<?php
namespace App\Services\Payments;

use Illuminate\Http\Request;
use RuntimeException;

final class PaddleWebhookVerifier implements WebhookVerifier
{
    public function verify(Request $request, string $rawBody): void
    {
        $secret = (string) config('rsync-studio.paddle.webhook_secret');
        $header = (string) $request->header('Paddle-Signature');
        if ($secret === '' || $header === '') throw new RuntimeException('Paddle webhook verification is not configured.');
        $parts = [];
        foreach (explode(';', $header) as $part) { [$k,$v] = array_pad(explode('=',trim($part),2),2,null); if ($k && $v) $parts[$k][]=$v; }
        $ts = isset($parts['ts'][0]) ? (int)$parts['ts'][0] : 0;
        $signatures = $parts['h1'] ?? [];
        $tolerance = max(1,(int)config('rsync-studio.paddle.timestamp_tolerance',300));
        if (!$ts || abs(time()-$ts)>$tolerance) throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
        $expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
        foreach ($signatures as $signature) if (hash_equals($expected,$signature)) return;
        throw new RuntimeException('Paddle webhook signature is invalid.');
    }
}