<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Services\CustomDomain\CustomDomainService;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;

/**
 * Signed completion callback from Ladill Domains' SSL service. Flips a custom
 * domain to live (or failed) once the certificate is issued. Auth is the HMAC
 * signature over the raw body (shared SSL_CALLBACK_SECRET), not a session.
 */
class SslCallbackController extends Controller
{
    public function __invoke(Request $request, CustomDomainService $service): JsonResponse
    {
        $secret = (string) config('customdomain.callback_secret');
        $body = $request->getContent();
        $signature = (string) $request->header('X-Ladill-Signature', '');

        if ($secret === '' || ! hash_equals(hash_hmac('sha256', $body, $secret), $signature)) {
            return response()->json(['error' => 'Invalid signature.'], 401);
        }

        $payload = json_decode($body, true);
        $data = (array) ($payload['data'] ?? []);
        $host = (string) ($data['host'] ?? '');
        if ($host === '') {
            return response()->json(['error' => 'Missing host.'], 422);
        }

        $service->applyCallback(
            $host,
            (string) ($data['status'] ?? 'failed'),
            $data['expires_at'] ?? null,
            $data['last_error'] ?? null,
        );

        return response()->json(['status' => 'ok']);
    }
}