وب‌هوک و idempotency

// Idempotency lives in the WHERE clause, not in application logic.
export async function confirmPayment(authority: string, refId: string) {
  const { count } = await db.payments.updateMany({
    where: {
      authority,
      state: { in: ['pending', 'expired'] }, // already 'paid' matches nothing
    },
    data: { state: 'paid', refId, settledAt: new Date() },
  });

  if (count === 0) return false; // a duplicate; the first call already won

  // Only the transition that actually changed the row may fulfil the order.
  await fulfilOrderFor(authority);
  return true;
}

// And a uniqueness constraint is still the backstop:
//   UNIQUE (authority)
//   UNIQUE (refId)

// 200 on success even when this is a duplicate, so the payer's browser
// stops retrying. Use 4xx/5xx only to signal a real, actionable fault.
return new Response(renderResultPage({ ok: result.isSuccessful, ref: result.transactionId }), {
  status: result.isSuccessful ? 200 : 400,
  headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' },
});