Add shared printful webhook secret for authentication

apps/api/src/server.ts

@@ -322,8 +322,11 @@ export const app = new Elysia()
     )
 
     // WEBHOOKS
-    .post("/webhooks/printful", async ({ body }) => {
+    .post("/webhooks/printful", async ({ body, query }) => {
         // https://webflow.com/integrations/printful
+        const verified = crypto.timingSafeEqual(Buffer.from(query.secret, "hex"), Buffer.from(env.PRINTFUL_WEBHOOK_SECRET, "hex"));
+        if (!verified) throw status(400, "Invalid secret");
+
         const payload = body as Printful.Webhook.EventPayload;
 
         switch (payload.type) {
@@ -360,6 +363,9 @@ export const app = new Elysia()
                 const shipment = payload.data.shipment;
                 log.info({ wOrderId, carrier: shipment.carrier, tracking: shipment.tracking_number }, "printful webhook: package shipped");
 
+                // TODO: possible to have multiple packages shipped
+                // order should NOT be immediately fulfulled in that case
+
                 await s.Commerce.Apparel.Orders.Queue.enqueue({
                     type: "apparel_order_fulfill",
                     source: "printful",
@@ -371,7 +377,7 @@ export const app = new Elysia()
             default:
                 log.warn({ type: (payload as any).type }, "printful webhook: unhandled event type");
         }
-    })
+    }, { query: t.Object({ secret: t.String() }) })
     .post("/webhooks/webflow", async ({ request, body }) => {
         if (!s.Commerce.Webflow.Util.verifyWebflowSignature(request, body))
             throw status(400, "Invalid signature");