PHP

require 'mmolove-callback.php';

$event = mmolove_verify(getenv('MMOLOVE_CALLBACK_SECRET'));   // false on failure
if ($event === false) {
    http_response_code(403);
    exit;
}
if (($event['event'] ?? '') === 'heart.test') {
    http_response_code(200);   // acknowledge the test, don't pay out
    exit;
}

mmolove_grant_reward($event['username'], $event['streak_day'] ?? null);
http_response_code(200);

<?php
// Load from env / secrets manager — NEVER hardcode in a public repo.
$MMOLOVE_SECRET = getenv('MMOLOVE_CALLBACK_SECRET');   // from the Integration tab

<?php
/**
 * mmolove-callback.php — reward-callback handler for MMOLove vote rewards.
 *
 * Flow: read raw body → verify HMAC → branch on heart.test → reward (idempotent
 * on heart_id) → 200. Any non-2xx tells MMOLove to retry.
 */

$MMOLOVE_SECRET = getenv('MMOLOVE_CALLBACK_SECRET');

// 1) Read the RAW body BEFORE any json_decode — we MUST sign the exact bytes.
$raw = file_get_contents('php://input');

// 2) Parse the X-MMOLove-Signature header:  t=<unix>,v1=<hex>
$header = $_SERVER['HTTP_X_MMOLOVE_SIGNATURE'] ?? '';
$sig = [];
foreach (explode(',', $header) as $part) {
    [$k, $v] = array_pad(explode('=', $part, 2), 2, '');
    $sig[trim($k)] = trim($v);
}
$t  = $sig['t']  ?? '';
$v1 = $sig['v1'] ?? '';   // NOTE: bare hex — no "sha256=" prefix on reward callbacks

// 3) Recompute the MAC over "<t>.<rawBody>" and compare constant-time.
$expected = hash_hmac('sha256', $t . '.' . $raw, $MMOLOVE_SECRET);   // lower-case hex
if ($t === '' || $v1 === '' || !hash_equals($expected, $v1)) {
    http_response_code(401);   // bad signature — MMOLove will retry
    exit;
}

// 4) (Recommended) reject stale deliveries — guards against replay.
if (abs(time() - (int) $t) > 300) {     // ±5 minutes
    http_response_code(401);
    exit;
}

// 5) Signature is good — now it's safe to parse the JSON.
$body = json_decode($raw, true);
if (!is_array($body)) {
    http_response_code(400);
    exit;
}

// 6) A test callback verifies the same way — acknowledge, but don't pay out.
if (($body['event'] ?? '') === 'heart.test') {
    http_response_code(200);
    exit;
}

// 7) Real vote — reward the voter, idempotently on heart_id.
$username  = (string) ($body['username'] ?? '');
$heartId   = (string) ($body['heart_id'] ?? '');
$streakDay = $body['streak_day'] ?? null;   // may be ABSENT — that's fine

if ($username === '' || $heartId === '') {
    http_response_code(400);
    exit;
}

if (mmolove_already_rewarded($heartId)) {
    http_response_code(200);   // safe replay of a retried delivery
    exit;
}

mmolove_grant_reward($username, $streakDay);   // YOUR in-game grant
mmolove_mark_rewarded($heartId);

http_response_code(200);   // tell MMOLove: delivered

<?php
/** Have we already rewarded this exact vote? Key on heart_id. */
function mmolove_already_rewarded(string $heartId): bool
{
    // SELECT 1 FROM mmolove_rewards WHERE heart_id = :id
    // return (bool) $row;
    return false;
}

/** Record that this vote has been rewarded (so retries no-op). */
function mmolove_mark_rewarded(string $heartId): void
{
    // INSERT INTO mmolove_rewards (heart_id, rewarded_at) VALUES (:id, NOW())
    //   ON CONFLICT (heart_id) DO NOTHING
}

/** Hand out the loot. Scale it with the streak if present. */
function mmolove_grant_reward(string $username, ?int $streakDay): void
{
    $reward = 100;                       // base reward
    if ($streakDay !== null) {
        if ($streakDay % 30 === 0)      $reward += 1000;  // monthly bonus
        elseif ($streakDay % 7 === 0)   $reward += 200;   // weekly bonus
    }
    // UPDATE accounts SET points = points + :reward WHERE username = :username
}