# Creem API Key (必需)
CREEM_API_KEY="ck_live_xxxxxxxxxxxxxxxxxx"

# Webhook 签名密钥 (必需,在配置 Webhook 后获取)
CREEM_WEBHOOK_SECRET="whsec_xxxxxxxxxxxxxxxxxx"

# API 基础 URL (可选,默认为 https://api.creem.io)
CREEM_API_BASE="https://api.creem.io"

# 测试模式 (可选,开发环境使用)
CREEM_SIMULATE="true"  # 跳过实际支付,直接成功

# .env.local (开发环境)
CREEM_SIMULATE="true"

# .env (生产环境)
CREEM_SIMULATE="false"  # 或删除此行

# 使用 ngrok
ngrok http 3000

# Webhook URL 示例
https://abc123.ngrok.io/api/payments/creem/webhook

export const subscriptionPlans: Record<PlanKey, SubscriptionPlan> = {
  starter_monthly: {
    key: "starter_monthly",
    kind: "subscription",
    priceCents: 2900,              // $29.00
    currency: "usd",
    creditsPerCycle: 1000,         // 每月 1000 积分
    cycle: "month",
    creemPriceId: "prod_6oSIwPL8m6scklr3fwdkC9", // Creem 产品 ID
    grantSchedule: { mode: "per_cycle" },        // 立即发放
  },
  pro_monthly: {
    key: "pro_monthly",
    kind: "subscription",
    priceCents: 9900,              // $99.00
    currency: "usd",
    creditsPerCycle: 10000,        // 每月 10000 积分
    cycle: "month",
    creemPriceId: "prod_5Xzh9qV5TWeTQtRxjZPEHM",
    grantSchedule: { mode: "per_cycle" },
  },
};

export const subscriptionPlans: Record<PlanKey, SubscriptionPlan> = {
  starter_yearly: {
    key: "starter_yearly",
    kind: "subscription",
    priceCents: 29000,             // $290.00 (年付)
    currency: "usd",
    creditsPerCycle: 12000,        // 全年总共 12000 积分
    cycle: "year",
    creemPriceId: "prod_2V1LbGt2bLmZpKgmASTiCN",
    grantSchedule: {
      mode: "installments",        // 分期发放模式
      grantsPerCycle: 12,          // 分 12 次发放
      intervalMonths: 1,           // 每月发放一次
      creditsPerGrant: 1000,       // 每次发放 1000 积分
      initialGrants: 1,            // 首次立即发放 1 次
    },
  },
  pro_yearly: {
    key: "pro_yearly",
    kind: "subscription",
    priceCents: 99000,             // $990.00 (年付)
    currency: "usd",
    creditsPerCycle: 120000,       // 全年总共 120000 积分
    cycle: "year",
    creemPriceId: "prod_2xyljTJW1IlT8FUDrucU3X",
    grantSchedule: {
      mode: "installments",
      grantsPerCycle: 12,
      intervalMonths: 1,
      creditsPerGrant: 10000,      // 每次发放 10000 积分
      initialGrants: 1,
    },
  },
};

用户购买年付计划
   ↓
立即发放 1000/10000 积分 (第 1 个月)
   ↓
记录到 subscriptionCreditSchedule 表
   ↓
Cron 定时任务每小时检查
   ↓
每月自动发放剩余积分 (共 11 次)

export const oneTimePacks: Record<PackKey, OneTimePack> = {
  pack_200: {
    key: "pack_200",
    kind: "one_time",
    priceCents: 500,               // $5.00
    currency: "usd",
    credits: 200,                  // 200 积分
    creemPriceId: "prod_3SiroZeMbMQidMVFDMUzKy",
  },
};

// constants/billing.ts
export type PackKey = "pack_200" | "pack_500"; // 添加新 Key

export const oneTimePacks: Record<PackKey, OneTimePack> = {
  pack_200: { /* ... */ },
  pack_500: {
    key: "pack_500",
    kind: "one_time",
    priceCents: 2000,              // $20.00
    currency: "usd",
    credits: 500,
    creemPriceId: "prod_YOUR_NEW_PRODUCT_ID",
  },
};

{
  "key": "starter_monthly" | "pro_yearly" | "pack_200",
  "successUrl": "https://yourdomain.com/dashboard?payment=success",
  "cancelUrl": "https://yourdomain.com/pricing?payment=cancelled"
}

{
  "url": "https://checkout.creem.io/xxxxxxxxxxxxx"
}

// components/pricing-card.tsx
"use client";

import { useState } from "react";
import { useSession } from "@/lib/auth-client";

export function PricingCard({ planKey }: { planKey: string }) {
  const session = useSession();
  const [loading, setLoading] = useState(false);

  const handleCheckout = async () => {
    if (!session.data) {
      // 未登录,跳转到登录页
      window.location.href = "/login";
      return;
    }

    setLoading(true);

    try {
      const res = await fetch("/api/payments/creem/checkout", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          key: planKey,
          successUrl: `${window.location.origin}/dashboard?payment=success`,
          cancelUrl: `${window.location.origin}/pricing?payment=cancelled`,
        }),
      });

      const data = await res.json();

      if (data.url) {
        // 重定向到 Creem Checkout 页面
        window.location.href = data.url;
      } else {
        alert(data.error || "Failed to create checkout session");
      }
    } catch (error) {
      console.error("Checkout error:", error);
      alert("Something went wrong");
    } finally {
      setLoading(false);
    }
  };

  return (
    <button onClick={handleCheckout} disabled={loading}>
      {loading ? "Processing..." : "Purchase"}
    </button>
  );
}

export async function createCheckoutSession(params: CreateCheckoutParams): Promise<CreateCheckoutResult> {
  const apiKey = getEnv("CREEM_API_KEY");
  const simulate = process.env.CREEM_SIMULATE === "true";

  if (simulate) {
    // 测试模式:跳过实际支付
    return { url: "/api/payments/creem/redirect-placeholder?success=1" };
  }

  // 创建 Checkout Payload
  const payload = {
    product_id: params.creemPriceId, // Creem 产品 ID
    success_url: params.successUrl,
    metadata: {
      userId: params.userId,         // 用户 ID
      key: params.key,               // 计划标识
      kind: params.kind,             // "subscription" 或 "one_time"
    },
  };

  const base = process.env.CREEM_API_BASE || "https://api.creem.io";
  const endpointUrl = `${base}/v1/checkouts`;

  const res = await fetch(endpointUrl, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": apiKey, // Creem 使用 x-api-key 头
    },
    body: JSON.stringify(payload),
  });

  if (!res.ok) {
    throw new Error(`Creem checkout create failed: ${res.status}`);
  }

  const data = await res.json();
  const redirectUrl = data.checkout_url || data.url;

  return { url: redirectUrl };
}

export async function POST(req: NextRequest) {
  // 1. 读取原始请求体 (用于签名验证)
  const rawBody = await req.text();

  // 2. 验证 Webhook 签名
  const ok = verifyWebhookSignature(req.headers, rawBody);
  if (!ok) {
    return NextResponse.json({ error: "Invalid signature" }, { status: 400 });
  }

  // 3. 解析事件
  const event = JSON.parse(rawBody);
  const type = event.eventType; // "checkout.completed" 等
  const mainObject = event.object || {};
  const metadata = mainObject.metadata || {};

  // 4. 提取关键信息
  const userId = metadata.userId;
  const key = metadata.key;       // 计划标识
  const kind = metadata.kind;     // "subscription" 或 "one_time"
  const paymentId = mainObject.order?.id || event.id;
  const amountCents = mainObject.order?.amount || 0;

  // 5. 幂等性检查 (防止重复处理)
  const existing = await db
    .select()
    .from(paymentTable)
    .where(eq(paymentTable.providerPaymentId, paymentId));

  if (existing.length > 0) {
    return NextResponse.json({ received: true }); // 已处理,跳过
  }

  // 6. 计算积分发放数量
  let creditsToGrant = 0;
  if (kind === "one_time") {
    creditsToGrant = oneTimePacks[key].credits;
  } else if (kind === "subscription") {
    const plan = subscriptionPlans[key];
    const schedule = getGrantSchedule(key);

    if (schedule) {
      // 年付计划:仅发放首次积分
      const initialGrant = computeInitialGrant(schedule);
      creditsToGrant = initialGrant.creditsNow;
    } else {
      // 月付计划:发放全部积分
      creditsToGrant = plan.creditsPerCycle;
    }
  }

  // 7. 插入支付记录
  await db.insert(paymentTable).values({
    id: paymentId,
    provider: "creem",
    providerPaymentId: paymentId,
    userId,
    amountCents,
    currency: "usd",
    status: "succeeded",
    type: kind,
    planKey: kind === "subscription" ? key : undefined,
    creditsGranted: creditsToGrant,
  });

  // 8. 创建或更新订阅记录 (仅订阅类型)
  if (kind === "subscription") {
    await db.insert(subscriptionTable).values({
      id: subscriptionId,
      provider: "creem",
      providerSubId: subscriptionId,
      userId,
      planKey: key,
      status: "active",
      currentPeriodEnd: extractCurrentPeriodEnd(),
    });
  }

  // 9. 发放积分 (事务性操作)
  await db.transaction(async tx => {
    // 增加用户积分
    await tx
      .update(userTable)
      .set({ credits: sql`${userTable.credits} + ${creditsToGrant}` })
      .where(eq(userTable.id, userId));

    // 记录到积分账本
    await tx.insert(creditLedger).values({
      id: paymentId,
      userId,
      delta: creditsToGrant,
      reason: kind === "one_time" ? "one_time_pack" : "subscription_cycle",
      paymentId,
    });

    // 更新用户订阅计划
    if (kind === "subscription") {
      await tx
        .update(userTable)
        .set({ planKey: key })
        .where(eq(userTable.id, userId));
    }

    // 设置积分发放调度 (年付计划)
    if (scheduleResetContext) {
      await resetSubscriptionSchedule({
        subscriptionId,
        userId,
        derivedSchedule: schedule,
        grantsRemaining: initialGrant.grantsRemaining,
        totalCreditsRemaining: initialGrant.totalCreditsRemaining,
        nextGrantAt: initialGrant.nextGrantAt,
      });
    }
  });

  // 10. 发送购买确认邮件
  await sendPurchaseEmail(userEmail, {
    orderId: paymentId,
    plan: key,
    amount: `$${(amountCents / 100).toFixed(2)}`,
    credits: creditsToGrant,
    type: kind,
  });

  return NextResponse.json({ received: true });
}

const existing = await db
  .select()
  .from(paymentTable)
  .where(eq(paymentTable.providerPaymentId, paymentId));

if (existing.length > 0) {
  return NextResponse.json({ received: true }); // 已处理
}

if (kind === "subscription" && subscriptionId) {
  await db.insert(subscriptionTable).values({
    id: subscriptionId,
    provider: "creem",
    providerSubId: subscriptionId,
    userId,
    planKey: key,
    status: "active",
    currentPeriodEnd: extractedDate,
  });
}

CREATE TABLE "subscription_credit_schedule" (
  "subscription_id" TEXT PRIMARY KEY,
  "user_id" TEXT NOT NULL,
  "credits_per_grant" INTEGER NOT NULL,    -- 每次发放的积分数
  "grants_remaining" INTEGER NOT NULL,     -- 剩余发放次数
  "total_credits_remaining" INTEGER NOT NULL, -- 剩余总积分
  "next_grant_at" TIMESTAMP NOT NULL,      -- 下次发放时间
  "created_at" TIMESTAMP DEFAULT NOW(),
  "updated_at" TIMESTAMP DEFAULT NOW()
);

// 计算首次发放
const initialGrant = computeInitialGrant(schedule);

// 立即发放首次积分 (1000 或 10000)
creditsToGrant = initialGrant.creditsNow; // 1000 (Starter) 或 10000 (Pro)

// 创建发放调度记录
await resetSubscriptionSchedule({
  subscriptionId,
  userId,
  derivedSchedule: schedule,
  grantsRemaining: 11,                     // 剩余 11 次
  totalCreditsRemaining: 11000,            // 剩余 11000 积分 (Starter)
  nextGrantAt: new Date("2025-11-15"),     // 30 天后
});

subscriptionId: "sub_xxx"
userId: "user_123"
creditsPerGrant: 1000
grantsRemaining: 11
totalCreditsRemaining: 11000
nextGrantAt: 2025-11-15T00:00:00Z

export async function GET(req: NextRequest) {
  // 1. 验证 Cron 认证
  const authHeader = req.headers.get("authorization");
  const cronSecret = process.env.CRON_SECRET;

  if (authHeader !== `Bearer ${cronSecret}`) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  // 2. 查询到期的发放任务
  const now = new Date();
  const schedules = await db
    .select()
    .from(subscriptionCreditSchedule)
    .where(
      sql`${subscriptionCreditSchedule.nextGrantAt} <= ${now}
          AND ${subscriptionCreditSchedule.grantsRemaining} > 0`
    );

  // 3. 逐个处理
  for (const schedule of schedules) {
    await db.transaction(async tx => {
      // 发放积分
      await tx
        .update(userTable)
        .set({
          credits: sql`${userTable.credits} + ${schedule.creditsPerGrant}`
        })
        .where(eq(userTable.id, schedule.userId));

      // 记录到账本
      await tx.insert(creditLedger).values({
        id: randomUUID(),
        userId: schedule.userId,
        delta: schedule.creditsPerGrant,
        reason: "subscription_cycle",
        paymentId: schedule.subscriptionId,
      });

      // 更新调度记录
      const newGrantsRemaining = schedule.grantsRemaining - 1;
      const newTotalRemaining = schedule.totalCreditsRemaining - schedule.creditsPerGrant;

      if (newGrantsRemaining > 0) {
        // 还有剩余,计算下次发放时间
        const nextGrantAt = new Date(schedule.nextGrantAt);
        nextGrantAt.setMonth(nextGrantAt.getMonth() + 1); // 30 天后

        await tx
          .update(subscriptionCreditSchedule)
          .set({
            grantsRemaining: newGrantsRemaining,
            totalCreditsRemaining: newTotalRemaining,
            nextGrantAt,
            updatedAt: new Date(),
          })
          .where(eq(subscriptionCreditSchedule.subscriptionId, schedule.subscriptionId));
      } else {
        // 全部发放完毕,删除调度记录
        await tx
          .delete(subscriptionCreditSchedule)
          .where(eq(subscriptionCreditSchedule.subscriptionId, schedule.subscriptionId));
      }
    });
  }

  return NextResponse.json({ processed: schedules.length });
}

{
  "crons": [
    {
      "path": "/api/cron/grant-subscription-credits",
      "schedule": "0 * * * *"
    }
  ]
}

# 每小时执行一次
0 * * * * curl -H "Authorization: Bearer YOUR_CRON_SECRET" \
  https://yourdomain.com/api/cron/grant-subscription-credits

CRON_SECRET="your-random-cron-secret-key"

2025-10-15  用户购买 → 立即发放 1000 积分
2025-11-15  定时任务 → 发放 1000 积分 (剩余 10 次)
2025-12-15  定时任务 → 发放 1000 积分 (剩余 9 次)
2026-01-15  定时任务 → 发放 1000 积分 (剩余 8 次)
...
2026-09-15  定时任务 → 发放 1000 积分 (最后一次,删除调度记录)

// Webhook 处理逻辑
if (scheduleResetContext) {
  // 重置发放调度 (重新开始 12 次发放)
  await resetSubscriptionSchedule({
    subscriptionId,
    userId,
    derivedSchedule: schedule,
    grantsRemaining: 11,
    totalCreditsRemaining: 11000,
    nextGrantAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
  });
}

export function verifyWebhookSignature(headers: Headers, rawBody: string): boolean {
  // 获取签名头
  const signature = headers.get("creem-signature") || headers.get("x-creem-signature");
  if (!signature) {
    return false;
  }

  const webhookSecret = process.env.CREEM_WEBHOOK_SECRET;
  if (!webhookSecret) {
    return false;
  }

  // 计算预期签名
  const computedSignature = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawBody)
    .digest("hex");

  // 时序安全比较 (防止时序攻击)
  const sigBuf = Buffer.from(signature);
  const compBuf = Buffer.from(computedSignature);

  if (sigBuf.length !== compBuf.length) {
    return false;
  }

  return crypto.timingSafeEqual(sigBuf, compBuf);
}

Creem 发送 Webhook
   ↓
计算 HMAC-SHA256(rawBody, CREEM_WEBHOOK_SECRET)
   ↓
在 creem-signature 头中附带签名
   ↓
我们的服务器重新计算签名
   ↓
比较两个签名 (timing-safe)
   ↓
验证通过 → 处理事件
验证失败 → 返回 400 错误

const existing = await db
  .select()
  .from(paymentTable)
  .where(eq(paymentTable.providerPaymentId, paymentId));

if (existing.length > 0) {
  // 已处理,直接返回成功
  return NextResponse.json({ received: true });
}

await db.transaction(async tx => {
  // 1. 增加积分
  await tx.update(userTable).set({ credits: sql`...` });

  // 2. 记录账本
  await tx.insert(creditLedger).values({ ... });

  // 3. 更新订阅
  await tx.update(userTable).set({ planKey: key });

  // 4. 设置发放调度
  await resetSubscriptionSchedule(...);
});

const userId = metadata?.userId;
const key = metadata?.key;
const kind = metadata?.kind;

if (!userId || !key || !kind) {
  return NextResponse.json({ error: "Missing metadata" }, { status: 400 });
}

const authHeader = req.headers.get("authorization");
const cronSecret = process.env.CRON_SECRET;

if (authHeader !== `Bearer ${cronSecret}`) {
  return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
}

# .env.local
CREEM_SIMULATE="true"

# test-webhook.sh
#!/bin/bash

WEBHOOK_URL="http://localhost:3000/api/payments/creem/webhook"
WEBHOOK_SECRET="whsec_test_secret"

PAYLOAD='{
  "id": "evt_test_123",
  "eventType": "checkout.completed",
  "object": {
    "id": "checkout_test_123",
    "metadata": {
      "userId": "user_test_123",
      "key": "starter_monthly",
      "kind": "subscription"
    },
    "order": {
      "id": "order_test_123",
      "amount": 2900,
      "currency": "USD",
      "subscription_id": "sub_test_123"
    }
  }
}'

SIGNATURE=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | sed 's/^.* //')

curl -X POST "$WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -H "creem-signature: $SIGNATURE" \
  -d "$PAYLOAD"

// 确保读取原始请求体
const rawBody = await req.text();

// 不要使用 req.json(),会丢失原始字节

grantSchedule: {
  mode: "installments",
  grantsPerCycle: 12,
  intervalMonths: 0.001, // 约 43 秒 (仅用于测试!)
  creditsPerGrant: 1000,
  initialGrants: 1,
}

curl -H "Authorization: Bearer YOUR_CRON_SECRET" \
  http://localhost:3000/api/cron/grant-subscription-credits

import { db } from "@/lib/db";
import { payment } from "@/lib/db/schema";
import { eq, desc } from "drizzle-orm";

// 查询用户的所有支付记录
const payments = await db
  .select()
  .from(payment)
  .where(eq(payment.userId, userId))
  .orderBy(desc(payment.createdAt));

import { deductCredits } from "@/lib/credits";

await deductCredits(userId, 1000, "refund", paymentId);

import { db } from "@/lib/db";
import { subscription } from "@/lib/db/schema";
import { eq } from "drizzle-orm";

await db
  .update(subscription)
  .set({ status: "cancelled" })
  .where(eq(subscription.id, subscriptionId));

const ledger = await db
  .select()
  .from(creditLedger)
  .where(eq(creditLedger.paymentId, paymentId));

if (ledger.length === 0) {
  // 未记录,需要手动补发
  await refundCredits(userId, amount, "subscription_cycle", paymentId);
}

// 添加日志记录
console.log(`[Creem Webhook] Processed ${type} for user ${userId}`);

// 检查积分账本总和是否匹配用户余额
const ledgerSum = await db
  .select({ total: sql`SUM(delta)` })
  .from(creditLedger)
  .where(eq(creditLedger.userId, userId));

const userCredits = await getUserCredits(userId);

if (ledgerSum[0].total !== userCredits) {
  // 数据不一致,需要修复
}

// app/[locale]/dashboard/page.tsx
const searchParams = useSearchParams();
const paymentSuccess = searchParams.get("payment") === "success";

if (paymentSuccess) {
  return (
    <div className="bg-green-50 p-4 rounded">
      <h2>Payment Successful!</h2>
      <p>Your credits have been added to your account.</p>
    </div>
  );
}