"""
Simplifi webhook verification (Python / Flask).

Verify the X-Simplifi-Signature header against the RAW request body
before parsing any JSON. Each webhook endpoint has its own signing secret
(shown when the endpoint is created in the Simplifi API settings).
"""

import hashlib
import hmac
import json
import os

from flask import Flask, request

app = Flask(__name__)
SIGNING_SECRET = os.environ["SIMPLIFI_WEBHOOK_SECRET"]  # your endpoint's signing_secret


@app.post("/webhooks/simplifi")
def simplifi_webhook():
    header = request.headers.get("X-Simplifi-Signature", "")  # "sha256={hex}"
    if not header.startswith("sha256="):
        return "", 400

    raw_body = request.get_data()  # raw bytes, before any parsing
    expected = hmac.new(SIGNING_SECRET.encode(), raw_body, hashlib.sha256).hexdigest()
    received = header[len("sha256="):]

    if not hmac.compare_digest(expected, received):
        return "", 401

    event = json.loads(raw_body)

    # Deduplicate on event["id"] - retries and resends keep the same delivery id.
    # Respond 2xx fast; do real work asynchronously (queue, etc.).

    # if event["type"] == "document.signer.signed": ...
    # if event["type"] == "document.completed": ...
    # if event["type"] == "webhook.test": ...

    return "ok", 200