Shopify Webhook の重複処理を完全に防ぐ — 冪等性キーと DynamoDB による実装

import { DynamoDBClient, PutItemCommand, ConditionalCheckFailedException } from "@aws-sdk/client-dynamodb"
 
const ddb = new DynamoDBClient({})
 
async function isFirstDelivery(webhookId: string): Promise<boolean> {
  const ttl = Math.floor(Date.now() / 1000) + 7 * 24 * 60 * 60 // 7日後に自動削除
 
  try {
    await ddb.send(new PutItemCommand({
      TableName: "webhook-idempotency",
      Item: {
        pk: { S: `webhook:${webhookId}` },
        ttl: { N: String(ttl) },
        receivedAt: { S: new Date().toISOString() },
      },
      ConditionExpression: "attribute_not_exists(pk)",
    }))
    return true // 初回
  } catch (error) {
    if (error instanceof ConditionalCheckFailedException) {
      return false // 重複
    }
    throw error
  }
}

// app/api/webhooks/shopify/orders-create/route.ts
import { headers } from "next/headers"
import crypto from "crypto"
 
export async function POST(request: Request) {
  const body = await request.text()
  const headersList = headers()
 
  // 1. HMAC 署名検証
  const hmac = headersList.get("x-shopify-hmac-sha256")
  const expected = crypto
    .createHmac("sha256", process.env.SHOPIFY_WEBHOOK_SECRET!)
    .update(body)
    .digest("base64")
 
  if (hmac !== expected) {
    return new Response("Unauthorized", { status: 401 })
  }
 
  // 2. 冪等性チェック
  const webhookId = headersList.get("x-shopify-webhook-id")!
  const isFirst = await isFirstDelivery(webhookId)
 
  if (!isFirst) {
    console.log(`Duplicate webhook skipped: ${webhookId}`)
    return new Response("OK", { status: 200 }) // 200 を返してリトライを止める
  }
 
  // 3. ビジネスロジック
  const order = JSON.parse(body)
  await processNewOrder(order)
 
  return new Response("OK", { status: 200 })
}