<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Valida a assinatura HMAC-SHA256 enviada pelo Mercado Pago no header
 * x-signature, usando a "Chave secreta" configurada no painel.
 *
 * Doc oficial: https://www.mercadopago.com.br/developers/pt/docs/your-integrations/notifications/webhooks
 */
class VerifyMercadoPagoWebhook
{
    public function handle(Request $request, Closure $next): Response
    {
        $secret = config('services.mercadopago.webhook_secret');

        // Em ambiente local sem secret configurado, deixa passar
        if (! $secret && app()->environment(['local', 'testing'])) {
            return $next($request);
        }

        if (! $secret) {
            abort(500, 'MP_WEBHOOK_SECRET não configurado');
        }

        $signatureHeader = $request->header('x-signature', '');
        $requestId = $request->header('x-request-id', '');
        $dataId = $request->query('data.id') ?? $request->query('data_id');

        if (! $signatureHeader || ! $requestId || ! $dataId) {
            abort(401, 'Cabeçalhos de assinatura ausentes');
        }

        // x-signature vem como: "ts=1234567,v1=abc123def..."
        $parts = [];
        foreach (explode(',', $signatureHeader) as $piece) {
            [$key, $value] = array_pad(explode('=', trim($piece), 2), 2, null);
            $parts[$key] = $value;
        }

        $ts   = $parts['ts']  ?? null;
        $hash = $parts['v1']  ?? null;

        if (! $ts || ! $hash) {
            abort(401, 'Assinatura mal formada');
        }

        $manifest = "id:{$dataId};request-id:{$requestId};ts:{$ts};";
        $expected = hash_hmac('sha256', $manifest, $secret);

        if (! hash_equals($expected, $hash)) {
            abort(401, 'Assinatura inválida');
        }

        return $next($request);
    }
}