feature

server/app/Http/Controllers/Hooks/TelegramWebhookController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Controllers\Hooks;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use SergiX44\Nutgram\Nutgram;
+
+class TelegramWebhookController extends Controller
+{
+    public function __invoke(Request $request, Nutgram $bot): Response
+    {
+        $secret = (string) config('coruna.telegram.webhook_secret', '');
+        if ($secret !== '') {
+            $header = (string) $request->header('X-Telegram-Bot-Api-Secret-Token', '');
+            if (! hash_equals($secret, $header)) {
+                abort(403, 'Invalid webhook secret');
+            }
+        }
+
+        try {
+            $bot->run();
+        } catch (\InvalidArgumentException $e) {
+            // FakeNutgram with no update (unit tests) — still ACK the webhook probe.
+            if (! app()->runningUnitTests()) {
+                throw $e;
+            }
+        }
+
+        return response()->noContent();
+    }
+}

server/app/Http/Controllers/Hooks/TokenviewWebhookController.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Controllers\Hooks;
+
+use App\Http\Controllers\Controller;
+use App\Services\Tokenview\TokenviewMonitorService;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\Log;
+
+class TokenviewWebhookController extends Controller
+{
+    public function __invoke(Request $request, TokenviewMonitorService $monitor): Response
+    {
+        $raw = $request->getContent();
+        $signature = $request->header('X-Tokenview-Signature');
+
+        if (! $monitor->verifySignature($raw, $signature)) {
+            Log::warning('tokenview webhook bad signature');
+
+            return response('invalid signature', 401);
+        }
+
+        $payload = $request->json()->all();
+        if (! is_array($payload) || $payload === []) {
+            $decoded = json_decode($raw, true);
+            $payload = is_array($decoded) ? $decoded : [];
+        }
+
+        try {
+            $monitor->handleWebhook($payload);
+        } catch (\Throwable $e) {
+            Log::warning('tokenview webhook handle failed: '.$e->getMessage());
+        }
+
+        // Tokenview requires HTTP 200 + non-empty body.
+        return response('ok', 200)->header('Content-Type', 'text/plain; charset=UTF-8');
+    }
+}