import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// No seu endpoint
app.post('/webhooks/octabuild', (req, res) => {
  const signature = req.headers['x-octabuild-signature'];
  const isValid = verifyWebhookSignature(
    JSON.stringify(req.body),
    signature,
    process.env.OCTABUILD_WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  const { event, data } = req.body;

  switch (event) {
    case 'land_plot.status_changed':
      console.log(`Terreno ${data.name}: ${data.previous_status} → ${data.status}`);
      break;
    case 'development.created':
      console.log(`Empreendimento criado: ${data.name}`);
      break;
    case 'financial.overdue':
      console.log(`Conta vencida: ${data.description}`);
      break;
  }

  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# No seu endpoint Flask
@app.route('/webhooks/octabuild', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-OctaBuild-Signature')
    is_valid = verify_webhook_signature(
        request.data.decode(),
        signature,
        os.environ['OCTABUILD_WEBHOOK_SECRET']
    )

    if not is_valid:
        return 'Invalid signature', 401

    event = request.json['event']
    data = request.json['data']

    if event == 'land_plot.status_changed':
        print(f"Terreno {data['name']}: {data['previous_status']} → {data['status']}")

    return 'OK', 200