A booking widget on your site

<?php
declare(strict_types=1);

require __DIR__ . '/../src/agoo_verify.php';

$secret = getenv('AGOO_WEBHOOK_SECRET') ?: '';
$body   = file_get_contents('php://input') ?: '';
$id     = $_SERVER['HTTP_WEBHOOK_ID'] ?? '';

// 1. Verify the signature before trusting anything in the request.
$valid = agoo_verify_webhook(
	$body,
	$id,
	$_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '',
	$_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '',
	$secret
);
if ( ! $valid ) {
	http_response_code( 400 );
	exit( 'Invalid signature' );
}

// 2. Skip events we've already handled. Agoo can deliver the same event more than once.
$db = new PDO( 'sqlite:' . __DIR__ . '/../data/agoo.sqlite' );
$db->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
$db->exec( 'CREATE TABLE IF NOT EXISTS processed_webhooks (id TEXT PRIMARY KEY, processed_at TEXT NOT NULL)' );

$seen = $db->prepare( 'SELECT 1 FROM processed_webhooks WHERE id = ?' );
$seen->execute( [ $id ] );
if ( $seen->fetchColumn() ) {
	http_response_code( 204 );
	exit;
}

// 3. Handle the event.
$event = json_decode( $body, true, 512, JSON_THROW_ON_ERROR );

if ( 'booking.created' === $event['type'] ) {
	$booking = $event['data']['object'];
	$start   = ( new DateTimeImmutable( $booking['start_at'] ) )
		->setTimezone( new DateTimeZone( $booking['time_zone'] ) )
		->format( 'l j F Y, H:i' );

	$lines = [
		'New booking: ' . $start,
		'Status: ' . $booking['status'], // confirmed, or pending until the host confirms
		'Patient: ' . $booking['attendee']['name'],
		'Phone: ' . ( $booking['attendee']['phone'] ?? 'not given' ),
		'Email: ' . ( $booking['attendee']['email'] ?? 'not given' ),
		'Booking: ' . $booking['id'],
	];
	$message = implode( "\n", $lines );

	$to = getenv( 'FRONT_DESK_EMAIL' ) ?: '';
	if ( '' === $to ) {
		error_log( $message ); // local testing: write to the log instead of sending
	} elseif ( ! mail( $to, 'New booking: ' . $start, $message ) ) {
		http_response_code( 500 ); // not recorded below, so Agoo retries later
		exit( 'Email failed' );
	}
}

// 4. Record the event as handled, then acknowledge it.
$db->prepare( 'INSERT INTO processed_webhooks (id, processed_at) VALUES (?, ?)' )
	->execute( [ $id, gmdate( DATE_ATOM ) ] );
http_response_code( 204 );

<?php
declare(strict_types=1);

/**
 * Verifies an Agoo webhook (Standard Webhooks). Returns true only for a genuine, fresh event.
 */
function agoo_verify_webhook( string $body, string $id, string $timestamp, string $signatures, string $secret, int $tolerance = 300 ): bool {
	if ( '' === $id || ! ctype_digit( $timestamp ) || '' === $signatures || '' === $secret ) {
		return false;
	}
	if ( abs( time() - (int) $timestamp ) > $tolerance ) {
		return false;
	}

	$key = base64_decode( preg_replace( '/^whsec_/', '', $secret ), true );
	if ( false === $key ) {
		return false;
	}
	$expected = base64_encode( hash_hmac( 'sha256', "{$id}.{$timestamp}.{$body}", $key, true ) );

	foreach ( explode( ' ', $signatures ) as $entry ) {
		[ $version, $signature ] = array_pad( explode( ',', $entry, 2 ), 2, '' );
		if ( 'v1' === $version && hash_equals( $expected, $signature ) ) {
			return true;
		}
	}
	return false;
}