<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use App\Models\Setting;

class VerifyRazorpaySignature
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
     */
    public function handle(Request $request, Closure $next)
    {
        $signature = $request->header('X-Razorpay-Signature');
        $payload = $request->getContent();
        
        if (!$signature) {
            Log::warning('Razorpay webhook received without signature', [
                'ip' => $request->ip(),
                'user_agent' => $request->userAgent(),
            ]);
            
            return response()->json(['error' => 'Missing signature'], 401);
        }

        // Get webhook secret from settings or config
        $webhookSecret = Setting::get('payment_razorpay_webhook_secret') 
            ?? config('services.razorpay.webhook_secret');

        if (!$webhookSecret) {
            Log::error('Razorpay webhook secret not configured');
            return response()->json(['error' => 'Webhook not configured'], 500);
        }

        // Verify signature
        $expectedSignature = hash_hmac('sha256', $payload, $webhookSecret);
        
        if (!hash_equals($expectedSignature, $signature)) {
            Log::warning('Invalid Razorpay webhook signature', [
                'ip' => $request->ip(),
                'expected' => $expectedSignature,
                'received' => $signature,
            ]);
            
            return response()->json(['error' => 'Invalid signature'], 401);
        }

        Log::info('Razorpay webhook signature verified successfully');
        
        return $next($request);
    }
}