Webhook signature verification

                  module Webhooks
  class StripeController < ApplicationController
    skip_before_action :verify_authenticity_token

    def create
      payload = request.body.read
      sig_header = request.env['HTTP_STRIPE_SIGNATURE']

      begin
        event = Stripe::Webhook.construct_event(
          payload, sig_header, Rails.application.credentials.stripe[:webhook_secret]
        )
      rescue Stripe::SignatureVerificationError => e
        Rails.logger.warn("Webhook signature verification failed: #{e.message}")
        return render json: { error: 'INVALID_SIGNATURE' }, status: :unauthorized
      end

      # Process the verified event
      case event.type
      when 'payment_intent.succeeded'
        ProcessPaymentSuccessWorker.perform_async(event.data.object.id)
      when 'customer.subscription.deleted'
        ProcessSubscriptionCancelledWorker.perform_async(event.data.object.id)
      end

      render json: { received: true }, status: :ok
    end
  end
end