#!/usr/bin/env python3
"""IBRESE POS webhook alıcısı (stdlib). HMAC + zaman sapması + node doğrulaması."""
from http.server import BaseHTTPRequestHandler, HTTPServer
import hashlib
import hmac
import json
import os
import time
import urllib.request

SECRET = os.environ.get("IBRESE_WEBHOOK_SECRET", "").encode()
RPC = os.environ.get("IBRESE_RPC", "https://rpc.ibrese.com").rstrip("/")
MAX_SKEW_MS = 5 * 60 * 1000
SEEN = set()


def parse_sig(header: str):
    parts = {}
    for item in header.split(","):
        if "=" in item:
            k, v = item.split("=", 1)
            parts[k.strip()] = v.strip()
    t = int(parts.get("t", "0"))
    v1 = parts.get("v1", "")
    if not (t > 0 and len(v1) == 64):
        raise ValueError("bad signature header")
    return t, v1


def verify(header: str, raw: bytes) -> bool:
    try:
        t, v1 = parse_sig(header)
    except Exception:
        return False
    now = int(time.time() * 1000)
    if abs(now - t) > MAX_SKEW_MS:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)


def confirm(payment_id: str) -> bool:
    req = urllib.request.Request(f"{RPC}/payments/{payment_id}", method="GET")
    with urllib.request.urlopen(req, timeout=8) as resp:
        body = json.loads(resp.read().decode())
    return body.get("status") == "FINALIZED" and body.get("amountRelation") in (
        "MATCH",
        "OVERPAYMENT",
    )


class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path != "/ibrese/webhook":
            self.send_error(404)
            return
        length = int(self.headers.get("Content-Length", "0"))
        raw = self.rfile.read(length)
        header = self.headers.get("X-IBRESE-Webhook-Signature", "")
        event_id = self.headers.get("X-IBRESE-Webhook-Id", "")
        if not SECRET or not verify(header, raw):
            self.send_response(401)
            self.end_headers()
            self.wfile.write(b'{"error":"bad signature"}')
            return
        if event_id in SEEN:
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b'{"ok":true,"duplicate":true}')
            return
        if event_id:
            SEEN.add(event_id)
        event = json.loads(raw)
        if event.get("type") == "payment.finalized" and event.get("invoicePaid") and event.get("paymentId"):
            if confirm(event["paymentId"]):
                print("SİPARİŞ ÖDENDİ", event.get("merchantReference"), event.get("paymentId"))
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(b'{"ok":true}')

    def log_message(self, fmt, *args):
        print(self.address_string(), fmt % args)


if __name__ == "__main__":
    if not SECRET:
        raise SystemExit("IBRESE_WEBHOOK_SECRET gerekli")
    HTTPServer(("127.0.0.1", int(os.environ.get("PORT", "8787"))), Handler).serve_forever()