Idempotent signed webhook receiver

<?php

namespace App\Http\Controllers;

use App\Jobs\ProcessWebhookEvent;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;

class ReceiveWebhook extends Controller
{
    public function __invoke(Request $request, string $source): JsonResponse
    {
        $secret = (string) config("services.webhooks.{$source}.secret");
        $timestamp = (int) $request->header('X-Timestamp');
        $body = $request->getContent();

        $expected = hash_hmac('sha256', $timestamp.'.'.$body, $secret);

        abort_unless($secret !== '' && hash_equals($expected, (string) $request->header('X-Signature')), 401);
        abort_if(abs(time() - $timestamp) > 300, 401, 'Stale timestamp');

        $event = json_decode($body, true, 16, JSON_THROW_ON_ERROR);
        $eventId = (string) ($event['id'] ?? '');
        abort_if($eventId === '', 422, 'Missing event id');

        // Atomic dedupe: the unique (source, event_id) index lets exactly one request insert.
        $isNew = DB::table('webhook_events')->insertOrIgnore([
            'source' => $source,
            'event_id' => $eventId,
            'payload' => $body,
            'received_at' => now(),
        ]) === 1;

        if ($isNew) {
            ProcessWebhookEvent::dispatch($source, $event);
        }

        return response()->json(['received' => true, 'duplicate' => ! $isNew]);
    }
}

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::create('webhook_events', function (Blueprint $table) {
            $table->id();
            $table->string('source', 40);
            $table->string('event_id', 120);
            $table->longText('payload');
            $table->timestamp('received_at');
            $table->unique(['source', 'event_id']); // the idempotency key
        });
    }

    public function down(): void
    {
        Schema::dropIfExists('webhook_events');
    }
};