core/src/Payment/Http/Controllers/StripeWebhookController.php

<?php

namespace Modules\Core\Payment\Http\Controllers;

use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Modules\Core\Payment\Drivers\StripePaymentDriver;
use Stripe\Webhook;

/**
 * A boboko-owned webhook endpoint for Stripe — never went through Lunar's
 * own Payments::driver('stripe') flow (the flow StripePaymentDriver was
 * built to replace, see that class's own docblock), and lunarphp/stripe
 * has since been removed entirely (see Modules\Core\Payment\Support\
 * StripeManager's own docblock). Signature verification is handled by
 * Modules\Core\Payment\Http\Middleware\StripeWebhookMiddleware, registered
 * on this route (see src/Payment/routes/webhooks.php) — pure Stripe SDK
 * verification + event-type filtering. This controller verifies the
 * signature again itself (Webhook::constructEvent()) to get the
 * constructed Event object — the middleware doesn't stash one anywhere
 * reusable, it only gates the request through.
 *
 * Resolves the driver directly by class, not via
 * Modules\Core\Payment\Services\PaymentDriverRegistry — this endpoint is
 * inherently Stripe-specific (Stripe's own webhook payload carries no
 * boboko payment-type key, only its own payment_intent id), and
 * StripePaymentDriver::handleCallback() already recovers $type itself
 * from the StripePaymentIntent row pay()/authorize() wrote.
 */
class StripeWebhookController extends Controller
{
    public function __invoke(Request $request, StripePaymentDriver $driver): JsonResponse
    {
        $event = Webhook::constructEvent(
            $request->getContent(),
            $request->header('Stripe-Signature'),
            config('services.stripe.webhooks.lunar'),
        );

        $driver->handleCallback($event->data->object->id, $event->data->object->toArray());

        return response()->json(['webhook_successful' => true]);
    }
}