<?php

namespace App\Http\Controllers;

use App\Models\Company;
use App\Services\StripePaymentService;
use Illuminate\Http\Request;
use Illuminate\Http\Response;

/**
 * Public webhook endpoints, one per provider — not CSRF-protected (a
 * third-party server can't carry a Laravel session token), independently
 * signature-verified per request instead. Mirrors the existing Twilio
 * webhook pattern (Admin\CallController::verifyTwilioSignature).
 */
class WebhookController extends Controller
{
    public function stripe(Request $request, Company $company, StripePaymentService $stripe): Response
    {
        if (! $company->stripe_webhook_secret) {
            return response('Webhook not configured.', 400);
        }

        try {
            $stripe->handleWebhook(
                $request->getContent(),
                $request->header('Stripe-Signature', ''),
                $company->stripe_webhook_secret
            );
        } catch (\Throwable $e) {
            return response('Signature verification failed.', 400);
        }

        return response('OK', 200);
    }
}
