Webhooks.php

<?php

declare(strict_types=1);

namespace Rapttor\WhopSdk\Resources;

use Rapttor\WhopSdk\Http\Page;

/**
 * Webhooks resource.
 *
 * @see https://docs.whop.com/api-reference/webhooks
 */
final class Webhooks extends AbstractResource
{
    /**
     * @param array{company_id: string, per_page?: int, after?: string} $params
     * @return Page<array<string, mixed>>
     */
    public function list(array $params = []): Page
    {
        $companyId = $this->requireParam($params, 'company_id');
        $query     = $this->stripParams($params, ['company_id']);

        $response = $this->client->get("/v5/company/{$companyId}/webhooks", $query);

        return $this->buildPage($response, $params);
    }

    /** @return array<string, mixed> */
    public function retrieve(string $webhookId, string $companyId): array
    {
        return $this->client->get("/v5/company/{$companyId}/webhooks/{$webhookId}");
    }

    /**
     * @param array<string, mixed> $body
     * @return array<string, mixed>
     */
    public function create(string $companyId, array $body): array
    {
        return $this->client->post("/v5/company/{$companyId}/webhooks", $body);
    }

    /**
     * @param array<string, mixed> $body
     * @return array<string, mixed>
     */
    public function update(string $webhookId, string $companyId, array $body): array
    {
        return $this->client->patch("/v5/company/{$companyId}/webhooks/{$webhookId}", $body);
    }

    /** @return array<string, mixed> */
    public function delete(string $webhookId, string $companyId): array
    {
        return $this->client->delete("/v5/company/{$companyId}/webhooks/{$webhookId}");
    }

    // ── Signature verification ─────────────────────────────────────────────────

    /**
     * Verify the HMAC-SHA256 signature on an incoming webhook request.
     *
     * Usage in a controller:
     * ```php
     * $payload   = file_get_contents('php://input');
     * $signature = $_SERVER['HTTP_X_WHOP_SIGNATURE'] ?? '';
     * $secret    = $_ENV['WHOP_WEBHOOK_SECRET'];
     *
     * if (!Webhooks::verifySignature($payload, $signature, $secret)) {
     *     http_response_code(401);
     *     exit;
     * }
     * ```
     *
     * @param string $payload   Raw request body (do NOT json_decode first).
     * @param string $signature Value of the `X-Whop-Signature` header.
     * @param string $secret    Your webhook secret from the Whop dashboard.
     */
    public static function verifySignature(string $payload, string $signature, string $secret): bool
    {
        // Strip an optional "sha256=" prefix that some platforms prepend
        $sig      = str_starts_with($signature, 'sha256=') ? substr($signature, 7) : $signature;
        $expected = hash_hmac('sha256', $payload, $secret);

        return hash_equals($expected, $sig);
    }
}