Webhooks

1<?php
2
3namespace App\Http\Controllers;
4
5use Illuminate\Http\Request;
6use Illuminate\Http\Response;
7
8class WebhookController extends Controller
9{
10    private string $webhookSecret;
11
12    public function __construct()
13    {
14        $this->webhookSecret = config('services.scell.webhook_secret');
15    }
16
17    public function handle(Request $request): Response
18    {
19        // 1. Get signature header
20        $signatureHeader = $request->header('X-Scell-Signature');
21
22        if (!$signatureHeader) {
23            return response('Missing signature header', 400);
24        }
25
26        // 2. Parse timestamp and signature
27        $elements = $this->parseSignatureHeader($signatureHeader);
28        $timestamp = $elements['timestamp'];
29        $signature = $elements['signature'];
30
31        // 3. Verify timestamp (replay attack protection)
32        if (abs(time() - $timestamp) > 300) {
33            return response('Timestamp expired', 403);
34        }
35
36        // 4. Verify signature
37        $payload = $request->getContent();
38        $expectedSignature = $this->computeSignature($timestamp, $payload);
39
40        if (!hash_equals($expectedSignature, $signature)) {
41            return response('Invalid signature', 403);
42        }
43
44        // 5. Process event
45        $event = $request->input('event');
46        $data = $request->input('data');
47
48        $this->processEvent($event, $data);
49
50        return response('OK', 200);
51    }
52
53    private function parseSignatureHeader(string $header): array
54    {
55        $parts = explode(',', $header);
56        $elements = [];
57
58        foreach ($parts as $part) {
59            [$key, $value] = explode('=', $part, 2);
60            $elements[$key] = $value;
61        }
62
63        return [
64            'timestamp' => (int) $elements['t'],
65            'signature' => $elements['v1'],
66        ];
67    }
68
69    private function computeSignature(int $timestamp, string $payload): string
70    {
71        $signedPayload = "{$timestamp}.{$payload}";
72        return hash_hmac('sha256', $signedPayload, $this->webhookSecret);
73    }
74
75    private function processEvent(string $event, array $data): void
76    {
77        match ($event) {
78            'invoice.validated' => $this->handleInvoiceValidated($data),
79            'signature.completed' => $this->handleSignatureCompleted($data),
80            'balance.low' => $this->handleBalanceLow($data),
81            default => null,
82        };
83    }
84}