WebhookRequestValidator.php

Go to the documentation of this file.

<?php
namespace Magento\Signifyd\Model\SignifydGateway\Response;

use Magento\Framework\Json\DecoderInterface;
use Magento\Signifyd\Model\Config;

class WebhookRequestValidator
{
    private $allowedTopicValues = [
        'cases/creation',
        'cases/rescore',
        'cases/review',
        'guarantees/completion',
        'cases/test'
    ];

    private $config;

    private $decoder;

    public function __construct(
        Config $config,
        DecoderInterface $decoder
    ) {
        $this->config = $config;
        $this->decoder = $decoder;
    }

    public function validate(WebhookRequest $webhookRequest)
    {
        $body = $webhookRequest->getBody();
        $eventTopic = $webhookRequest->getEventTopic();
        $hash = $webhookRequest->getHash();

        return $this->isValidTopic($eventTopic)
            && $this->isValidBody($body)
            && $this->isValidHash($eventTopic, $body, $hash);
    }

    private function isValidTopic($topic)
    {
        return in_array($topic, $this->allowedTopicValues);
    }

    private function isValidBody($body)
    {
        try {
            $decodedBody = $this->decoder->decode($body);
        } catch (\Exception $e) {
            return false;
        }

        return !empty($decodedBody);
    }

    private function isValidHash($eventTopic, $body, $hash)
    {
        // In the case that this is a webhook test, the encoding ABCDE is allowed
        $apiKey = $eventTopic == 'cases/test' ? 'ABCDE' : $this->config->getApiKey();
        $actualHash = base64_encode(hash_hmac('sha256', $body, $apiKey, true));

        return $hash === $actualHash;
    }
}