request) {
  const body = await req.text();
  const headersList = await headers();
  const signature = headersList.get("stripe-signature")!;
 
  // HMAC verification: MANDATORY
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(
      body,
      signature,
      process.env.STRIPE_WEBHOOK_SECRET!,
    );
  } catch {
    return new Response("Invalid signature", { status: 400 });
  }
 
  switch (event.type) {
    case "checkout.session.completed": {
      const session = event.data.object;
      const orgId = session.metadata?.organizationId;
      if (!orgId) break;
 
      await db.subscription.update({
        where: { organizationId: orgId },
        data: {
          plan: "PRO",
          stripeSubscriptionId: session.subscription as string,
          status: "ACTIVE",
        },
      });
      break;
    }
 
    case "customer.subscription.deleted": {
      // Downgrade to FREE
      const sub = event.data.object;
      await db.subscription.updateMany({
        where: { stripeSubscriptionId: sub.id },
        data: { plan: "FREE", status: "CANCELED" },
      });
      break;
    }
  }
 
  return new Response("OK", { status: 200 });
}

// ❌ VULNERABLE: timing attack
if (computedSignature === receivedSignature) { ... }
 
// ✅ SECURE: constant-time comparison
crypto.timingSafeEqual(
  Buffer.from(computedSignature),
  Buffer.from(receivedSignature),
);

// Strict idempotency: an atomic create, the unique constraint does the work
try {
  await db.stripeWebhookEvent.create({
    data: { stripeEventId: event.id, type: event.type },
  });
} catch (e: unknown) {
  // Prisma unique-constraint violation (P2002) = already processed
  const isDuplicate =
    typeof e === "object" &&
    e !== null &&
    "code" in e &&
    (e as { code: string }).code === "P2002";
  if (isDuplicate) return new Response("OK", { status: 200 });
  throw e;
}