Auto-Publish SEOPilot Articles by Committing to Your Git Repo

{
  "event": "article.generated",
  "delivery_id": "d3f1c2a0-5b6e-4a7c-8d9e-0f1a2b3c4d5e",
  "created_at": "2026-06-01T09:00:00.000Z",
  "data": {
    "site": {
      "id": "8d3482e5-0874-41e1-90b7-43f3fffbac05",
      "url": "https://yoursite.com",
      "name": "Your Site"
    },
    "article": {
      "id": "a1b2c3d4-0000-0000-0000-000000000000",
      "title": "How to Choose a CRM for a Solo Realtor",
      "slug": "crm-for-solo-realtors",
      "meta_title": "How to Choose a CRM for a Solo Realtor",
      "meta_description": "A practical guide to picking the right CRM...",
      "body_md": "# How to Choose a CRM...",
      "internal_links": [
        { "slug": "best-crm-features", "anchor": "CRM features that matter" }
      ],
      "generated_at": "2026-06-01T09:00:00.000Z",
      "hero_image": {
        "url": "https://images.example.com/hero.jpg",
        "alt": "A realtor reviewing leads on a laptop",
        "photographer": { "name": "Jane Doe", "url": "https://unsplash.com/@janedoe" },
        "source_url": "https://unsplash.com/photos/abc123"
      }
    },
    "keyword": {
      "id": "f0e1d2c3-0000-0000-0000-000000000001",
      "keyword": "crm for solo realtors"
    }
  }
}

import crypto from "node:crypto";
import matter from "gray-matter";

const TOLERANCE_SECONDS = 5 * 60;

// Verify the X-SEOPilot-Signature header ("t=<ts>,v1=<hmac>") over the RAW body.
export function verifySignature(
  rawBody: string,
  header: string | null,
  secret: string,
  nowMs: number = Date.now()
): boolean {
  if (!header || !secret) return false;

  const parts: Record<string, string> = {};
  for (const seg of header.split(",")) {
    const [k, v] = seg.split("=");
    if (k && v) parts[k.trim()] = v.trim();
  }
  const { t: timestamp, v1: provided } = parts;
  if (!timestamp || !provided) return false;

  const ts = Number(timestamp);
  if (!Number.isFinite(ts)) return false;
  if (Math.abs(nowMs / 1000 - ts) > TOLERANCE_SECONDS) return false; // replay guard

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(provided, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Only allow safe slugs — the slug becomes a file path.
export function sanitizeSlug(slug: unknown): string | null {
  if (typeof slug !== "string") return null;
  const s = slug.trim();
  if (!s || s.length > 200 || !/^[a-z0-9-]+$/.test(s)) return null;
  return s;
}

// Fenced code blocks and inline code spans render literally in MDX, so leave
// them untouched. Everything else is prose, where "<", "{", "}" and a leading
// import/export would be parsed as JSX/expressions and break the build.
const CODE_SEGMENT = /(```[\s\S]*?```|`[^`\n]*`)/g;

export function sanitizeMdxBody(body: string): string {
  return body
    .split(CODE_SEGMENT)
    .map((segment, i) =>
      // Odd indices are the captured code segments — preserve verbatim.
      i % 2 === 1
        ? segment
        : segment
            .replace(/[{}<]/g, (ch) => `\\${ch}`)
            .replace(/^(\s*)(import|export)\b/gm, "$1\\$2")
    )
    .join("");
}

// Map the webhook payload to an MDX file (frontmatter + body).
export function toMdx(article: any, keyword: string | undefined): string {
  const hero = article.hero_image;
  const frontmatter: Record<string, unknown> = {
    title: article.title,
    description: article.meta_description,
    date: new Date(article.generated_at).toISOString().slice(0, 10),
    ...(keyword ? { keyword } : {}),
    ...(hero?.url && hero?.alt
      ? {
          image: {
            url: hero.url,
            alt: hero.alt,
            ...(hero.photographer?.name ? { photographer: hero.photographer.name } : {}),
            ...(hero.photographer?.url ? { photographer_url: hero.photographer.url } : {}),
            ...(hero.source_url ? { source_url: hero.source_url } : {}),
          },
        }
      : {}),
  };
  return matter.stringify(sanitizeMdxBody(article.body_md), frontmatter);
}

import { NextResponse } from "next/server";
import { verifySignature, sanitizeSlug, toMdx } from "@/lib/seopilot";

const GITHUB_API = "https://api.github.com";

async function commitFile(filePath: string, content: string, message: string) {
  const repo = process.env.GITHUB_REPO!;       // "owner/name"
  const branch = process.env.GITHUB_BRANCH!;   // e.g. "main"
  const headers = {
    Authorization: `Bearer ${process.env.GITHUB_TOKEN!}`,
    Accept: "application/vnd.github+json",
    "X-GitHub-Api-Version": "2022-11-28",
  };

  // Look up the existing file to get its SHA (needed to update) and skip no-op writes.
  const getRes = await fetch(
    `${GITHUB_API}/repos/${repo}/contents/${filePath}?ref=${branch}`,
    { headers }
  );
  let sha: string | undefined;
  if (getRes.ok) {
    const existing = await getRes.json();
    const current = Buffer.from(existing.content, "base64").toString("utf8");
    if (current === content) return "skipped";
    sha = existing.sha;
  }

  const putRes = await fetch(`${GITHUB_API}/repos/${repo}/contents/${filePath}`, {
    method: "PUT",
    headers: { ...headers, "Content-Type": "application/json" },
    body: JSON.stringify({
      message,
      branch,
      content: Buffer.from(content, "utf8").toString("base64"),
      ...(sha ? { sha } : {}),
    }),
  });
  if (!putRes.ok) throw new Error(`GitHub PUT failed: ${putRes.status}`);
  return sha ? "updated" : "created";
}

export async function POST(request: Request) {
  const secret = process.env.SEOPILOT_WEBHOOK_SECRET;
  if (!secret) return NextResponse.json({ error: "Not configured" }, { status: 500 });

  // Read the RAW body and verify BEFORE parsing.
  const rawBody = await request.text();
  const signature = request.headers.get("x-seopilot-signature");
  if (!verifySignature(rawBody, signature, secret)) {
    return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  if (payload.event !== "article.generated" || !payload.data?.article) {
    return NextResponse.json({ error: "Unsupported event" }, { status: 400 });
  }

  const article = payload.data.article;
  const slug = sanitizeSlug(article.slug);
  if (!slug) return NextResponse.json({ error: "Invalid slug" }, { status: 400 });

  try {
    const action = await commitFile(
      `content/blog/${slug}.mdx`,
      toMdx(article, payload.data.keyword?.keyword),
      `content: publish "${article.title}" via SEOPilot`
    );
    return NextResponse.json({ ok: true, action, slug });
  } catch (err) {
    console.error("SEOPilot publish failed:", err);
    // Return 5xx so SEOPilot retries.
    return NextResponse.json({ error: "Publish failed" }, { status: 500 });
  }
}