"""Python 3, standard library. Run behind an HTTPS ingress; secrets stay in env."""
import os, json, time, base64, hashlib, hmac, sqlite3
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRETS = [s for s in os.environ.get("LIVETP_WEBHOOK_SECRET", "").split(",") if s]
if not SECRETS:
    raise RuntimeError("Configure LIVETP_WEBHOOK_SECRET")
DB = sqlite3.connect(os.environ.get("LIVETP_WEBHOOK_INBOX", "livetp-webhooks.sqlite"))
DB.execute("CREATE TABLE IF NOT EXISTS inbox (environment TEXT, id TEXT, payload TEXT, received_at INTEGER, processed INTEGER DEFAULT 0, PRIMARY KEY(environment,id))")
DB.commit()

class Receiver(BaseHTTPRequestHandler):
    def log_message(self, *_):
        pass

    def reply(self, status, data):
        body = json.dumps(data).encode()
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def do_POST(self):
        if self.path != "/livetp":
            return self.reply(404, {"error": "not_found"})
        try:
            size = int(self.headers.get("Content-Length", "0"))
            if size <= 0 or size > 16384:
                return self.reply(413, {"error": "invalid_size"})
            body = self.rfile.read(size)
            event_id = self.headers.get("webhook-id", "")
            timestamp = self.headers.get("webhook-timestamp", "")
            signatures = self.headers.get("webhook-signature", "").split(" ")
            valid = timestamp.isdigit() and abs(time.time() - int(timestamp)) <= 300
            message = event_id.encode() + b"." + timestamp.encode() + b"." + body
            matches = False
            for secret in SECRETS:
                key = base64.b64decode(secret.removeprefix("whsec_"), validate=True)
                expected = "v1," + base64.b64encode(hmac.new(key, message, hashlib.sha256).digest()).decode()
                matches |= any(hmac.compare_digest(expected, s) for s in signatures)
            if not valid or not matches:
                return self.reply(401, {"error": "invalid_signature"})
            event = json.loads(body)
            if event["id"] != event_id or event["environment"] not in ("development", "staging", "production"):
                return self.reply(422, {"error": "invalid_event"})
            if event["type"] == "webhook.test":
                return self.reply(200, {"challenge": event["data"]["challenge"]})
            cursor = DB.execute("INSERT OR IGNORE INTO inbox(environment,id,payload,received_at) VALUES(?,?,?,?)", (event["environment"], event_id, body.decode(), int(time.time())))
            DB.commit()
            self.reply(202, {"received": True, "duplicate": cursor.rowcount == 0})
        except Exception:
            DB.rollback()
            self.reply(503, {"error": "receiver_unavailable"})

HTTPServer(("127.0.0.1", int(os.environ.get("PORT", "8787"))), Receiver).serve_forever()