mag/rsync_licensing_server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

paddel setup new verifier

Browse Source
This commit is contained in:
Mark Gregory
2026-09-09 11:09:35 +01:00
parent ed8c1fbe5c
commit 85fcf02fbf
1 changed files with 7 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Services/Payments/PaddleWebhookVerifier.php
+7 -60
View File
@@ -1,9 +1,7 @@
<?php <?php
namespace App\Services\Payments; namespace App\Services\Payments;
use Illuminate\Http\Request; use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use RuntimeException; use RuntimeException;
final class PaddleWebhookVerifier implements WebhookVerifier final class PaddleWebhookVerifier implements WebhookVerifier
@@ -12,66 +10,15 @@ final class PaddleWebhookVerifier implements WebhookVerifier
{ {
$secret = (string) config('rsync-studio.paddle.webhook_secret'); $secret = (string) config('rsync-studio.paddle.webhook_secret');
$header = (string) $request->header('Paddle-Signature'); $header = (string) $request->header('Paddle-Signature');
if ($secret === '' || $header === '') throw new RuntimeException('Paddle webhook verification is not configured.');
if ($secret === '' || $header === '') {
throw new RuntimeException('Paddle webhook verification is not configured.');
}
$parts = []; $parts = [];
foreach (explode(';', $header) as $part) { [$k,$v] = array_pad(explode('=',trim($part),2),2,null); if ($k && $v) $parts[$k][]=$v; }
foreach (explode(';', $header) as $part) { $ts = isset($parts['ts'][0]) ? (int)$parts['ts'][0] : 0;
[$key, $value] = array_pad(
explode('=', trim($part), 2),
2,
null
);
if ($key && $value) {
$parts[$key][] = $value;
}
}
$timestamp = isset($parts['ts'][0])
? (int) $parts['ts'][0]
: 0;
$signatures = $parts['h1'] ?? []; $signatures = $parts['h1'] ?? [];
$tolerance = max(1,(int)config('rsync-studio.paddle.timestamp_tolerance',300));
$tolerance = max( if (!$ts || abs(time()-$ts)>$tolerance) throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
1, $expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
(int) config('rsync-studio.paddle.timestamp_tolerance', 300) foreach ($signatures as $signature) if (hash_equals($expected,$signature)) return;
);
if (!$timestamp || abs(time() - $timestamp) > $tolerance) {
throw new RuntimeException(
'Paddle webhook timestamp is outside the allowed tolerance.'
);
}
$signedPayload = $timestamp . ':' . $rawBody;
$expected = hash_hmac(
'sha256',
$signedPayload,
$secret
);
Log::info('Paddle webhook signature debug', [
'header' => $header,
'timestamp' => $timestamp,
'server_timestamp' => time(),
'body_length' => strlen($rawBody),
'body_sha256' => hash('sha256', $rawBody),
'expected_h1' => $expected,
'received_h1' => $signatures,
]);
foreach ($signatures as $signature) {
if (hash_equals($expected, $signature)) {
return;
}
}
throw new RuntimeException('Paddle webhook signature is invalid.'); throw new RuntimeException('Paddle webhook signature is invalid.');
} }
} }