<?php
header('Content-Type:application/json');
include 'api/includes/db.php';
$cfg = require 'config.php';
$data = json_decode(file_get_contents('php://input'), true);
$calc = hash_hmac('sha256', $data['payment_id'].'|'.$data['txn_id'], $cfg['webhook_secret']);
if (!hash_equals($calc, $data['signature'])) {
    http_response_code(403);
    echo json_encode(['status'=>'error','message'=>'Invalid signature']);
    exit;
}
$stmt = $pdo->prepare("UPDATE transactions SET status='success', response=? WHERE txn_id=?");
$stmt->execute([json_encode($data), $data['txn_id']]);
$stmt = $pdo->prepare("UPDATE users SET balance = balance + ? WHERE id = ?");
$stmt->execute([ /* amount */ , $data['user_id'] ]);
echo json_encode(['status'=>'success','message'=>'Payment recorded']);
