<?php
namespace App\Services\Payments;

use Illuminate\Http\Request;
use RuntimeException;

final class LemonSqueezyWebhookVerifier implements WebhookVerifier
{
    public function verify(Request $request, string $rawBody): void
    {
        $secret = (string) config('rsync-studio.lemon_squeezy.webhook_secret');
        $signature = (string) $request->header('X-Signature');
        if ($secret === '' || $signature === '') throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
        $expected = hash_hmac('sha256',$rawBody,$secret);
        if (!hash_equals($expected,$signature)) throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
    }
}