src/Controller/GuestyBillingWebhookController.php line 18

  1. <?php
  2. namespace App\Controller;
  4. use App\Service\BillingFormLinks;
  5. use App\Service\GuestyBillingSignature;
  6. use App\Service\InvoicingOperationLock;
  7. use App\Service\InvoicingGuestChanges;
  8. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  9. use Symfony\Component\HttpFoundation\JsonResponse;
  10. use Symfony\Component\HttpFoundation\Request;
  11. use Symfony\Component\Routing\Annotation\Route;
  13. final class GuestyBillingWebhookController extends AbstractController
  14. {
  15.     public function __construct(private BillingFormLinks $links, private InvoicingGuestChanges $guestChanges) {}
  17.     #[Route('/invoicing/webhooks/guesty/billing-form', name: 'invoicing_guesty_billing_webhook', methods: ['POST'])]
  18.     public function receive(Request $request): JsonResponse
  19.     {
  20.         $directory = dirname(__DIR__, 2).'/var/invoicing';
  21.         $path = $directory.'/guesty-billing-webhook.json';
  22.         $config = is_file($path) ? json_decode(file_get_contents($path), true) : [];
  23.         $body = $request->getContent();
  24.         $messageId = $request->headers->get('svix-id', $request->headers->get('webhook-id', ''));
  25.         $time = $request->headers->get('svix-timestamp', $request->headers->get('webhook-timestamp', ''));
  26.         $signature = $request->headers->get('svix-signature', $request->headers->get('webhook-signature', ''));
  27.         if (empty($config['enabled']) || strlen($body) > 262144 || !GuestyBillingSignature::valid($body, $messageId, $time, $signature, $config['secret'] ?? '')) {
  28.             return $this->response(['error' => 'Unauthorized notification.'], 401);
  29.         }
  30.         try { $event = json_decode($body, true, 32, JSON_THROW_ON_ERROR); }
  31.         catch (\JsonException $e) { return $this->response(['error' => 'Invalid notification.'], 400); }
  32.         if (!is_array($event)) return $this->response(['error' => 'Invalid notification.'], 400);
  33.         if (($event['event'] ?? '') === 'guest.updated') {
  34.             $id = $event['guest']['_id'] ?? '';
  35.             $account = $event['guest']['accountId'] ?? '';
  36.             if (!is_string($id) || !preg_match('/^[a-f0-9]{24}$/D', $id) || $account !== BillingFormLinks::ACCOUNT) {
  37.                 return $this->response(['error' => 'Invalid guest notification.'], 400);
  38.             }
  39.             try {
  40.                 $recorded = $this->guestChanges->record($id, $event['meta']['eventId'] ?? $messageId);
  41.                 return $this->response(['status' => $recorded ? 'queued' : 'duplicate']);
  42.             } catch (\Throwable $e) {
  43.                 return $this->response(['error' => 'Guest change not confirmed. Notification will be retried.'], 503);
  44.             }
  45.         }
  46.         if (($event['event'] ?? '') !== 'reservation.created.v2') return $this->response(['status' => 'ignored']);
  47.         $id = $event['data']['_id'] ?? $event['data']['reservationId'] ?? '';
  48.         $account = $event['data']['accountId'] ?? '';
  49.         if (!is_string($id) || !preg_match('/^[a-f0-9]{24}$/D', $id) || $account !== BillingFormLinks::ACCOUNT) {
  50.             return $this->response(['error' => 'Invalid reservation notification.'], 400);
  51.         }
  52.         try {
  53.             return InvoicingOperationLock::run(function () use ($directory, $messageId, $event, $id): JsonResponse {
  54.                 $path = $directory.'/billing-form-events.json';
  55.                 $history = is_file($path) ? json_decode(file_get_contents($path), true) : [];
  56.                 if (!is_array($history)) throw new \RuntimeException('Notification journal unavailable.');
  57.                 $eventId = $event['meta']['eventId'] ?? $messageId;
  58.                 if (!is_string($eventId) || $eventId === '' || strlen($eventId) > 200) throw new \InvalidArgumentException('Invalid event.');
  59.                 $key = hash('sha256', $id.'|'.$eventId);
  60.                 if (isset($history[$key])) return $this->response(['status' => 'duplicate']);
  61.                 $result = $this->links->ensure($id);
  62.                 $history[$key] = ['reservationId' => $id, 'status' => $result['status'], 'completedAt' => date(DATE_ATOM)];
  63.                 $history = array_slice($history, -1000, null, true);
  64.                 $temporary = $path.'.'.bin2hex(random_bytes(8));
  65.                 if (file_put_contents($temporary, json_encode($history, JSON_THROW_ON_ERROR), LOCK_EX) === false) throw new \RuntimeException('Notification journal unavailable.');
  66.                 chmod($temporary, 0600);
  67.                 if (!rename($temporary, $path)) throw new \RuntimeException('Notification journal unavailable.');
  68.                 return $this->response($result);
  69.             }, false);
  70.         } catch (\Throwable $e) {
  71.             // No token, full URL, credentials or guest data in responses/logs. Non-2xx asks Guesty to retry.
  72.             return $this->response(['error' => 'Billing link not confirmed. Notification will be retried.'], 503);
  73.         }
  74.     }
  76.     private function response(array $body, int $status = 200): JsonResponse
  77.     {
  78.         return new JsonResponse($body, $status, ['Cache-Control' => 'no-store', 'X-Content-Type-Options' => 'nosniff'] + ($status === 503 ? ['Retry-After' => '60'] : []));
  79.     }
  80. }