assertPostOnly(); $token = $this->filter('_token', 'str'); $secret = \XF::options()->rhpz_webhook_secret ?? ''; if( !$secret || !hash_equals($secret, $token) ){ return $this->error('Unauthorized', 401); } $userId = $this->filter('user_id', 'uint'); $count = $this->filter('count', 'uint'); $user = \XF::em()->find('XF:User', $userId); if( !$user ){ return $this->error('User not found', 404); } $user->rhpz_entry_count = $count; $user->save(); $trophyService = \XF::service('XF:Trophy\Notify', $user); $trophyService->checkAndAwardTrophies(); return $this->apiSuccess(['count' => $count]); } }