Stripe Checkout session and verified webhook

<?php

namespace App\Http\Controllers;

use App\Models\Invoice;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Http;

class CheckoutController extends Controller
{
    public function __invoke(Invoice $invoice): RedirectResponse
    {
        abort_unless($invoice->status === 'pending', 409);

        $session = Http::asForm()
            ->withToken(config('services.stripe.secret'))
            ->baseUrl('https://api.stripe.com/v1')
            ->timeout(15)
            ->post('/checkout/sessions', [
                'mode' => 'payment',
                'success_url' => route('invoices.show', $invoice).'?paid=1',
                'cancel_url' => route('invoices.show', $invoice),
                'client_reference_id' => $invoice->number,
                'metadata[invoice]' => $invoice->number,
                'line_items[0][quantity]' => 1,
                'line_items[0][price_data][currency]' => strtolower($invoice->currency),
                'line_items[0][price_data][unit_amount]' => $invoice->total_cents,
                'line_items[0][price_data][product_data][name]' => "Invoice {$invoice->number}",
            ])
            ->throw()
            ->json();

        return redirect()->away($session['url']);
    }
}

<?php

namespace App\Http\Controllers;

use App\Models\Invoice;
use Illuminate\Http\Request;
use Illuminate\Http\Response;

class StripeWebhookController extends Controller
{
    public function __invoke(Request $request): Response
    {
        $payload = $request->getContent(); // raw body: the signature covers exact bytes

        if (! $this->validSignature($payload, (string) $request->header('Stripe-Signature'))) {
            return response('Invalid signature', 400);
        }

        $event = json_decode($payload, true);
        $object = $event['data']['object'] ?? [];

        match ($event['type'] ?? '') {
            'checkout.session.completed' => $this->markPaid($object),
            default => null, // acknowledge everything else
        };

        return response('ok');
    }

    private function markPaid(array $session): void
    {
        if (($session['payment_status'] ?? '') !== 'paid') {
            return;
        }

        // Conditional update makes redelivery of the same event a no-op.
        Invoice::where('number', $session['client_reference_id'] ?? '')
            ->where('status', 'pending')
            ->update(['status' => 'paid', 'paid_at' => now(), 'gateway_ref' => $session['payment_intent'] ?? null]);
    }

    private function validSignature(string $payload, string $header, int $tolerance = 300): bool
    {
        $parts = [];
        foreach (explode(',', $header) as $piece) {
            [$key, $value] = array_pad(explode('=', trim($piece), 2), 2, '');
            $parts[$key][] = $value;
        }

        $timestamp = (int) ($parts['t'][0] ?? 0);
        $expected = hash_hmac('sha256', $timestamp.'.'.$payload, (string) config('services.stripe.webhook_secret'));

        return abs(time() - $timestamp) <= $tolerance
            && collect($parts['v1'] ?? [])->contains(fn ($sig) => hash_equals($expected, $sig));
    }
}