+
+
+ GitHub Marketplace
+
+ docs ↗
+
+
+
+ {loading ? "Loading..." : "Refresh"}
+
+
+ {error}
+
+ )}
+
+
+ Paste this as the Payload URL on the listing's Webhook page. Content type{" "}
+ application/json, and set a Secret.
+
+
+
+
+ {webhookUrl}
+
+
+ {copied ? "Copied" : "Copy"}
+
+
+
+
+
+
+ {data?.configured ? "●" : "○"}
+
+
+ {data?.configured
+ ? "Secret configured (GITHUB_MARKETPLACE_WEBHOOK_SECRET)"
+ : "No secret set. Deliveries are rejected with 503 until GITHUB_MARKETPLACE_WEBHOOK_SECRET is set on the service."}
+
+
+ {data && !data.migrationApplied && (
+
+ ○
+
+ Tables missing. Apply{" "}
+
+ supabase/migrations/20260821170000_github_marketplace.sql
+
+ .
+
+
+ )}
+
+ Subscriptions{" "}
+
+ ({active} active of {subs.length})
+
+
+
+ {subs.length === 0 ? (
+
+ No purchases recorded yet. GitHub does not resend failed deliveries, so if a customer
+ reports a purchase that is missing here, replay it from the listing's delivery log.
+
+ ) : (
+
+
+
+
+ Account
+ Plan
+ Cycle
+ Units
+ Status
+ Next billing
+
+
+
+ {subs.map((s) => (
+
+
+
+ {s.github_account_login}
+
+
+ {s.github_account_type === "Organization" ? "org" : "user"}
+
+
+
+ {s.plan_name ?? "—"}
+
+ {fmtPrice(s.plan_monthly_price_cents)}
+
+ {s.pending_plan_name && (
+
+ → {s.pending_plan_name} on {fmtDate(s.pending_effective_date)}
+
+ )}
+
+ {s.billing_cycle ?? "—"}
+ {s.unit_count ?? "—"}
+
+
+ {s.status}
+
+ {s.on_free_trial && (
+
+ trial → {fmtDate(s.free_trial_ends_on)}
+
+ )}
+
+ {fmtDate(s.next_billing_date)}
+
+ ))}
+
+
+
Recent deliveries
+ {events.length === 0 ? (
+ Nothing delivered yet.
+ ) : (
+
+ {events.map((e) => (
+
+
+ {e.applied ? "✓" : "·"}
+
+ {e.action}
+ {e.github_account_login ?? "unknown"}
+
+ {new Date(e.received_at).toISOString().replace("T", " ").slice(0, 16)}
+
+ {e.skip_reason && (
+ skipped: {e.skip_reason}
+ )}
+
+ ))}
+
+ )}
+
+ );
+}
diff --git a/apps/web/src/app/api/admin/marketplace/route.ts b/apps/web/src/app/api/admin/marketplace/route.ts
new file mode 100644
index 0000000..46b53ed
--- /dev/null
+++ b/apps/web/src/app/api/admin/marketplace/route.ts
@@ -0,0 +1,65 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdmin } from "@/lib/admin-guard";
+import { getSupabaseAdmin } from "@/lib/supabase";
+
+export const runtime = "nodejs";
+
+/**
+ * Admin view of the GitHub Marketplace listing's webhook.
+ *
+ * Reports whether the secret is configured, the current subscription per
+ * GitHub account, and the most recent deliveries. GitHub does not resend
+ * failed deliveries, so the delivery list is the thing to look at when a
+ * customer says they paid and nothing happened.
+ *
+ * The secret itself is never returned, only whether one is set.
+ */
+export async function GET(req: NextRequest) {
+ const guard = await requireAdmin(req);
+ if (guard instanceof NextResponse) return guard;
+
+ const supabase = getSupabaseAdmin();
+
+ const [subs, events] = await Promise.all([
+ supabase
+ .from("github_marketplace_purchases")
+ .select(
+ "id, github_account_id, github_account_login, github_account_type, plan_id, plan_name, plan_monthly_price_cents, billing_cycle, unit_count, on_free_trial, free_trial_ends_on, next_billing_date, status, pending_plan_name, pending_effective_date, effective_date, last_action, updated_at",
+ )
+ .order("updated_at", { ascending: false })
+ .limit(200),
+ supabase
+ .from("github_marketplace_events")
+ .select(
+ "id, delivery_id, action, github_account_login, effective_date, applied, skip_reason, received_at",
+ )
+ .order("received_at", { ascending: false })
+ .limit(50),
+ ]);
+
+ // A missing table is the expected state until the migration is applied
+ // by hand, so say that plainly instead of returning a bare 500.
+ const missingTable =
+ subs.error?.code === "42P01" || events.error?.code === "42P01";
+ if (missingTable) {
+ return NextResponse.json({
+ configured: Boolean(process.env.GITHUB_MARKETPLACE_WEBHOOK_SECRET),
+ webhookPath: "/api/webhooks/github/marketplace",
+ migrationApplied: false,
+ subscriptions: [],
+ events: [],
+ });
+ }
+
+ if (subs.error || events.error) {
+ return NextResponse.json({ error: "Failed to load marketplace data" }, { status: 500 });
+ }
+
+ return NextResponse.json({
+ configured: Boolean(process.env.GITHUB_MARKETPLACE_WEBHOOK_SECRET),
+ webhookPath: "/api/webhooks/github/marketplace",
+ migrationApplied: true,
+ subscriptions: subs.data ?? [],
+ events: events.data ?? [],
+ });
+}
diff --git a/apps/web/src/app/api/webhooks/github/__tests__/marketplace-route.test.ts b/apps/web/src/app/api/webhooks/github/__tests__/marketplace-route.test.ts
new file mode 100644
index 0000000..abfc6ba
--- /dev/null
+++ b/apps/web/src/app/api/webhooks/github/__tests__/marketplace-route.test.ts
@@ -0,0 +1,215 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from "vitest";
+import { createHmac } from "node:crypto";
+
+const originalEnv = { ...process.env };
+
+const SECRET = "test-marketplace-secret";
+
+/**
+ * In-memory stand-in for the two tables. `state` is reset per test so the
+ * dedupe and out-of-order cases can set up their own starting point.
+ */
+const state = {
+ existingPurchase: null as { id: string; effective_date: string | null } | null,
+ eventInsertReturns: [{ id: "event-1" }] as { id: string }[],
+ upsertedPurchases: [] as Record