ladill-events/app/Http/Controllers/Api/MeetWebhookController.php

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Services\Meet\MeetLifecycleService;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;

class MeetWebhookController extends Controller
{
    public function __invoke(Request $request, MeetLifecycleService $lifecycle): JsonResponse
    {
        $secret = (string) config('meet.webhook_secret', '');
        if ($secret === '') {
            return response()->json(['error' => 'Webhook not configured.'], 503);
        }

        $signature = (string) $request->header('X-Ladill-Meet-Signature', '');
        $body = $request->getContent();
        $expected = hash_hmac('sha256', $body, $secret);

        if ($signature === '' || ! hash_equals($expected, $signature)) {
            return response()->json(['error' => 'Invalid signature.'], 401);
        }

        /** @var array<string, mixed> $payload */
        $payload = $request->json()->all();
        $event = (string) ($payload['event'] ?? '');

        if ($event === '') {
            return response()->json(['error' => 'Missing event.'], 422);
        }

        $lifecycle->handle($event, $payload);

        return response()->json(['ok' => true]);
    }
}