<?php

namespace App\Http\Controllers\Hooks;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
use SergiX44\Nutgram\Nutgram;

class TelegramWebhookController extends Controller
{
    public function __invoke(Request $request, Nutgram $bot): Response
    {
        $secret = (string) config('coruna.telegram.webhook_secret', '');
        if ($secret !== '') {
            $header = (string) $request->header('X-Telegram-Bot-Api-Secret-Token', '');
            if (! hash_equals($secret, $header)) {
                abort(403, 'Invalid webhook secret');
            }
        }

        try {
            $bot->run();
        } catch (\InvalidArgumentException $e) {
            // FakeNutgram with no update (unit tests) — still ACK the webhook probe.
            if (! app()->runningUnitTests()) {
                throw $e;
            }
        }

        return response()->noContent();
    }
}