<?php
// Boostigo webhook receiver (plain PHP). Point your API key's webhook URL at this file over HTTPS.
// 1) read the RAW body  2) verify HMAC signature + timestamp  3) de-duplicate  4) process  5) return 200 fast.
require __DIR__ . '/webhook-signature.php';

$secret = getenv('BOOSTIGO_WEBHOOK_SECRET') ?: 'whsec_YOUR_SECRET'; // API key -> Callback Secret in the Client Dashboard
$raw    = file_get_contents('php://input');                          // RAW body — never json_decode before verifying
$ts     = $_SERVER['HTTP_X_BOOSTIGO_TIMESTAMP'] ?? '';
$sig    = $_SERVER['HTTP_X_BOOSTIGO_SIGNATURE'] ?? '';
$delivery = $_SERVER['HTTP_X_BOOSTIGO_DELIVERY'] ?? '';

if (!boostigo_verify_signature($secret, $ts, $raw, $sig)) {
    http_response_code(401);
    echo json_encode(['received' => false, 'error' => 'invalid signature']);
    exit;
}

$event = json_decode($raw, true);
$order = $event['data'] ?? [];

// De-duplicate: the same X-Boostigo-Delivery can be redelivered if you answered slowly.
// if (already_processed($delivery)) { http_response_code(200); echo '{"received":true}'; exit; }

switch ($event['event'] ?? '') {
    case 'order.success':
        // mark your order ($order['request_id'] / $order['order_id']) as delivered: $order['diamond'] diamonds
        break;
    case 'order.failed':
    case 'order.cancelled':
        // mark as failed; the amount was refunded to your API key. Inform the customer.
        // $order['error']['code'] === 'RECHARGE_FAILED'
        break;
    case 'order.processing':
    case 'order.delayed':
        // optional progress updates
        break;
    default:
        // unknown/new event types: ignore gracefully
        break;
}

http_response_code(200);
header('Content-Type: application/json');
echo json_encode(['received' => true]);