Receive webhooks

// Express. `db` and `queue` stand in for your own storage and job runner.
app.post("/webhooks/cardzone", express.json(), async (req, res) => {
  const { event, event_id: eventId, order } = req.body ?? {};
  if (!event?.startsWith("b2b.order.")) return res.sendStatus(200); // not an event this receiver handles
  if (!eventId || !order?.order_id) return res.sendStatus(400);

  const isNew = await db.insertIgnore("cardzone_events", { event_id: eventId });
  if (isNew) await queue.add("cardzone-order-sync", { orderId: order.order_id, eventId });
  res.sendStatus(200);
});

// The job: re-fetch, then apply only newer sequences.
async function syncOrder({ orderId, eventId }) {
  const sequence = Number(eventId.split(":")[2] ?? 0);
  if (sequence && sequence < (await db.highestSequence(orderId))) return;

  const order = await cardzone("GET", `/orders/${orderId}`);
  await db.saveOrder(order, sequence);
  if (order.status === "fulfilled") await deliverCodes(order);
}

# Flask
@app.post("/webhooks/cardzone")
def cardzone_webhook():
    payload = request.get_json(silent=True) or {}
    if not str(payload.get("event", "")).startswith("b2b.order."):
        return "", 200  # not an event this receiver handles
    event_id = payload.get("event_id")
    order_id = (payload.get("order") or {}).get("order_id")
    if not event_id or not order_id:
        return "", 400

    if db.insert_ignore("cardzone_events", event_id=event_id):
        queue.enqueue(sync_order, order_id, event_id)
    return "", 200


def sync_order(order_id, event_id):
    parts = event_id.split(":")
    sequence = int(parts[2]) if len(parts) > 2 else 0
    if sequence and sequence < db.highest_sequence(order_id):
        return

    order = cardzone("GET", f"/orders/{order_id}")
    db.save_order(order, sequence)
    if order["status"] == "fulfilled":
        deliver_codes(order)

# app/controllers/cardzone_webhooks_controller.rb
class CardzoneWebhooksController < ActionController::API
  def create
    return head :ok unless params[:event].to_s.start_with?("b2b.order.") # not an event this receiver handles

    event_id = params.require(:event_id)
    order_id = params.require(:order).require(:order_id)

    # cardzone_events.event_id has a unique index.
    CardzoneEvent.create!(event_id:)
    CardzoneOrderSyncJob.perform_later(order_id, event_id)
    head :ok
  rescue ActiveRecord::RecordNotUnique
    head :ok # duplicate delivery: already queued
  end
end

class CardzoneOrderSyncJob < ApplicationJob
  def perform(order_id, event_id)
    sequence = event_id.split(":")[2].to_i
    return if sequence.positive? && sequence < CardzoneOrder.highest_sequence(order_id)

    order = Cardzone.get("/orders/#{order_id}")
    CardzoneOrder.apply!(order, sequence:)
    DeliverCodesJob.perform_later(order_id) if order["status"] == "fulfilled"
  end
end