import hmac
import hashlib
import time
import logging
from typing import Optional, Dict, Any, Tuple
from threading import Lock

import orjson
from pydantic import BaseModel, Field, ValidationError

# Structured logging setup
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(name)s: %(message)s'
)
logger = logging.getLogger("WebhookSecurityPipeline")


class WebhookPayload(BaseModel):
    """Schema definition for incoming webhook payloads."""
    event_id: str = Field(..., description="Unique request/event identifier")
    event_type: str = Field(..., description="Classification of the domain event")
    timestamp: int = Field(..., description="UNIX epoch timestamp in seconds")
    data: Dict[str, Any] = Field(default_factory=dict, description="Arbitrary event payload data")


class WebhookSecurityConfig(BaseModel):
    """Configuration governing validation constraints and cryptographic secrets."""
    secret_key: str = Field(..., description="Shared secret key for HMAC verification")
    allowed_skew_seconds: int = Field(default=300, description="Maximum permitted clock drift in seconds")


class WebhookStorageManager:
    """Thread-safe in-memory cache with TTL for event de-duplication."""
    def __init__(self, ttl_seconds: int = 600):
        self._cache: Dict[str, float] = {}
        self._lock = Lock()
        self._ttl = ttl_seconds

    def check_and_mark(self, event_id: str) -> bool:
        """
        Atomically inspect and record an event ID.
        Returns True if the ID was previously processed; False if newly registered.
        """
        with self._lock:
            self._cleanup_expired()
            if event_id in self._cache:
                return True
            self._cache[event_id] = time.time() + self._ttl
            return False

    def _cleanup_expired(self) -> None:
        current_time = time.time()
        expired_keys = [k for k, v in self._cache.items() if v < current_time]
        for k in expired_keys:
            del self._cache[k]


class WebhookVerifier:
    """End-to-end validator for cryptographic verification, parsing, and replay protection."""
    def __init__(self, config: WebhookSecurityConfig, storage: WebhookStorageManager):
        self.config = config
        self.storage = storage

    def verify_signature(self, raw_body: bytes, received_signature: str) -> bool:
        """Constant-time HMAC-SHA256 signature verification."""
        if not received_signature:
            return False

        sig_hash = received_signature
        if received_signature.startswith("sha256="):
            sig_hash = received_signature.split("=", 1)[1]

        computed_mac = hmac.new(
            self.config.secret_key.encode('utf-8'),
            raw_body,
            hashlib.sha256
        ).hexdigest()

        return hmac.compare_digest(computed_mac, sig_hash)

    def verify_timestamp(self, timestamp: int) -> bool:
        """Validates whether the payload timestamp resides within the allowed clock skew window."""
        current_time = int(time.time())
        time_diff = abs(current_time - timestamp)
        return time_diff <= self.config.allowed_skew_seconds

    def process_request(self, raw_body: bytes, received_signature: str) -> Tuple[bool, str, Optional[WebhookPayload]]:
        """
        Orchestrates full-pipeline validation.
        Fails fast upon encountering the first invalid security or schema gate.
        """
        # Step 1: Signature Verification (Constant-Time HMAC)
        if not self.verify_signature(raw_body, received_signature):
            logger.warning(
                "Webhook security incident: Invalid signature detected.",
                extra={"signature": received_signature}
            )
            return False, "INVALID_SIGNATURE", None

        # Step 2: JSON Deserialization (utilizing high-throughput orjson parser)
        try:
            parsed_data = orjson.loads(raw_body)
        except orjson.JSONDecodeError as e:
            logger.error(f"Webhook parse error: Malformed JSON. Details: {e}")
            return False, "MALFORMED_JSON", None

        # Step 3: Schema Validation with Pydantic
        try:
            payload = WebhookPayload(**parsed_data)
        except ValidationError as e:
            logger.error(
                "Webhook validation error: Schema mismatch.",
                extra={"validation_errors": e.errors()}
            )
            return False, "SCHEMA_VALIDATION_FAILED", None

        # Step 4: Clock Skew Verification (Bounded Replay Attack Defense)
        if not self.verify_timestamp(payload.timestamp):
            logger.warning(
                "Webhook security incident: Timestamp out of allowed window.",
                extra={
                    "event_id": payload.event_id,
                    "payload_timestamp": payload.timestamp,
                    "server_timestamp": int(time.time()),
                    "allowed_skew": self.config.allowed_skew_seconds
                }
            )
            return False, "EXPIRED_TIMESTAMP", None

        # Step 5: De-duplication Check (Atomic Concurrency Control)
        if self.storage.check_and_mark(payload.event_id):
            logger.warning(
                "Webhook security incident: Duplicate event ID detected (Replay attack vector).",
                extra={"event_id": payload.event_id}
            )
            return False, "DUPLICATE_REQUEST", None

        logger.info(
            "Webhook successfully verified and processed.",
            extra={"event_id": payload.event_id, "event_type": payload.event_type}
        )
        return True, "SUCCESS", payload

Traceback (most recent call last):
  File "/home/phenox/gemini-sandbox/TOAI_Workspace/V2_SandBox/V2_PROD_20261024_034207_test.py", line 8, in <module>
    import orjson
ModuleNotFoundError: No module named 'orjson'