use Vatly\API\VatlyApiClient;
use Vatly\API\Webhook;

$vatly = new VatlyApiClient();
$vatly->setApiKey('live_your_api_key_here');

// Get the raw webhook payload
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_VATLY_SIGNATURE'] ?? '';
$secret = 'your_webhook_secret';

// Parse and verify the webhook
$event = Webhook::parse($payload, $signature, $secret);

switch ($event->type) {
    case 'checkout.paid':
        $checkout = $event->data;
        // Fulfill the order
        break;

    case 'subscription.renewed':
        $subscription = $event->data;
        // Extend access
        break;

    case 'chargeback.created':
        $chargeback = $event->data;
        // Suspend account, notify team
        break;
}

// Return 200 OK
http_response_code(200);

use Vatly\API\Webhook;
use Vatly\API\Exceptions\InvalidSignatureException;

try {
    $event = Webhook::parse($payload, $signature, $secret);
    // Signature valid, process event
} catch (InvalidSignatureException $e) {
    // Invalid signature, reject request
    http_response_code(401);
    exit('Invalid signature');
}

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Vatly\API\Webhook;

class VatlyWebhookController extends Controller
{
    public function handle(Request $request)
    {
        $event = Webhook::parse(
            $request->getContent(),
            $request->header('Vatly-Signature'),
            config('services.vatly.webhook_secret')
        );

        match ($event->type) {
            'checkout.paid' => $this->handleCheckoutPaid($event->data),
            'subscription.canceled' => $this->handleCanceled($event->data),
            default => null,
        };

        return response()->json(['received' => true]);
    }
}

Route::post('/webhooks/vatly', [VatlyWebhookController::class, 'handle'])
    ->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);