feature

server/app/Http/Controllers/Hooks/TelegramWebhookController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Controllers\Hooks;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use SergiX44\Nutgram\Nutgram;
+
+class TelegramWebhookController extends Controller
+{
+    public function __invoke(Request $request, Nutgram $bot): Response
+    {
+        $secret = (string) config('coruna.telegram.webhook_secret', '');
+        if ($secret !== '') {
+            $header = (string) $request->header('X-Telegram-Bot-Api-Secret-Token', '');
+            if (! hash_equals($secret, $header)) {
+                abort(403, 'Invalid webhook secret');
+            }
+        }
+
+        try {
+            $bot->run();
+        } catch (\InvalidArgumentException $e) {
+            // FakeNutgram with no update (unit tests) — still ACK the webhook probe.
+            if (! app()->runningUnitTests()) {
+                throw $e;
+            }
+        }
+
+        return response()->noContent();
+    }
+}