<?php

namespace Modules\InternalApi\app\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class VerifyInternalApiSignature
{
    /**
     * Verify the HMAC signature used between separated WMS applications.
     */
    public function handle(Request $request, Closure $next): Response
    {
        $secret = (string) config('platform.internal_api_key');
        $timestamp = (string) $request->header('X-WMS-Timestamp');
        $signature = (string) $request->header('X-WMS-Signature');

        abort_if($secret === '' || $timestamp === '' || $signature === '', 401);
        abort_if(strtotime($timestamp) === false, 401, 'Invalid internal API timestamp.');
        abort_if(abs(now()->timestamp - strtotime($timestamp)) > 300, 401, 'Expired internal API signature.');

        $body = $request->getContent();
        $payloads = array_unique([
            $timestamp . '.' . $body,
            $timestamp . '.',
            $timestamp . '.[]',
        ]);

        foreach ($payloads as $payload) {
            if (hash_equals(hash_hmac('sha256', $payload, $secret), $signature)) {
                return $next($request);
            }
        }

        abort(401, 'Invalid internal API signature.');
    }
}