import hmac
import hashlib
import base64
import json

# --- Helper function for safe header extraction ---
def get_header(headers, header_name):
    """
    Retrieve a header value from the headers dictionary, accounting for case-insensitivity.
    """
    for key, value in headers.items():
        if key.lower() == header_name.lower():
            return value
    return None

# --- Begin webhook signature validation ---

# 1. Retrieve the raw payload. 
#    IMPORTANT: Ensure this is the exact raw body as received.
raw_payload = input_data.get('body')
if not isinstance(raw_payload, str):
    # If the body is parsed into a dict, re-serialize it.
    # Note: This may not match the original raw payload if the provider’s JSON
    # encoding is different (e.g., whitespace, key ordering).
    raw_payload = json.dumps(raw_payload, separators=(',', ':'))

# 2. Retrieve the signature from headers.
headers = input_data.get('headers', {})
signature = get_header(headers, 'x-marker-signature')
if signature is None:
    return {'validation_status': 'failed', 'error': 'Missing signature header'}

# 3. Your secret token (replace with your actual secret key)
secret_token = 'your_marker_io_secret_token'

# 4. Compute the expected signature using HMAC with SHA-256.
digest = hmac.new(
    secret_token.encode('utf-8'),
    raw_payload.encode('utf-8'),
    hashlib.sha256
).digest()

# Base64-encode the computed digest.
expected_signature = base64.b64encode(digest).decode('utf-8')

# 5. Compare the provided signature to the expected signature using a timing-safe comparison.
if hmac.compare_digest(signature, expected_signature):
    return {'validation_status': 'success'}
else:
    return {'validation_status': 'failed'}