import crypto from 'crypto'
import express from 'express'

const app = express()
const WEBHOOK_SECRET = process.env.NAWA_WEBHOOK_SECRET!

// IMPORTANT: Use raw body for signature verification
app.post(
  '/webhooks/nawa',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-nawa-signature'] as string
    const timestamp = req.headers['x-nawa-timestamp'] as string

    // 1. Check timestamp freshness (prevent replay attacks)
    const age = Math.abs(Date.now() / 1000 - parseInt(timestamp))
    if (age > 300) {
      return res.status(400).json({ error: 'Timestamp expired' })
    }

    // 2. Verify HMAC-SHA256 signature
    const payload = `${timestamp}.${req.body}`
    const expected = crypto
      .createHmac('sha256', WEBHOOK_SECRET)
      .update(payload)
      .digest('hex')

    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
      return res.status(400).json({ error: 'Invalid signature' })
    }

    // 3. Parse and handle the event
    const event = JSON.parse(req.body.toString())

    switch (event.type) {
      case 'classification.completed':
        handleClassification(event.data)
        break
      case 'comment.new':
        handleNewComment(event.data)
        break
      case 'credits.low':
        alertLowCredits(event.data)
        break
      case 'credits.exhausted':
        alertCreditsExhausted(event.data)
        break
    }

    res.status(200).json({ received: true })
  }
)

import { NextRequest, NextResponse } from 'next/server'
import crypto from 'crypto'

const WEBHOOK_SECRET = process.env.NAWA_WEBHOOK_SECRET!

export async function POST(req: NextRequest) {
  const body = await req.text()
  const signature = req.headers.get('x-nawa-signature')!
  const timestamp = req.headers.get('x-nawa-timestamp')!

  // Verify timestamp
  const age = Math.abs(Date.now() / 1000 - parseInt(timestamp))
  if (age > 300) {
    return NextResponse.json({ error: 'Timestamp expired' }, { status: 400 })
  }

  // Verify signature
  const payload = `${timestamp}.${body}`
  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payload)
    .digest('hex')

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return NextResponse.json({ error: 'Invalid signature' }, { status: 400 })
  }

  const event = JSON.parse(body)

  // Handle event
  switch (event.type) {
    case 'classification.completed':
      // Process classification
      break
    case 'credits.low':
      // Alert team
      break
  }

  return NextResponse.json({ received: true })
}

import hmac
import hashlib
import time
import json
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
WEBHOOK_SECRET = "nawa_wh_your_secret"

@app.post("/webhooks/nawa")
async def handle_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get("x-nawa-signature", "")
    timestamp = request.headers.get("x-nawa-timestamp", "")

    # Verify timestamp
    age = abs(time.time() - int(timestamp))
    if age > 300:
        raise HTTPException(status_code=400, detail="Timestamp expired")

    # Verify signature
    payload = f"{timestamp}.{body.decode()}"
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=400, detail="Invalid signature")

    event = json.loads(body)

    # Handle event
    match event["type"]:
        case "classification.completed":
            await handle_classification(event["data"])
        case "comment.new":
            await handle_new_comment(event["data"])
        case "credits.low":
            await alert_low_credits(event["data"])

    return {"received": True}