<?php

namespace Modules\InternalApi\app\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class VerifyInternalApiSignature
{
    /**
     * Verify the HMAC signature used between separated WMS applications.
     */
    public function handle(Request $request, Closure $next): Response
    {
        $secret = (string) config('platform.internal_api_key');
        $timestamp = (string) $request->header('X-WMS-Timestamp');
        $signature = (string) $request->header('X-WMS-Signature');

        abort_if($secret === '' || $timestamp === '' || $signature === '', 401);
        abort_if(abs(now()->timestamp - strtotime($timestamp)) > 300, 401, 'Expired internal API signature.');

        $expected = hash_hmac('sha256', $timestamp . '.' . $request->getContent(), $secret);
        abort_unless(hash_equals($expected, $signature), 401, 'Invalid internal API signature.');

        return $next($request);
    }
}