require("dotenv").config();

module.exports = function (req, res, next) {

  const appSignature = (
    req.headers["app_signature"] || req.headers["x-app-signature"] || ""
  ).trim();
  const expectedSignature = (process.env.APP_SIGNATURE || "").trim();

  if (!appSignature) {
    return res.status(403).json({
      status: "failed",
      message: "Missing APP_SIGNATURE header.",
    });
  }

  if (appSignature !== expectedSignature) {
    return res.status(403).json({
      status: "failed",
      message: "Invalid APP_SIGNATURE. Use the exact value from server .env.",
    });
  }

  next(); // allow request to continue

};