Build a SaaS with subscriptions

const PLANS = {
  monthly: process.env.BACHS_PRO_MONTHLY,
  yearly: process.env.BACHS_PRO_YEARLY,
};

export async function POST(req) {
  const user = await getCurrentUser(req); // your own auth
  const { plan } = await req.json();
  const productId = PLANS[plan];
  if (!productId) return Response.json({ error: "Unknown plan" }, { status: 400 });

  const res = await fetch(`${process.env.BACHS_API_URL}/v1/checkout-sessions`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.BACHS_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      product_cart: [{ product_id: productId, quantity: 1 }],
      customer: user.bachsCustomerId
        ? { customer_id: user.bachsCustomerId }
        : { email: user.email, name: user.name },
      billing_currency: "USD",
      metadata: { user_id: String(user.id) },
      success_url: `${process.env.APP_URL}/billing/success`,
      cancel_url: `${process.env.APP_URL}/pricing`,
    }),
  });
  if (!res.ok) return Response.json({ error: "Could not start checkout" }, { status: 502 });

  const { checkout_url } = await res.json();
  return Response.json({ checkout_url });
}

bachs listen --forward-to localhost:3000/api/webhooks/bachs \
  --events customer.subscription.created,customer.subscription.updated,customer.subscription.deleted,invoice.paid,invoice.payment_failed

import crypto from "node:crypto";

// X-Bachs-Signature-V2 looks like "t=1760000000,v1=abc...,v1=def..."
function verify(header, rawBody, secret, toleranceSeconds = 300) {
  if (!header) return false;
  const parts = header.split(",").map((part) => part.split("="));
  const timestamp = Number(parts.find(([key]) => key === "t")?.[1]);
  if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  // During a secret rotation there is one v1 value per valid secret.
  return parts
    .filter(([key]) => key === "v1")
    .some(([, sig]) =>
      sig.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)),
    );
}

export async function POST(req) {
  const rawBody = await req.text(); // read before parsing JSON
  const signature = req.headers.get("x-bachs-signature-v2");
  if (!verify(signature, rawBody, process.env.BACHS_WEBHOOK_SECRET)) {
    return new Response("Invalid signature", { status: 400 });
  }

  const event = JSON.parse(rawBody);
  if (await alreadyProcessed(event.id)) return new Response("OK"); // your own store

  switch (event.type) {
    case "customer.subscription.created":
    case "customer.subscription.updated":
    case "customer.subscription.deleted": {
      const sub = event.data;
      // Deliveries can arrive out of order: skip an event older than the one you saved.
      const saved = await getSubscription(sub.metadata.user_id); // your own store
      if (saved && Date.parse(saved.updatedAt) > Date.parse(event.created_at)) break;
      await saveSubscription({
        // your own store
        userId: sub.metadata.user_id,
        subscriptionId: sub.subscription_id,
        customerId: sub.customer.customer_id,
        productId: sub.product_id,
        status: sub.status,
        currentPeriodEnd: sub.current_period_end,
        cancelAtPeriodEnd: sub.cancel_at_period_end,
        updatedAt: event.created_at,
      });
      break;
    }
    case "invoice.payment_failed":
      await showUpdateCardBanner(event.data.customer.customer_id); // optional
      break;
  }

  await markProcessed(event.id);
  return new Response("OK");
}

export function hasAccess(subscription) {
  if (!subscription) return false;
  // past_due: a renewal failed and Bachs is retrying. Keeping access
  // during recovery is common; return false here if you prefer.
  return ["trialing", "active", "past_due"].includes(subscription.status);
}

export async function POST(req) {
  const user = await getCurrentUser(req); // your own auth
  const res = await fetch(
    `${process.env.BACHS_API_URL}/v1/customers/${user.bachsCustomerId}/portal-sessions`,
    { method: "POST", headers: { Authorization: `Bearer ${process.env.BACHS_API_KEY}` } },
  );
  if (!res.ok) return Response.json({ error: "Could not open billing" }, { status: 502 });

  const { url } = await res.json();
  return Response.redirect(url, 303);
}