feat: complete pragativeer v2 frontend and backend, docker setup, and cbt engine

backend/billing.py

@@ -0,0 +1,45 @@
+import os
+import hmac
+import hashlib
+from uuid import UUID
+
+# In a live environment, these are provided by the Razorpay Dashboard.
+# We use mock keys for the local sandbox.
+RAZORPAY_KEY_ID = os.getenv("RAZORPAY_KEY_ID", "rzp_test_local_sandbox")
+RAZORPAY_KEY_SECRET = os.getenv("RAZORPAY_KEY_SECRET", "local_secret_mock")
+RAZORPAY_WEBHOOK_SECRET = os.getenv("RAZORPAY_WEBHOOK_SECRET", "local_webhook_secret")
+
+def generate_mock_order(user_id: UUID, tier: str, amount_in_paise: int) -> dict:
+    """
+    Simulates the Razorpay Orders API response for local testing.
+    Normally this would call: razorpay_client.order.create(data)
+    """
+    import time
+    mock_order_id = f"order_{int(time.time())}_{str(user_id)[:8]}"
+    
+    return {
+        "id": mock_order_id,
+        "entity": "order",
+        "amount": amount_in_paise,
+        "currency": "INR",
+        "status": "created",
+        "notes": {
+            "user_id": str(user_id),
+            "tier_requested": tier
+        }
+    }
+
+def verify_webhook_signature(payload_body: str, signature_header: str) -> bool:
+    """
+    Cryptographically verifies that the webhook actually came from Razorpay.
+    """
+    if not signature_header:
+        return False
+        
+    expected_signature = hmac.new(
+        key=RAZORPAY_WEBHOOK_SECRET.encode('utf-8'),
+        msg=payload_body.encode('utf-8'),
+        digestmod=hashlib.sha256
+    ).hexdigest()
+    
+    return hmac.compare_digest(expected_signature, signature_header)