<?php
// Receive + verify a CodeB webhook in PHP (raw handler).
// Events include call.started, call.answered, call.ended, transcript.saved,
// call.ice.connected, call.transferred, outbound-ai.finished,
// sfu.publisher.connected, sfu.subscriber.connected.
// European Digital Identity Wallet sign-in events flow through the same
// dispatcher; verification is identical.
// [webhooks-cookbook 2026-07-23]
//
// Wire this up as the endpoint you registered on
// https://<CODEB_TENANT_HOST>/webhooks-admin.html

$secret = getenv('CODEB_WEBHOOK_SECRET');
$raw    = file_get_contents('php://input');   // exact bytes; HMAC input
$got    = $_SERVER['HTTP_X_CODEB_SIGNATURE'] ?? '';

$mac    = hash_hmac('sha256', $raw, $secret);
$want   = 'sha256=' . $mac;

if (!hash_equals($want, $got)) {
    http_response_code(401);
    echo 'bad signature';
    exit;
}

$evt    = $_SERVER['HTTP_X_CODEB_EVENT']       ?? '';
$delId  = $_SERVER['HTTP_X_CODEB_DELIVERY_ID'] ?? '';
$payload = json_decode($raw, true);

error_log("[{$delId}] {$evt} " . json_encode($payload));
// ... process asynchronously; ACK within 5s.
http_response_code(200);
echo 'ok';