API Events¶

function verifyWebhookSignature(
    string $payload,
    string $signature,
    string $secret
): bool {
    $expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);
    return hash_equals($expected, $signature);
}

// In your webhook handler
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_GOLDSTANDARD_SIGNATURE'] ?? '';
$secret = 'your-webhook-secret';

if (!verifyWebhookSignature($payload, $signature, $secret)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);
// Process event...

namespace Xoops\Modules\GoldStandard\Infrastructure\Webhook;

class WebhookDispatcher
{
    public function __construct(
        private readonly WebhookRepository $webhooks,
        private readonly HttpClient $client,
        private readonly QueueInterface $queue
    ) {}

    public function dispatch(string $eventType, array $data): void
    {
        $webhooks = $this->webhooks->findByEvent($eventType);

        foreach ($webhooks as $webhook) {
            if (!$webhook->isActive()) {
                continue;
            }

            $payload = $this->buildPayload($eventType, $data);

            // Queue for async delivery
            $this->queue->push(new DeliverWebhookJob(
                webhookId: $webhook->getId(),
                payload: $payload
            ));
        }
    }

    private function buildPayload(string $eventType, array $data): array
    {
        return [
            'id' => 'evt_' . Ulid::generate(),
            'type' => $eventType,
            'created_at' => (new \DateTimeImmutable())->format(\DateTimeInterface::ATOM),
            'data' => $data,
            'metadata' => [
                'module' => 'goldstandard',
                'version' => '1.0',
                'site_url' => XOOPS_URL
            ]
        ];
    }
}

namespace Xoops\Modules\GoldStandard\Infrastructure\Webhook;

class DeliverWebhookJob
{
    public function __construct(
        public readonly string $webhookId,
        public readonly array $payload,
        public readonly int $attempt = 1
    ) {}

    public function handle(
        WebhookRepository $webhooks,
        HttpClient $client,
        QueueInterface $queue
    ): void {
        $webhook = $webhooks->findById($this->webhookId);

        if (!$webhook) {
            return;
        }

        $signature = $this->generateSignature(
            json_encode($this->payload),
            $webhook->getSecret()
        );

        try {
            $response = $client->post($webhook->getUrl(), [
                'json' => $this->payload,
                'headers' => [
                    'Content-Type' => 'application/json',
                    'X-GoldStandard-Signature' => $signature,
                    'X-GoldStandard-Event' => $this->payload['type'],
                    'X-GoldStandard-Delivery' => $this->payload['id']
                ],
                'timeout' => 30
            ]);

            $this->logDelivery($webhook, $response, 'success');

        } catch (\Exception $e) {
            $this->logDelivery($webhook, null, 'failed', $e->getMessage());

            if ($this->attempt < 7) {
                $delay = $this->getRetryDelay($this->attempt);

                $queue->later($delay, new self(
                    webhookId: $this->webhookId,
                    payload: $this->payload,
                    attempt: $this->attempt + 1
                ));
            }
        }
    }

    private function generateSignature(string $payload, string $secret): string
    {
        return 'sha256=' . hash_hmac('sha256', $payload, $secret);
    }

    private function getRetryDelay(int $attempt): int
    {
        return match($attempt) {
            1 => 60,        // 1 minute
            2 => 300,       // 5 minutes
            3 => 1800,      // 30 minutes
            4 => 7200,      // 2 hours
            5 => 28800,     // 8 hours
            6 => 86400,     // 24 hours
            default => 86400
        };
    }
}