Configure webhooks

from flask import Flask, request, jsonify
from typing import Dict, Any, Optional, Union
import json
import base64
import time
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.exceptions import InvalidSignature

app = Flask(__name__)

class WebhookEvent:
    def __init__(self, data: Dict[str, Any]):
        self.api_version: str = data['api_version']
        self.event_id: str = data['event_id']
        self.event_category: str = data['event_category']
        self.event_type: str = data['event_type']
        self.event_object: Dict[str, Any] = data['event_object']
        self.event_object_changes: Optional[Dict[str, Any]] = data.get('event_object_changes')
        self.event_created_at: str = data['event_created_at']

class SignatureVerificationResult:
    def __init__(self, is_valid: bool, error: Optional[str] = None):
        self.is_valid = is_valid
        self.error = error

WEBHOOK_PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
your_webhook_public_key_here
-----END PUBLIC KEY-----"""

def verify_webhook_signature(payload: bytes, signature_header: str, public_key_pem: str) -> SignatureVerificationResult:
    try:
        # Parse signature header
        signature_parts = signature_header.split(',')
        timestamp = next((part.split('=', 1)[1] for part in signature_parts if part.startswith('t=')), None)
        signature = next((part.split('=', 1)[1] for part in signature_parts if part.startswith('v0=')), None)
        
        if not timestamp or not signature:
            return SignatureVerificationResult(False, 'Missing timestamp or signature')
        
        # Check timestamp (reject events older than 10 minutes)
        current_time = int(time.time() * 1000)
        if current_time - int(timestamp) > 600000:
            return SignatureVerificationResult(False, 'Timestamp too old')
        
        # Create signed payload
        signed_payload = f"{timestamp}.{payload.decode()}"
        
        # Verify signature
        public_key = serialization.load_pem_public_key(public_key_pem.encode())
        signature_bytes = base64.b64decode(signature)
        
        public_key.verify(
            signature_bytes,
            signed_payload.encode(),
            padding.PKCS1v15(),
            hashes.SHA256()
        )
        return SignatureVerificationResult(True)
    except InvalidSignature:
        return SignatureVerificationResult(False, 'Invalid signature')
    except Exception as e:
        return SignatureVerificationResult(False, f'Signature verification failed: {e}')

def handle_webhook_event(event: WebhookEvent) -> None:
    if event.event_type == 'customer.created':
        print(f"New customer created: {event.event_object.get('id')}")
    elif event.event_type == 'customer.updated':
        print(f"Customer updated: {event.event_object.get('id')}")
    elif event.event_type == 'transfer.created':
        print(f"Transfer created: {event.event_object.get('id')}")
    else:
        print(f"Unhandled event type: {event.event_type}")

@app.route('/webhooks/bridge', methods=['POST'])
def handle_webhook():
    payload = request.get_data()
    signature_header = request.headers.get('X-Webhook-Signature')
    
    if not signature_header:
        return jsonify({'error': 'Missing signature header'}), 400
    
    verification = verify_webhook_signature(payload, signature_header, WEBHOOK_PUBLIC_KEY)
    
    if not verification.is_valid:
        print(f"Signature verification failed: {verification.error}")
        return jsonify({'error': 'Invalid signature'}), 400
    
    try:
        event_data = json.loads(payload)
        event = WebhookEvent(event_data)
        handle_webhook_event(event)
        return jsonify({'received': True})
    except Exception as e:
        print(f"Failed to parse webhook event: {e}")
        return jsonify({'error': 'Invalid JSON'}), 400

if __name__ == '__main__':
    app.run(port=3000, debug=True)