Stripe Checkout + Signbee: Trigger Contract Signing After Payment (2026)

import { NextResponse } from "next/server";
import Stripe from "stripe";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: "2025-02-24.acacia",
});

export async function POST(req: Request) {
  const { priceId, seats, customerEmail, planTier } = await req.json();

  const session = await stripe.checkout.sessions.create({
    mode: "subscription",
    customer_email: customerEmail,
    billing_address_collection: "required",
    tax_id_collection: { enabled: true },
    line_items: [
      {
        price: priceId,
        quantity: seats,
      },
    ],
    // Collect legal entity & signatory title directly on Stripe Checkout
    custom_fields: [
      {
        key: "legal_company_name",
        label: { type: "custom", custom: "Registered Legal Entity Name" },
        type: "text",
        optional: false,
      },
      {
        key: "signatory_title",
        label: { type: "custom", custom: "Signatory Job Title (e.g. VP Engineering)" },
        type: "text",
        optional: false,
      },
    ],
    metadata: {
      contract_template: "b2b_enterprise_msa_v2026",
      sla_uptime_target: planTier === "enterprise" ? "99.99%" : "99.9%",
      governing_law: "State of Delaware, USA",
      payment_terms: "Annual Pre-Paid via Stripe",
    },
    // Redirect customer to an onboarding status page that surfaces the signing link
    success_url: `${process.env.NEXT_PUBLIC_APP_URL}/onboarding/contract?session_id={CHECKOUT_SESSION_ID}`,
    cancel_url: `${process.env.NEXT_PUBLIC_APP_URL}/pricing`,
  });

  return NextResponse.json({ url: session.url });
}

import { NextResponse } from "next/server";
import Stripe from "stripe";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: "2025-02-24.acacia",
});

export async function POST(req: Request) {
  const rawBody = await req.text();
  const signature = req.headers.get("stripe-signature");

  if (!signature) {
    return NextResponse.json({ error: "Missing stripe-signature" }, { status: 400 });
  }

  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(
      rawBody,
      signature,
      process.env.STRIPE_WEBHOOK_SECRET!
    );
  } catch (err) {
    const message = err instanceof Error ? err.message : "Invalid signature";
    return NextResponse.json({ error: `Webhook Error: ${message}` }, { status: 400 });
  }

  if (event.type === "checkout.session.completed") {
    const rawSession = event.data.object as Stripe.Checkout.Session;

    // 1. Expand line items, customer, and subscription for full commercial context
    const session = await stripe.checkout.sessions.retrieve(rawSession.id, {
      expand: ["line_items.data.price.product", "customer", "subscription"],
    });

    // 2. Guard against duplicate webhook deliveries (idempotency check)
    const subscription = session.subscription as Stripe.Subscription | null;
    if (subscription?.metadata?.signbee_document_id) {
      return NextResponse.json({
        received: true,
        status: "already_dispatched",
        document_id: subscription.metadata.signbee_document_id,
      });
    }

    // 3. Extract customer legal details & custom Checkout fields
    const legalEntityField = session.custom_fields?.find(
      (f) => f.key === "legal_company_name"
    );
    const titleField = session.custom_fields?.find(
      (f) => f.key === "signatory_title"
    );

    const companyName =
      legalEntityField?.text?.value ||
      session.customer_details?.name ||
      "Client Organization";
    const signatoryTitle = titleField?.text?.value || "Authorized Representative";
    const recipientName = session.customer_details?.name || companyName;
    const recipientEmail = session.customer_details?.email;

    if (!recipientEmail) {
      return NextResponse.json({ error: "No customer email on session" }, { status: 422 });
    }

    // 4. Build dynamic CommonMark Order Schedule table from Stripe line items
    const currency = (session.currency || "usd").toUpperCase();
    const lineItemRows = (session.line_items?.data || [])
      .map((item) => {
        const unitAmount = ((item.price?.unit_amount || 0) / 100).toFixed(2);
        const subtotal = ((item.amount_total || 0) / 100).toFixed(2);
        const interval = item.price?.recurring?.interval || "one-time";
        return `| ${item.description} | ${item.quantity} | ${currency} ${unitAmount} (${interval}) | ${currency} ${subtotal} |`;
      })
      .join("\n");

    const totalPaid = ((session.amount_total || 0) / 100).toFixed(2);
    const effectiveDate = new Date().toISOString().split("T")[0];
    const slaTarget = session.metadata?.sla_uptime_target || "99.9%";
    const governingLaw = session.metadata?.governing_law || "State of Delaware, USA";

    const contractMarkdown = `# Master SaaS Subscription & Order Form

**Effective Date:** ${effectiveDate}  
**Stripe Payment Reference:** ${session.id}  
**Provider:** Acme Cloud Infrastructure Inc. ("Provider")  
**Customer Legal Entity:** ${companyName} ("Customer")  
**Authorized Signatory:** ${recipientName}, ${signatoryTitle} (${recipientEmail})

---

## 1. Commercial Order Schedule

Customer has remitted payment via Stripe Checkout for the following subscription licenses and implementation services:

| Description / SKU | Quantity | Unit Rate & Billing Cycle | Total Paid |
|---|---|---|---|
${lineItemRows}
| **Total Settled at Checkout** | — | — | **${currency} ${totalPaid}** |

## 2. Service Level Agreement & Uptime Commitment

Provider guarantees a Monthly Uptime Percentage of at least **${slaTarget}** across all production API endpoints. If Provider falls below this threshold in any calendar month, Customer shall be eligible for service credits equal to 10% of the monthly pro-rata subscription fee for each 30 minutes of unscheduled downtime.

## 3. Data Processing, Confidentiality & Intellectual Property

1. **Customer Data Ownership:** Customer retains all right, title, and interest in and to all data transmitted through the platform.
2. **Subprocessors & Security:** Provider maintains SOC 2 Type II controls and encrypts all customer payloads at rest (AES-256) and in transit (TLS 1.3).
3. **No-Chargeback Covenant:** Customer acknowledges that the above commercial schedule matches the authorized Stripe transaction (${session.payment_intent || session.id}) and agrees that any billing dispute shall be resolved under Section 4 prior to initiating a card network dispute.

## 4. Term, Renewal & Governing Law

This Agreement commences on **${effectiveDate}** and renews automatically according to the billing interval specified in Section 1 unless canceled with at least thirty (30) days written notice. This Agreement is governed by the laws of the **${governingLaw}**.`;

    // 5. Dispatch to Signbee REST API (Party A auto-signed via Bearer token)
    const signbeeRes = await fetch("https://signb.ee/api/v1/send", {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        title: `MSA & Order Form — ${companyName} (${effectiveDate})`,
        markdown: contractMarkdown,
        sender_name: "Michael Beckett, CEO — Acme Cloud Infrastructure Inc.",
        sender_email: "contracts@acmecloud.io",
        recipient_name: `${recipientName} (${signatoryTitle})`,
        recipient_email: recipientEmail,
        expires_in_days: 14,
        webhook_url: `${process.env.NEXT_PUBLIC_APP_URL}/api/webhooks/signbee`,
      }),
    });

    if (!signbeeRes.ok) {
      const errText = await signbeeRes.text();
      throw new Error(`Signbee dispatch failed: ${errText}`);
    }

    const signbeeData = await signbeeRes.json();

    // 6. Persist Signbee document_id and signing_url back onto Stripe metadata
    if (subscription) {
      await stripe.subscriptions.update(subscription.id, {
        metadata: {
          ...subscription.metadata,
          signbee_document_id: signbeeData.document_id,
          signbee_signing_url: signbeeData.signing_url || "",
          contract_status: "awaiting_counterparty_signature",
        },
      });
    }

    if (typeof session.customer === "object" && session.customer && !session.customer.deleted) {
      await stripe.customers.update(session.customer.id, {
        metadata: {
          latest_signbee_document_id: signbeeData.document_id,
          legal_company_name: companyName,
        },
      });
    }
  }

  return NextResponse.json({ received: true });
}

import Stripe from "stripe";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: "2025-02-24.acacia",
});

export async function attachSignbeeCertificateToDispute(dispute: Stripe.Dispute) {
  // 1. Retrieve the charge & customer metadata to locate the Signbee document_id
  const chargeId = typeof dispute.charge === "string" ? dispute.charge : dispute.charge.id;
  const charge = await stripe.charges.retrieve(chargeId, { expand: ["customer"] });
  const customer = charge.customer as Stripe.Customer | null;

  const documentId =
    charge.metadata?.signbee_document_id ||
    customer?.metadata?.latest_signbee_document_id;

  if (!documentId) {
    console.warn(`No Signbee document found for disputed charge ${chargeId}`);
    return;
  }

  // 2. Fetch document metadata & signed PDF bytes from Signbee REST API
  const docRes = await fetch(`https://signb.ee/api/v1/documents/${documentId}`, {
    headers: { Authorization: `Bearer ${process.env.SIGNBEE_API_KEY}` },
  });
  const docMeta = await docRes.json();

  if (docMeta.status !== "signed" || !docMeta.signed_pdf_url) {
    console.warn(`Document ${documentId} is not yet signed (status: ${docMeta.status})`);
    return;
  }

  const pdfResponse = await fetch(docMeta.signed_pdf_url);
  const pdfBuffer = Buffer.from(await pdfResponse.arrayBuffer());

  // 3. Upload the cryptographically sealed PDF to Stripe Files API
  const stripeFile = await stripe.files.create({
    purpose: "dispute_evidence",
    file: {
      data: pdfBuffer,
      name: `signed-contract-${documentId}.pdf`,
      type: "application/pdf",
    },
  });

  // 4. Attach file ID and SHA-256 audit metadata directly to the Stripe Dispute
  await stripe.disputes.update(dispute.id, {
    evidence: {
      customer_signature: stripeFile.id,
      service_documentation: stripeFile.id,
      customer_Email_address: docMeta.recipient_email,
      customer_name: docMeta.recipient_name,
      uncategorized_text: `Customer executed binding Master Services Agreement (Signbee ID: ${documentId}) on ${docMeta.signed_at} from IP ${docMeta.signer_ip}. Cryptographic SHA-256 Certificate Hash: ${docMeta.sha256_hash}. Public verification URL: https://signb.ee/verify/${documentId}`,
    },
    submit: false, // Stage evidence for final review or set true for auto-submission
  });
}