"""Proposed HMAC webhook verifier and synthetic self-test; not a backend claim."""
import base64,hashlib,hmac,json,time

def verify(raw, timestamp, event_id, signature, secret_b64, now, seen):
 if abs(now-int(timestamp))>300: raise ValueError('stale')
 message=(timestamp+'.'+event_id+'.').encode()+raw
 expected='v1='+hmac.new(base64.b64decode(secret_b64,validate=True),message,hashlib.sha256).hexdigest()
 if not hmac.compare_digest(expected,signature):raise ValueError('signature')
 parsed=json.loads(raw)
 if parsed['eventId']!=event_id:raise ValueError('event mismatch')
 if event_id in seen:return 'duplicate'
 seen.add(event_id) # replace with transactional durable inbox per tenant
 return 'accepted'

if __name__=='__main__':
 secret=base64.b64encode(b'synthetic-test-key-not-for-production').decode()
 raw=b'{"eventId":"evt-test-001","eventName":"EvidenceGenerated"}'
 ts='1792040400';eid='evt-test-001'
 mac='v1='+hmac.new(base64.b64decode(secret),(ts+'.'+eid+'.').encode()+raw,hashlib.sha256).hexdigest()
 seen=set();assert verify(raw,ts,eid,mac,secret,int(ts),seen)=='accepted'
 assert verify(raw,ts,eid,mac,secret,int(ts),seen)=='duplicate'
 for body,now in [(raw+b' ',int(ts)),(raw,int(ts)+301)]:
  try:verify(body,ts,eid,mac,secret,now,set())
  except ValueError:pass
  else:raise AssertionError('tamper/stale accepted')
 print('PASS: synthetic HMAC, duplicate, tamper and expiry tests')