<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class VerifyShopifyWebhook
{
    public function handle(Request $request, Closure $next): Response
    {
        $hmac   = $request->header('X-Shopify-Hmac-Sha256');
        $secret = config('services.shopify.webhook_secret');

        if (!$hmac || !$secret) {
            abort(401);
        }

        $computed = base64_encode(hash_hmac('sha256', $request->getContent(), $secret, true));

        if (!hash_equals($computed, $hmac)) {
            abort(401);
        }

        return $next($request);
    }
}