import hmac
import hashlib
import os
from flask import Flask, request, jsonify
app = Flask(__name__)
def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
if not signature.startswith('sha256='):
return False
expected = hmac.new(
secret.encode('utf-8'),
payload,
hashlib.sha256
).hexdigest()
received = signature[7:] # Remove "sha256=" prefix
return hmac.compare_digest(received, expected)
@app.route('/webhooks/reevit', methods=['POST'])
def webhook():
payload = request.get_data()
signature = request.headers.get('X-Reevit-Signature', '')
secret = os.environ.get('REEVIT_WEBHOOK_SECRET', '')
if secret and not verify_signature(payload, signature, secret):
return jsonify({'error': 'Invalid signature'}), 401
event = request.get_json()
event_type = event.get('type')
if event_type == 'payment.succeeded':
data = event.get('data', {})
order_id = data.get('metadata', {}).get('order_id')
# Fulfill order, send confirmation email
print(f"Payment succeeded for order {order_id}")
elif event_type == 'payment.failed':
# Notify customer, allow retry
pass
return jsonify({'received': True})