<?php
/**
 * FityPay Developer API - Sample Direct Webhook Endpoint
 * --------------------------------------------------------
 * Safaricom (Daraja) will send the STK Push result DIRECTLY to this URL 
 * when the transaction concludes (Success or Failure).
 *
 * Make sure this file is uploaded to a publicly accessible HTTPS domain!
 */

// 0. FityPay webhook verification - answer the challenge and stop.
// Before this URL can be used by /v1/start, FityPay sends a one-time GET
// request with a ?fitypay_challenge=... value and expects it echoed back.
if (isset($_GET['fitypay_challenge'])) {
    header('Content-Type: text/plain');
    echo $_GET['fitypay_challenge'];
    exit;
}

header("Content-Type: application/json");

// 1. Capture the raw JSON payload from Safaricom
$payload = file_get_contents('php://input');
$data = json_decode($payload, true);

// 2. Validate the payload structure
if (!$data || !isset($data['Body']['stkCallback'])) {
    // Return early if not a valid Safaricom payload
    http_response_code(400);
    echo json_encode(["ResultCode" => 1, "ResultDesc" => "Invalid JSON Payload"]);
    exit;
}

$stkCallback = $data['Body']['stkCallback'];

// 3. Extract the Primary Identifiers and Status
$merchantRequestID = $stkCallback['MerchantRequestID'] ?? null;
$checkoutRequestID = $stkCallback['CheckoutRequestID'] ?? null;
$resultCode = (int)($stkCallback['ResultCode'] ?? -1);
$resultDesc = $stkCallback['ResultDesc'] ?? 'Unknown Error';

// 4. Initialize variables for successful transactions
$amount = 0;
$receiptNumber = null;
$phoneNumber = null;
$transactionDate = null;

// 5. If ResultCode is 0, the payment was SUCCESSFUL, and we can extract the Metadata
if ($resultCode === 0 && isset($stkCallback['CallbackMetadata']['Item'])) {
    foreach ($stkCallback['CallbackMetadata']['Item'] as $item) {
        $name = $item['Name'];
        $value = $item['Value'] ?? null;

        switch ($name) {
            case 'Amount':
                $amount = $value;
                break;
            case 'MpesaReceiptNumber':
                $receiptNumber = $value;
                break;
            case 'PhoneNumber':
                $phoneNumber = $value;
                break;
            case 'TransactionDate':
                $transactionDate = $value;
                break;
        }
    }
}

// 6. Handle the Business Logic in your Database
$logMessage = "Checkout ID: $checkoutRequestID | Status: $resultCode ($resultDesc)\n";
if ($resultCode === 0) {
    // Payment Success! Update your system orders to 'Paid'
    $logMessage .= "Amount: $amount | Phone: $phoneNumber | Receipt: $receiptNumber\n";
    // TODO: Update your database using $checkoutRequestID to mark the order complete
} else {
    // Payment Failed or Cancelled by User! Update your system to 'Failed'
    $logMessage .= "User did not complete the payment.\n";
    // TODO: Mark order as failed using $checkoutRequestID
}

// 7. Log the output to a file (For debugging purposes)
$logEntry = "--- " . date('Y-m-d H:i:s') . " ---\n";
$logEntry .= $logMessage;
$logEntry .= "Raw Payload: " . $payload . "\n\n";
file_put_contents(__DIR__ . '/mpesa_webhook_debug.txt', $logEntry, FILE_APPEND);


// 8. Always acknowledge receipt to Safaricom with a 2xx Response Code and valid JSON
// If you don't do this, Daraja will keep retrying to send you the webhook!
http_response_code(200);
echo json_encode([
    "ResultCode" => 0,
    "ResultDesc" => "Confirmation Received Successfully"
]);