import crypto from 'crypto';
import express from 'express';

const app = express();
const WEBHOOK_SECRET = process.env.RESERVEI_WEBHOOK_SECRET;

// Importante: usar raw body para verificação
app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-reservei-signature'];
  const timestamp = req.headers['x-reservei-timestamp'];
  const payload = req.body.toString();
  
  // Verificar timestamp (previne replay attacks)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(401).json({ error: 'Timestamp too old' });
  }
  
  // Calcular assinatura esperada
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signedPayload)
    .digest('hex');
  
  // Comparação segura
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Processar evento
  const event = JSON.parse(payload);
  console.log(`✅ Evento recebido: ${event.type}`);
  
  switch (event.type) {
    case 'booking.created':
      // Processar nova reserva
      handleBookingCreated(event.data.object);
      break;
    case 'booking.ticketed':
      // Enviar bilhete para cliente
      handleBookingTicketed(event.data.object);
      break;
    case 'wallet.low_balance':
      // Alertar admin
      handleLowBalance(event.data.object);
      break;
  }
  
  // Responder rapidamente
  res.status(200).json({ received: true });
});

function handleBookingCreated(booking) {
  console.log(`Nova reserva: ${booking.booking_reference}`);
}

function handleBookingTicketed(booking) {
  console.log(`Bilhete emitido: ${booking.documents[0].unique_identifier}`);
}

function handleLowBalance(wallet) {
  console.log(`⚠️ Saldo baixo: R$ ${wallet.balance}`);
}

import hmac
import hashlib
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['RESERVEI_WEBHOOK_SECRET']

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Reservei-Signature')
    timestamp = request.headers.get('X-Reservei-Timestamp')
    payload = request.get_data(as_text=True)
    
    # Verificar timestamp
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return jsonify({'error': 'Timestamp too old'}), 401
    
    # Calcular assinatura
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    # Comparação segura
    if not hmac.compare_digest(signature, expected_signature):
        return jsonify({'error': 'Invalid signature'}), 401
    
    # Processar evento
    event = request.json
    print(f"✅ Evento recebido: {event['type']}")
    
    if event['type'] == 'booking.created':
        handle_booking_created(event['data']['object'])
    elif event['type'] == 'booking.ticketed':
        handle_booking_ticketed(event['data']['object'])
    
    return jsonify({'received': True}), 200

def handle_booking_created(booking):
    print(f"Nova reserva: {booking['booking_reference']}")

def handle_booking_ticketed(booking):
    print(f"Bilhete: {booking['documents'][0]['unique_identifier']}")

<?php

$webhookSecret = getenv('RESERVEI_WEBHOOK_SECRET');
$signature = $_SERVER['HTTP_X_RESERVEI_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_RESERVEI_TIMESTAMP'] ?? '';
$payload = file_get_contents('php://input');

// Verificar timestamp
$now = time();
if (abs($now - intval($timestamp)) > 300) {
    http_response_code(401);
    echo json_encode(['error' => 'Timestamp too old']);
    exit;
}

// Calcular assinatura
$signedPayload = $timestamp . '.' . $payload;
$expectedSignature = hash_hmac('sha256', $signedPayload, $webhookSecret);

// Comparação segura
if (!hash_equals($signature, $expectedSignature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

// Processar evento
$event = json_decode($payload, true);
error_log("✅ Evento recebido: " . $event['type']);

switch ($event['type']) {
    case 'booking.created':
        handleBookingCreated($event['data']['object']);
        break;
    case 'booking.ticketed':
        handleBookingTicketed($event['data']['object']);
        break;
}

http_response_code(200);
echo json_encode(['received' => true]);

function handleBookingCreated($booking) {
    error_log("Nova reserva: " . $booking['booking_reference']);
}

function handleBookingTicketed($booking) {
    error_log("Bilhete: " . $booking['documents'][0]['unique_identifier']);
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "math"
    "net/http"
    "os"
    "strconv"
    "time"
)

var webhookSecret = os.Getenv("RESERVEI_WEBHOOK_SECRET")

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    signature := r.Header.Get("X-Reservei-Signature")
    timestamp := r.Header.Get("X-Reservei-Timestamp")
    
    payload, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read body", http.StatusBadRequest)
        return
    }
    
    // Verificar timestamp
    ts, _ := strconv.ParseInt(timestamp, 10, 64)
    now := time.Now().Unix()
    if math.Abs(float64(now-ts)) > 300 {
        http.Error(w, "Timestamp too old", http.StatusUnauthorized)
        return
    }
    
    // Calcular assinatura
    signedPayload := timestamp + "." + string(payload)
    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write([]byte(signedPayload))
    expectedSignature := hex.EncodeToString(mac.Sum(nil))
    
    // Comparação segura
    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }
    
    // Processar evento
    var event map[string]interface{}
    json.Unmarshal(payload, &event)
    
    eventType := event["type"].(string)
    println("✅ Evento recebido:", eventType)
    
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]bool{"received": true})
}