# ivyforms/1.5.1/backend/src/Controllers/Square/SquareWebhookController.php

The Innovative Form Builder – IvyForms, version 1.5.1. 84 lines.

- Page: https://pluginprobe.com/plugins/ivyforms/1.5.1/code/backend/src/Controllers/Square/SquareWebhookController.php
- Raw: https://pluginprobe.com/plugins/ivyforms/1.5.1/raw/backend/src/Controllers/Square/SquareWebhookController.php
- Modified: 2026-10-05T14:37:20+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/ivyforms/1.5.1/code/backend/src/Controllers/Square/SquareWebhookController.php#L10-L20`.

```php
<?php

namespace IvyForms\Controllers\Square;

use IvyForms\Services\Integrations\MiddlewareSignatureService;
use IvyForms\Services\Payment\SquareOAuthService;
use IvyForms\Services\Payment\WebhookEventDedupeStore;
use IvyForms\Services\Translations\BackendStrings;
use WP_REST_Request;
use WP_REST_Response;

/**
 * Public webhook endpoint — IvyForms middleware forwards signed Square revocation events here.
 */
class SquareWebhookController
{
    private SquareOAuthService $squareOAuthService;
    private MiddlewareSignatureService $middlewareSignatureService;

    public function __construct(
        SquareOAuthService $squareOAuthService,
        MiddlewareSignatureService $middlewareSignatureService
    ) {
        $this->squareOAuthService = $squareOAuthService;
        $this->middlewareSignatureService = $middlewareSignatureService;
    }

    public function __invoke(WP_REST_Request $data): WP_REST_Response
    {
        return $this->handle($data);
    }

    public function handle(WP_REST_Request $data): WP_REST_Response
    {
        $rawBody = $data->get_body();
        $signature = (string) $data->get_header('X-IvyForms-Signature');
        if (!$this->middlewareSignatureService->verifySignature($rawBody, $signature)) {
            return new WP_REST_Response(
                [
                    'message' => BackendStrings::getCommonStrings()['invalid_request_data'],
                    'data' => ['success' => false],
                ],
                403
            );
        }

        $decoded = json_decode($rawBody, true);
        $eventId = is_array($decoded)
            ? (string) ($decoded['event_id'] ?? $decoded['id'] ?? '')
            : '';
        if (!WebhookEventDedupeStore::claim('square', $eventId)) {
            return new WP_REST_Response(
                [
                    'message' => BackendStrings::getCommonStrings()['ok'],
                    'data' => ['success' => true],
                ],
                200
            );
        }

        $eventType = is_array($decoded) ? (string) ($decoded['type'] ?? '') : '';
        if ($eventType !== 'oauth.authorization.revoked') {
            return new WP_REST_Response(
                [
                    'message' => BackendStrings::getCommonStrings()['ok'],
                    'data' => ['success' => true, 'ignored' => true],
                ],
                200
            );
        }

        $this->squareOAuthService->clearSquareSettingsFromRevocationWebhook();
        $this->squareOAuthService->notifyAdminDisconnected();

        return new WP_REST_Response(
            [
                'message' => BackendStrings::getCommonStrings()['ok'],
                'data' => ['success' => true],
            ],
            200
        );
    }
}

```