"""Razorpay webhook endpoint — the authoritative source of payment status.

Server-to-server POST from Razorpay. It carries no session/CSRF token; it is
authenticated by its HMAC signature (``X-Razorpay-Signature``) verified against
``RAZORPAY_WEBHOOK_SECRET`` before any processing. This endpoint is registered
CSRF-exempt in the app factory.

Processing is idempotent (see :func:`app.payments.services.handle_webhook_event`)
so Razorpay's at-least-once delivery — and retries on non-2xx — can never create
duplicate premium activations.
"""

from __future__ import annotations

from flask import current_app, request

from app.payments import payments_bp, razorpay_service, services


@payments_bp.route("/webhook/razorpay", methods=["POST"])
def razorpay_webhook():
    """Verify the signature, then process the event idempotently."""
    signature = request.headers.get("X-Razorpay-Signature", "")
    body = request.get_data(as_text=True)

    # Reject anything we cannot cryptographically attribute to Razorpay.
    if not razorpay_service.verify_webhook_signature(body, signature):
        return "", 400

    payload = request.get_json(silent=True) or {}
    event_type = payload.get("event", "")
    try:
        services.handle_webhook_event(event_type, payload)
    except Exception:  # noqa: BLE001 - return 500 so Razorpay retries the delivery
        current_app.logger.exception("Razorpay webhook processing failed for %s", event_type)
        return "", 500
    # 200 acknowledges receipt; unhandled events are accepted (and ignored) too.
    return "", 200