import requests

response = requests.post(
    "https://api.saturday.fit/v1/webhooks",
    headers={"Authorization": "Bearer sk_test_abc123def456"},
    json={
        "url": "https://your-app.com/webhooks/saturday",
        "events": [
            "prescription.calculated",
            "athlete.updated",
            "athlete.created",
        ],
    },
)

webhook = response.json()
# Save webhook["secret"] — you need it to verify signatures
print(f"Webhook secret: {webhook['secret']}")

import hashlib
import hmac
import time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_webhook_secret_here"

@app.route("/webhooks/saturday", methods=["POST"])
def handle_webhook():
    # 1. Extract signature header
    signature_header = request.headers.get("X-Saturday-Signature")
    if not signature_header:
        abort(400, "Missing signature header")

    # 2. Parse timestamp and signature
    parts = signature_header.split(",")
    timestamp = None
    signature = None
    for part in parts:
        key, value = part.split("=", 1)
        if key == "t":
            timestamp = value
        elif key == "v1":
            signature = value

    if not timestamp or not signature:
        abort(400, "Invalid signature format")

    # 3. Reject stale timestamps (5-minute replay window)
    if abs(time.time() - int(timestamp)) > 300:
        abort(400, "Timestamp too old — possible replay attack")

    # 4. Compute expected signature
    raw_body = request.get_data(as_text=True)
    signed_payload = f"{timestamp}.{raw_body}"
    expected = hmac.new(
        WEBHOOK_SECRET.encode("utf-8"),
        signed_payload.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    # 5. Constant-time comparison
    if not hmac.compare_digest(expected, signature):
        abort(400, "Invalid signature")

    # 6. Process the event
    event = request.json
    print(f"Received event: {event['type']}")

    # Always return 200 quickly — process async if needed
    return "", 200