<?php

// Minimal FileFast webhook receiver. Keep the endpoint secret server-side.
$body = file_get_contents('php://input');
$webhookId = $_SERVER['HTTP_WEBHOOK_ID'] ?? '';
$timestamp = $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '';
$secret = getenv('FILEFAST_WEBHOOK_SECRET') ?: '';

if ($secret === '' || !ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit;
}

$expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . $body, $secret);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

// Use a database/queue uniqueness constraint on $webhookId before processing.
$event = json_decode($body, true, flags: JSON_THROW_ON_ERROR);
error_log(sprintf('Verified FileFast event %s (%s)', $webhookId, $event['type'] ?? 'unknown'));

http_response_code(204);