Belohnungen für Stimmen

<?php
// Set the webhook token, API URL and local database connection.
$secret = 'paste-webhook-token-here';
$apiUrl = 'https://api.gamemonitoring.de';
$rewardAmount = '1.00';
$pdo = new PDO('mysql:host=127.0.0.1;dbname=game;charset=utf8mb4', 'game', 'password', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

// Read the JSON payload sent by GAMEMONITORING.
$data = json_decode(file_get_contents('php://input'), true) ?: [];

// Test deliveries are signed too. Normalize the boolean value to the lowercase
// string used by GAMEMONITORING when the signature is calculated.
$isTest = ($data['is_test'] ?? false) === true;
$signingData = array_replace($data, ['is_test' => $isTest ? 'true' : 'false']);

// Prepare payload keys for signature verification: all fields except signature,
// sorted alphabetically before building the signing string.
$fields = array_values(array_filter(array_keys($data), fn($field) => $field !== 'signature'));
sort($fields, SORT_STRING);

// Build the signing string and expected HMAC.
$signing = implode('&', array_map(fn($field) => $field . '=' . (string) ($signingData[$field] ?? ''), $fields));
$expected = hash_hmac('sha256', $signing, $secret);
$actual = (string) ($data['signature'] ?? '');

// Reject requests with an invalid signature.
if (!hash_equals($expected, $actual)) {
    http_response_code(401);
    exit;
}

// Acknowledge test deliveries without fetching vote data or changing balance.
if ($isTest) {
    http_response_code(204);
    exit;
}

// Process server vote events.
if (($data['event_type'] ?? '') === 'server.vote') {
    $eventType = (string) $data['event_type'];
    $eventId = (string) $data['event_id'];

    // Load full vote data by event_id. Nickname, server, and user data are not in the webhook body.
    $voteUrl = $apiUrl . '/votes/' . rawurlencode($eventId);
    $voteBody = @file_get_contents($voteUrl);

    // If the API is unavailable, return 500 so the delivery can be retried.
    if ($voteBody === false) {
        http_response_code(500);
        exit;
    }

    $voteResponse = json_decode($voteBody, true) ?: [];
    $vote = $voteResponse['response'] ?? null;

    // Do not issue a reward when the vote response is missing a concrete nickname.
    if (!is_array($vote) || !isset($vote['nickname']) || !is_string($vote['nickname'])) {
        http_response_code(500);
        exit;
    }

    $voteServerId = (string) ($vote['server']['id'] ?? '');

    // Use vote nickname to update the local account. Use $voteServerId for per-server rules.
    $nickname = trim($vote['nickname']);

    if ($nickname === '') {
        http_response_code(500);
        exit;
    }

    // Keep deduplication and reward update in one transaction.
    // If the database work fails, the webhook returns 500 and can be retried.
    $pdo->beginTransaction();

    try {
        // Store the event once; duplicate deliveries affect zero rows.
        $reward = $pdo->prepare('INSERT IGNORE INTO gamemonitoring_webhooks (event_type, event_id) VALUES (?, ?)');
        $reward->execute([$eventType, $eventId]);

        // Reward the local user only for a newly stored event.
        if ($reward->rowCount() === 1) {
            $balance = $pdo->prepare('UPDATE users SET balance = balance + ? WHERE nickname = ?');
            $balance->execute([$rewardAmount, $nickname]);
        }

        // Commit after deduplication and balance update succeed.
        $pdo->commit();
    } catch (Throwable $error) {
        // Roll back if any database step fails.
        $pdo->rollBack();
        throw $error;
    }
}

http_response_code(204);