109 lines
2.9 KiB
PHP
Executable File
109 lines
2.9 KiB
PHP
Executable File
<?php
|
|
|
|
namespace Modules\Paddle\Services;
|
|
|
|
use App\Services\Payments\WebhookVerifier;
|
|
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Log;
|
|
use RuntimeException;
|
|
|
|
final class PaddleWebhookVerifier implements WebhookVerifier
|
|
{
|
|
public function verify(Request $request, string $rawBody): void
|
|
{
|
|
$secret = trim((string) config('paddle.webhook_secret'));
|
|
$header = trim((string) $request->header('Paddle-Signature'));
|
|
|
|
if ($secret === '') {
|
|
throw new RuntimeException('Paddle webhook secret is not configured.');
|
|
}
|
|
|
|
if ($header === '') {
|
|
throw new RuntimeException('Paddle-Signature header is missing.');
|
|
}
|
|
|
|
$parts = [];
|
|
|
|
foreach (explode(';', $header) as $part) {
|
|
[$key, $value] = array_pad(
|
|
explode('=', trim($part), 2),
|
|
2,
|
|
null
|
|
);
|
|
|
|
if ($key !== null && $value !== null) {
|
|
$parts[$key][] = $value;
|
|
}
|
|
}
|
|
|
|
$timestamp = isset($parts['ts'][0])
|
|
? (int) $parts['ts'][0]
|
|
: 0;
|
|
|
|
$signatures = $parts['h1'] ?? [];
|
|
|
|
if ($timestamp === 0) {
|
|
throw new RuntimeException(
|
|
'Paddle webhook signature has no timestamp.'
|
|
);
|
|
}
|
|
|
|
if ($signatures === []) {
|
|
throw new RuntimeException(
|
|
'Paddle webhook signature has no h1 signature.'
|
|
);
|
|
}
|
|
|
|
$tolerance = max(
|
|
1,
|
|
(int) config('paddle.timestamp_tolerance', 300)
|
|
);
|
|
|
|
$age = abs(time() - $timestamp);
|
|
|
|
if ($age > $tolerance) {
|
|
throw new RuntimeException(
|
|
"Paddle webhook timestamp is outside the allowed tolerance ({$age}s)."
|
|
);
|
|
}
|
|
|
|
$signedPayload = $timestamp . ':' . $rawBody;
|
|
|
|
$expected = hash_hmac(
|
|
'sha256',
|
|
$signedPayload,
|
|
$secret
|
|
);
|
|
|
|
Log::debug('Paddle webhook signature diagnostics', [
|
|
'timestamp' => $timestamp,
|
|
'age_seconds' => $age,
|
|
'body_length' => strlen($rawBody),
|
|
'body_sha256' => hash('sha256', $rawBody),
|
|
|
|
// Safe diagnostics — do NOT log the secret itself.
|
|
'secret_prefix' => substr($secret, 0, 11),
|
|
'secret_length' => strlen($secret),
|
|
|
|
'received_signature_prefixes' => array_map(
|
|
static fn (string $signature): string =>
|
|
substr($signature, 0, 12),
|
|
$signatures
|
|
),
|
|
|
|
'expected_signature_prefix' => substr($expected, 0, 12),
|
|
]);
|
|
|
|
foreach ($signatures as $signature) {
|
|
if (hash_equals($expected, $signature)) {
|
|
return;
|
|
}
|
|
}
|
|
|
|
throw new RuntimeException(
|
|
'Paddle webhook signature is invalid.'
|
|
);
|
|
}
|
|
}
|