<?php

declare(strict_types=1);

// Signature Verification (Phase 5 — Webhooks). Lets the client test their
// own HMAC verification implementation against ours, using their own real
// signing secret — developer/v1/webhooks/verify-signature.php
// (ClientWebhookService::verifySignature(), reusing Security::verifyHmac()
// verbatim). Pure computation, no state changed, no step-up.

require __DIR__ . '/../includes/bootstrap.php';

$pageTitle = 'Signature Verification';
$activeNav = 'webhooks';
$breadcrumbs = [['label' => 'Webhooks', 'href' => uh_url('webhooks/')], ['label' => 'Signature Verification']];
$pageScript = 'webhooks-verify-signature';

ob_start();
?>

<?= uh_subnav(uh_webhooks_nav_items(), 'verify_signature') ?>

<div class="row g-3">
  <div class="col-lg-7 col-12">
    <?= uh_card('
      <p class="text-muted fs-8">Paste the exact <code>X-Ureh-Timestamp</code>, raw request body, and <code>X-Ureh-Signature</code> header your endpoint received, and we will check them against your own signing secret — the same check your own verification code should perform.</p>
      <form id="uh-verify-form">
        ' . uh_form_field('timestamp', 'X-Ureh-Timestamp', 'text', ['placeholder' => 'e.g. 1785360000', 'required' => 'required']) . '
        ' . uh_form_textarea('payload', 'Raw Payload (request body)', '', ['rows' => '8', 'placeholder' => 'The exact raw JSON body, unmodified', 'required' => 'required']) . '
        ' . uh_form_field('signature', 'X-Ureh-Signature', 'text', ['placeholder' => 'The signature header value', 'required' => 'required']) . '
        <button type="submit" class="btn btn-primary" id="uh-verify-submit">Verify Signature</button>
      </form>
    ', 'Verify a Signature', '', 'lock') ?>
  </div>
  <div class="col-lg-5 col-12">
    <div id="uh-verify-result" class="d-none">
      <?= uh_card(uh_detail_list([
          ['label' => 'Signature', 'value' => '<span id="uh-verify-signature-result">—</span>'],
          ['label' => 'Timestamp', 'value' => '<span id="uh-verify-timestamp-result">—</span>'],
      ]), 'Result', '', 'check') ?>
    </div>
  </div>
</div>
<?php
$content = ob_get_clean();
require __DIR__ . '/../layouts/app.php';
