<?php
declare(strict_types=1);
// Rename/mount this endpoint as /itz-commerce-webhook on the website.
$secret = (string)getenv('ITZ_COMMERCE_SECRET');
$raw=(string)file_get_contents('php://input');
$ts=(string)($_SERVER['HTTP_X_ITZ_TIMESTAMP']??'');
$sig=strtolower((string)($_SERVER['HTTP_X_ITZ_SIGNATURE']??''));
if($secret===''||!ctype_digit($ts)||abs(time()-(int)$ts)>300){http_response_code(401);exit('invalid');}
$expected=hash_hmac('sha256',$ts."\n".$raw,$secret);
if(!hash_equals($expected,$sig)){http_response_code(401);exit('invalid');}
$event=json_decode($raw,true);
if(!is_array($event)){http_response_code(400);exit('bad json');}
// TODO: Update the local website order using $event['order']['public_id'].
header('Content-Type: application/json');echo json_encode(['ok'=>true]);
