<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;

class HubSpotWebhookMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        $clientSecret = config('services.hubspot.client_secret'); // Store your HubSpot client secret in config/services.php

        if (!$clientSecret) {
            // Not yet configured, ignores
            return response()->json(['message' => 'Ok'], 201);
        }

        $signature = $request->header('X-HubSpot-Signature');

        if (!$signature || !$this->isValidSignature($request->getContent(), $signature, $clientSecret)) {
            Log::warning('Invalid HubSpot webhook signature.', [
                'signature' => $signature,
                'request' => $request->all(),
            ]);

            return response()->json(['message' => 'Invalid signature'], 401);
        }

        return $next($request);
    }

    /**
     * Validates the HubSpot signature.
     *
     * @param  string  $payload
     * @param  string  $signature
     * @param  string  $clientSecret
     * @return bool
     */
    protected function isValidSignature($payload, $signature, $clientSecret)
    {
        $hash = hash('sha256', $clientSecret . $payload);
        return hash_equals($hash, $signature);
    }
}