39 lines
1.4 KiB
PHP
Executable File
39 lines
1.4 KiB
PHP
Executable File
<?php
|
|
|
|
namespace App\Services\Payments;
|
|
|
|
use Illuminate\Http\Request;
|
|
use RuntimeException;
|
|
|
|
final class PaddleWebhookVerifier implements WebhookVerifier
|
|
{
|
|
public function verify(Request $request, string $rawBody): void
|
|
{
|
|
$secret = (string) config('rsync-studio.paddle.webhook_secret');
|
|
$header = (string) $request->header('Paddle-Signature');
|
|
if ($secret === '' || $header === '') {
|
|
throw new RuntimeException('Paddle webhook verification is not configured.');
|
|
}
|
|
$parts = [];
|
|
foreach (explode(';', $header) as $part) {
|
|
[$k,$v] = array_pad(explode('=', trim($part), 2), 2, null);
|
|
if ($k && $v) {
|
|
$parts[$k][] = $v;
|
|
}
|
|
}
|
|
$ts = isset($parts['ts'][0]) ? (int) $parts['ts'][0] : 0;
|
|
$signatures = $parts['h1'] ?? [];
|
|
$tolerance = max(1, (int) config('rsync-studio.paddle.timestamp_tolerance', 300));
|
|
if (! $ts || abs(time() - $ts) > $tolerance) {
|
|
throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
|
|
}
|
|
$expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
|
|
foreach ($signatures as $signature) {
|
|
if (hash_equals($expected, $signature)) {
|
|
return;
|
|
}
|
|
}
|
|
throw new RuntimeException('Paddle webhook signature is invalid.');
|
|
}
|
|
}
|