HubSpot & Intercom

Copyexport const hubSpotOAuthProvider = new HubSpotOAuthProvider({
  name: "HubSpot",
  clientId: process.env.HUBSPOT_CLIENT_ID!,
  clientSecret: process.env.HUBSPOT_CLIENT_SECRET!,
  authUrl: "https://app.hubspot.com/oauth/authorize",
  tokenUrl: "https://api.hubapi.com/oauth/v1/token",
  redirectUri: `${APP_DOMAIN_WITH_NGROK}/api/hubspot/callback`,
  redisStatePrefix: "hubspot:oauth:state",
  scopes: [
    "oauth",
    "crm.objects.contacts.read",
    "crm.objects.contacts.write",
    "crm.objects.deals.read",
    "crm.schemas.contacts.write",
  ].join(" "),
  tokenSchema: hubSpotAuthTokenSchema,
  bodyFormat: "form",
  authorizationMethod: "body",
});

Copy  isTokenValid(token: HubSpotAuthToken) {
    if (!token.created_at) {
      return false;
    }
 
    const buffer = 60 * 1000; // refresh 1 min early
    const expiresAt = token.created_at + token.expires_in * 1000;
 
    return Date.now() < expiresAt - buffer;
  }

Copyexport const POST = withAxiom(async (req) => {
  try {
    const rawBody = await req.text();
    const signature = req.headers.get("X-HubSpot-Signature");
 
    // Verify webhook signature
    if (!signature) {
      throw new DubApiError({
        code: "bad_request",
        message: "Missing X-HubSpot-Signature header.",
      });
    }
 
    if (!HUBSPOT_CLIENT_SECRET) {
      throw new DubApiError({
        code: "internal_server_error",
        message: "Missing HUBSPOT_CLIENT_SECRET environment variable.",
      });
    }
 
    // Create expected hash: client_secret + request_body
    const sourceString = HUBSPOT_CLIENT_SECRET + rawBody;
    const expectedHash = crypto
      .createHash("sha256")
      .update(sourceString)
      .digest("hex");
 
    // Compare with provided signature using constant-time comparison
    if (!timingSafeCompare(signature, expectedHash)) {
      throw new DubApiError({
        code: "unauthorized",
        message: "Invalid webhook signature.",
      });
    }
 

Copyconst events = JSON.parse(rawBody) as any[];
const finalEvents = Array.isArray(events) ? events : [events];
 
// HubSpot can send multiple events in a single request, so we fan them out
// to QStash and process each event independently in /api/hubspot/webhook/process.
// This keeps the webhook handler fast and ensures a slow/failing event doesn't
// block or fail the rest of the batch.
const qstashResponse = await enqueueBatchJobs(
  finalEvents.map((event) => ({
    queueName: "process-hubspot-webhook",
    url: `${APP_DOMAIN_WITH_NGROK}/api/hubspot/webhook/process`,
    deduplicationId: event.eventId,
    method: "POST",
    body: event,
  })),
);
 
console.log(
  `[hubspot/webhook] Enqueued ${finalEvents.length} webhook events to be processed.`,
  qstashResponse,
);
 
return logAndRespond("Webhook received.");

Copyexport const POST = withAxiom(async (req) => {
  const startTime = Date.now();
 
  let body: any;
  let workspace:
    | Pick<WorkspaceProps, "id" | "stripeConnectId" | "webhookEnabled">
    | undefined;
 
  try {
    const rawBody = await req.text();
 
    await verifyQstashSignature({
      req,
      rawBody,
    });
 
    body = JSON.parse(rawBody);
 
    const { objectTypeId, portalId, subscriptionType } =
      hubSpotWebhookSchema.parse(body);
 
    // Find the installation
    const installation = await prisma.installedIntegration.findFirst({
      where: {
        integration: {
          slug: "hubspot",
        },
        credentials: {
          path: "$.hub_id",
          equals: portalId,
        },
      },
      include: {
        project: {
          select: {
            id: true,
            stripeConnectId: true,
            webhookEnabled: true,
          },
        },
      },
    });
 
    if (!installation) {
      return logAndRespond(
        `[HubSpot] Installation is not found for portalId ${portalId}.`,
      );
    }
 
    workspace = installation.project;
 

Copyexport function getHubSpotEventAction({
  event,
  settings,
}: {
  event: Pick<
    z.infer<typeof hubSpotLeadEventSchema>,
    "objectTypeId" | "subscriptionType" | "propertyName" | "propertyValue"
  >;
  settings: z.infer<typeof hubSpotSettingsSchema>;
}): "trackLead" | "trackSale" | "skip" {

Copy// A new contact is created (deferred lead tracking)
if (objectTypeId === "0-1" && subscriptionType === "object.creation") {
  const contactInfo = await hubSpotApi.getContact(objectId);
 
  if (!contactInfo) {
    return `No contact info found for contact ${objectId}.`;
  }
 
  const { properties } = contactInfo;
 
  if (!properties.dub_id) {
    return `No dub_id found for contact ${objectId}.`;
  }
 
  const customerName =
    [properties.firstname, properties.lastname].filter(Boolean).join(" ") ||
    null;
 
  const trackLeadResult = await trackLead({
    clickId: properties.dub_id,
    eventName: "Sign up",
    customerEmail: properties.email,
    customerExternalId: properties.email,
    customerName,
    mode: "deferred",
    workspace,
    source: "hubspot",
    commissionSource: CommissionSource.hubspot,
  });
 
  if (trackLeadResult) {
    await updateHubSpotContact({
      contact: contactInfo,
      trackLeadResult,
      hubSpotApi,
    });
  }
 
  return `Deferred lead tracked for contact ${objectId}.`;
}

Copy// Case 2: When the contact's lifecycle stage is changed to a qualified lead
if (
  objectTypeId === "0-1" &&
  subscriptionType === "object.propertyChange" &&
  settings.leadTriggerEvent === "lifecycleStageReached"
) {
  if (!settings.leadLifecycleStageId) {
    return `leadLifecycleStageId is not set.`;
  }
 
  const contactInfo = await hubSpotApi.getContact(objectId);
 
  if (!contactInfo) {
    return `No contact info found for contact ${objectId}.`;
  }
 
  const { properties } = contactInfo;
 
  if (
    properties.lifecyclestage?.toLowerCase() !==
    settings.leadLifecycleStageId?.toLowerCase()
  ) {
    return `Unknown contact lifecyclestage ${properties.lifecyclestage}. Expected ${settings.leadLifecycleStageId}.`;
  }
 
  if (!properties.dub_id) {
    return `No dub_id found for contact ${objectId}.`;
  }
 
  const customer = await prisma.customer.findFirst({
    where: {
      projectId: workspace.id,
      OR: [{ externalId: contactInfo.id }, { externalId: properties.email }],
    },
  });
 
  const trackLeadResult = await trackLead({
    clickId: properties.dub_id,
    eventName: `Contact ${properties.lifecyclestage}`,
    customerExternalId: customer?.externalId || properties.email,
    customerName: `${properties.firstname} ${properties.lastname}`,
    customerEmail: properties.email,
    mode: "async",
    workspace,
    source: "hubspot",
    commissionSource: CommissionSource.hubspot,
  });
 
  if (trackLeadResult) {
    await updateHubSpotContact({
      contact: contactInfo,
      trackLeadResult,
      hubSpotApi,
    });
  }
 
  return `Lead tracked for contact ${objectId}.`;
}

Copy// Track the final lead event
// Case 1: A deal is created for the contact
if (
  objectTypeId === "0-3" &&
  subscriptionType === "object.creation" &&
  settings.leadTriggerEvent === "dealCreated"
) {
  return trackFinalLead({
    dealId: objectId,
    workspace,
    hubSpotApi,
  });
}
 
// Track the final lead event
// Case 3: A deal reaches the configured lead deal stage
if (
  objectTypeId === "0-3" &&
  subscriptionType === "object.propertyChange" &&
  settings.leadTriggerEvent === "dealStageReached"
) {
  if (!settings.leadDealStageId) {
    return `leadDealStageId is not set.`;
  }
 
  if (propertyName !== "dealstage") {
    return `Unknown propertyName ${propertyName}. Expected dealstage.`;
  }
 
  if (
    propertyValue?.toLowerCase() !== settings.leadDealStageId.toLowerCase()
  ) {
    return `Unknown propertyValue ${propertyValue}. Expected ${settings.leadDealStageId}.`;
  }
 
  return trackFinalLead({
    dealId: objectId,
    workspace,
    hubSpotApi,
  });
}

Copy// Track the final lead for the first contact associated with a deal
const trackFinalLead = async ({
  dealId,
  workspace,
  hubSpotApi,
}: {
  dealId: number;
  workspace: Pick<WorkspaceProps, "id" | "stripeConnectId" | "webhookEnabled">;
  hubSpotApi: HubSpotApi;
}) => {
  const deal = await hubSpotApi.getDeal(dealId);
 
  if (!deal) {
    return `No deal found for deal ${dealId}.`;
  }
 
  const { properties, associations } = deal;
 
  // Find the contact associated with the deal
  const contact = associations?.contacts?.results?.[0];
 
  if (!contact) {
    return `No contact found for deal ${dealId}.`;
  }
 
  // HubSpot doesn't return the contact properties in the deal associations,
  // so we need to get it separately
  const contactInfo = await hubSpotApi.getContact(contact.id);
 
  if (!contactInfo) {
    return `No contact info found for contact ${contact.id}.`;
  }
 
  const customer = await prisma.customer.findFirst({
    where: {
      projectId: workspace.id,
      OR: [
        { email: contactInfo.properties.email },
        { externalId: contactInfo.id },
        { externalId: contactInfo.properties.email },
      ],
    },
  });
 
  if (!customer) {
    return `No customer found for contact ID ${contactInfo.id} or email ${contactInfo.properties.email}.`;
  }
 
  const trackLeadResult = await trackLead({
    clickId: "",
    eventName: `Deal ${properties.dealstage}`,
    customerExternalId: customer.externalId!,

Copyexport const trackHubSpotSaleEvent = async ({
  payload,
  workspace,
  authToken,
  settings,
}: {
  payload: Record<string, any>;
  workspace: Pick<WorkspaceProps, "id" | "stripeConnectId" | "webhookEnabled">;
  authToken: HubSpotAuthToken;
  settings: z.infer<typeof hubSpotSettingsSchema>;
}) => {
  const { objectId, subscriptionType, propertyName, propertyValue } =
    hubSpotSaleEventSchema.parse(payload);
 
  if (subscriptionType !== "object.propertyChange") {
    return `Unknown subscriptionType ${subscriptionType}.`;
  }
 
  if (propertyName !== "dealstage") {
    return `Unknown propertyName ${propertyName}. Expected dealstage.`;
  }
 
  if (
    propertyValue.toLowerCase() !== settings.closedWonDealStageId?.toLowerCase()
  ) {
    return `Unknown propertyValue ${propertyValue}. Expected ${settings.closedWonDealStageId}.`;
  }
 
  const hubSpotApi = new HubSpotApi({
    token: authToken.access_token,
  });
 
  const deal = await hubSpotApi.getDeal(objectId);
 
  if (!deal) {
    return `No deal found for deal ${objectId}`;
  }
 
  const { id: dealId, properties, associations } = deal;
 
  if (!properties.amount) {
    return `Amount is not set for deal ${dealId}`;
  }
 
  // Find the contact associated with the deal
  const contact = associations?.contacts?.results?.[0];
 
  if (!contact) {
    return `No contact associated with deal ${dealId}`;
  }
 
  // HubSpot doesn't return the contact properties in the deal associations,
  // so we need to get it separately
  const contactInfo = await hubSpotApi.getContact(contact.id);
 
  if (!contactInfo) {
    return `No contact info found for contact ${contact.id}`;
  }
 
  const customer = await prisma.customer.findFirst({
    where: {
      projectId: workspace.id,
      OR: [
        { email: contactInfo.properties.email },
        { externalId: contactInfo.id },
        { externalId: contactInfo.properties.email },
      ],
    },
  });
 
  if (!customer) {
    return `No customer found for contact ID ${contactInfo.id} or email ${contactInfo.properties.email}.`;
  }
 
  await trackSale({
    customerExternalId: customer.externalId!,
    amount: Number(properties.amount) * 100,
    eventName: `${properties.dealname} ${properties.dealstage}`,
    paymentProcessor: "custom",
    invoiceId: dealId,

Copytry {
  const session = await getSession();
 
  if (!session?.user.id) {
    throw new DubApiError({
      code: "unauthorized",
      message: "Unauthorized. Please login to continue.",
    });
  }
 
  const { token, contextId: workspaceId } =
    await intercomOAuthProvider.exchangeCodeForToken<string>(req);
 
  workspace = await prisma.project.findUniqueOrThrow({
    where: {
      id: workspaceId,
    },
    select: {
      id: true,
      slug: true,
      plan: true,
      users: {
        where: {
          userId: session.user.id,
        },
        select: {
          role: true,
          defaultFolderId: true,
        },
      },
    },
  });
 
  if (workspace.users.length === 0) {
    throw new DubApiError({
      code: "bad_request",
      message: "You are not a member of this workspace.",
    });
  }
 
  if (workspace.users[0].role !== "owner") {
    throw new DubApiError({
      code: "bad_request",
      message: "Only workspace owners can install integrations.",
    });
  }
 
  if (!getPlanCapabilities(workspace.plan).canInstallAdvancedIntegrations) {
    throw new DubApiError({
      code: "forbidden",
      message:
        "Intercom integration is only available on Advanced and Enterprise plans.",
    });
  }
 
  const integration = await prisma.integration.findUniqueOrThrow({
    where: {
      id: INTERCOM_INTEGRATION_ID,
    },
    select: {
      id: true,
    },
  });
 
  const intercom = new Intercom({
    token: token.access_token,
  });
 
  const admin = await intercom.getAdmin();
 
  if (!admin.app?.id_code) {
    throw new DubApiError({
      code: "internal_server_error",
      message: "Failed to retrieve Intercom workspace ID.",
    });
  }
 
  const credentials = intercomCredentialsSchema.parse({
    accessToken: encrypt(token.access_token),
    appId: admin.app?.id_code,

Copyconst relevantTopics = new Set(["conversation.admin.replied", "ping"]);