import hashlib
import hmac
import json
import os
import time
from wsgiref.simple_server import make_server

seen: set[str] = set()  # Demonstration only; production requires an atomic shared replay store.


def application(environ, start_response):
    secret = os.environ.get("WEBHOOK_SECRET", "").encode()
    timestamp = environ.get("HTTP_X_WEBHOOK_TIMESTAMP", "")
    signature = environ.get("HTTP_X_WEBHOOK_SIGNATURE", "")
    try:
        raw = environ["wsgi.input"].read(int(environ.get("CONTENT_LENGTH", "0")))
        timestamp_number = int(timestamp)
    except (ValueError, KeyError):
        start_response("401 Unauthorized", [])
        return [b""]
    expected = "v1=" + hmac.new(secret, timestamp.encode() + b"." + raw, hashlib.sha256).hexdigest()
    replay_key = hashlib.sha256(timestamp.encode() + b"." + signature.encode() + b"." + raw).hexdigest()
    if not secret or abs(time.time() - timestamp_number) > 300 or not hmac.compare_digest(expected, signature) or replay_key in seen:
        start_response("401 Unauthorized", [])
        return [b""]
    try:
        event = json.loads(raw)
    except json.JSONDecodeError:
        start_response("400 Bad Request", [])
        return [b""]
    seen.add(replay_key)
    start_response("204 No Content", [])  # Hand event to durable work before acknowledging in production.
    return [b""]


if __name__ == "__main__":
    make_server("127.0.0.1", 8080, application).serve_forever()