import os
import hmac
import hashlib
from uuid import UUID

# In a live environment, these are provided by the Razorpay Dashboard.
# We use mock keys for the local sandbox.
RAZORPAY_KEY_ID = os.getenv("RAZORPAY_KEY_ID", "rzp_test_local_sandbox")
RAZORPAY_KEY_SECRET = os.getenv("RAZORPAY_KEY_SECRET", "local_secret_mock")
RAZORPAY_WEBHOOK_SECRET = os.getenv("RAZORPAY_WEBHOOK_SECRET", "local_webhook_secret")

def generate_mock_order(user_id: UUID, tier: str, amount_in_paise: int) -> dict:
    """
    Simulates the Razorpay Orders API response for local testing.
    Normally this would call: razorpay_client.order.create(data)
    """
    import time
    mock_order_id = f"order_{int(time.time())}_{str(user_id)[:8]}"
    
    return {
        "id": mock_order_id,
        "entity": "order",
        "amount": amount_in_paise,
        "currency": "INR",
        "status": "created",
        "notes": {
            "user_id": str(user_id),
            "tier_requested": tier
        }
    }

def verify_webhook_signature(payload_body: str, signature_header: str) -> bool:
    """
    Cryptographically verifies that the webhook actually came from Razorpay.
    """
    if not signature_header:
        return False
        
    expected_signature = hmac.new(
        key=RAZORPAY_WEBHOOK_SECRET.encode('utf-8'),
        msg=payload_body.encode('utf-8'),
        digestmod=hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(expected_signature, signature_header)