import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.util.DigestUtils;
import org.springframework.web.bind.annotation;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.HashMap;
import java.util.Map;

@SpringBootApplication
@RestController
public class CallbackApplication {

    private static final String SHARED_SECRET = "HMAC_KEY";

    public static void main(String args) {
        SpringApplication.run(CallbackApplication.class, args);
    }

    @PostMapping(value = "/callback", consumes = MediaType.APPLICATION_JSON_VALUE)
    public ResponseEntity handleCallback(@RequestBody String rawBody,
                                            @RequestHeader(value = "X-Signature", required = false) String signature) {
        try {
            // 1) Read the raw body (JSON)
            String raw = rawBody;

            // 2) Retrieve the headers
            String providedSignature = (signature != null) ? signature : "";

            // 3) (Optional) Verify the HMAC signature
            String expected = hmacSha256(raw, SHARED_SECRET);
            if (!secureCompare(expected, providedSignature)) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                        .contentType(MediaType.TEXT_PLAIN)
                        .body("Invalid signature");
            }

            // 4) Decode the JSON
            Map data;
            try {
                data = new com.fasterxml.jackson.databind.ObjectMapper().readValue(raw, Map.class);
            } catch (Exception e) {
                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
                        .contentType(MediaType.TEXT_PLAIN)
                        .body("Invalid JSON");
            }

            // 5) Process the data
            // data contains what the client sent in the payload
            // For example: data.get("id"), data.get("results"), etc.

            // 6) Respond in JSON (optional, we log these responses for tracking purposes)
            Map response = new HashMap<>();
            response.put("status", "ok");
            response.put("received_at", Instant.now().toString());
            response.put("echo", data.get("id"));

            return ResponseEntity.ok()
                    .contentType(MediaType.APPLICATION_JSON)
                    .body(response);

        } catch (Exception e) {
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                    .contentType(MediaType.TEXT_PLAIN)
                    .body("Server error");
        }
    }

    // Helper method: compute HMAC SHA-256
    private String hmacSha256(String data, String secret) throws Exception {
        Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        sha256_HMAC.init(secretKey);
        byte hash = sha256_HMAC.doFinal(data.getBytes(StandardCharsets.UTF_8));
        return bytesToHex(hash);
    }

    // Helper method: secure string comparison (to avoid timing attacks)
    private boolean secureCompare(String a, String b) {
        if (a == null || b == null || a.length() != b.length()) {
            return false;
        }
        int result = 0;
        for (int i = 0; i < a.length(); i++) {
            result |= a.charAt(i) ^ b.charAt(i);
        }
        return result == 0;
    }

    // Helper method: convert bytes to hex string
    private String bytesToHex(byte bytes) {
        StringBuilder hexString = new StringBuilder(2 bytes.length);
        for (byte b : bytes) {
            String hex = Integer.toHexString(0xff & b);
            if (hex.length() == 1) hexString.append('0');
            hexString.append(hex);
        }
        return hexString.toString();
    }
}