<?php

namespace App\Services\Payments;

use Illuminate\Http\Request;
use RuntimeException;

final class LemonSqueezyWebhookVerifier implements WebhookVerifier
{
    public function verify(Request $request, string $rawBody): void
    {
        $secret = (string) config('rsync-studio.lemon_squeezy.webhook_secret');
        $signature = (string) $request->header('X-Signature');
        if ($secret === '' || $signature === '') {
            throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
        }
        $expected = hash_hmac('sha256', $rawBody, $secret);
        if (! hash_equals($expected, $signature)) {
            throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
        }
    }
}