"""Offline webhook consumer demonstration. Python 3 standard library only.

Run: python3 webhook-retries-demo.py [--json]
Uses synthetic signed events and a temporary SQLite database, never a live API.
This is a transaction example, not an HTTP server or a fulfillment integration.
"""
import hashlib
import hmac
import json
import sqlite3
import sys
import tempfile
from pathlib import Path


def setup(db):
    db.executescript('''
        CREATE TABLE IF NOT EXISTS inbox (
            receiver TEXT NOT NULL, delivery TEXT NOT NULL, digest TEXT NOT NULL,
            PRIMARY KEY (receiver, delivery)
        );
        CREATE TABLE IF NOT EXISTS order_updates (
            receiver TEXT NOT NULL, order_id TEXT NOT NULL, event TEXT NOT NULL,
            PRIMARY KEY (receiver, order_id, event)
        );
    ''')


def consume(db, raw, signature, delivery_id, secret, receiver):
    expected = 'sha256=' + hmac.new(secret, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, signature):
        return 'invalid signature'
    event = json.loads(raw)
    if event.get('event') != 'checkout.completed':
        raise ValueError('unsupported event')
    order_id = event.get('order', {}).get('id')
    if not isinstance(order_id, str) or not order_id or not delivery_id:
        raise ValueError('order ID and delivery ID are required')
    digest = hashlib.sha256(raw).hexdigest()
    # The delivery marker and the local order update commit together.
    # A unique constraint serializes concurrent claims of the same delivery.
    with db:
        inserted = db.execute(
            'INSERT OR IGNORE INTO inbox VALUES (?, ?, ?)',
            (receiver, delivery_id, digest),
        ).rowcount
        if not inserted:
            previous = db.execute(
                'SELECT digest FROM inbox WHERE receiver=? AND delivery=?',
                (receiver, delivery_id),
            ).fetchone()[0]
            if previous != digest:
                raise ValueError('delivery ID reused with a different body')
            return 'duplicate skipped'
        updated = db.execute(
            'INSERT OR IGNORE INTO order_updates VALUES (?, ?, ?)',
            (receiver, order_id, event['event']),
        ).rowcount
        return 'order updated' if updated else 'order already updated'


def demo():
    # Public fixture secret. Never use this value for a real endpoint.
    secret = b'offline-demo-only'
    raw = b'{"event":"checkout.completed","order":{"id":"demo-order-42"}}'
    signature = 'sha256=' + hmac.new(secret, raw, hashlib.sha256).hexdigest()
    receiver = 'demo-merchant'  # Trusted endpoint configuration, not a header.
    with tempfile.TemporaryDirectory(prefix='ordercore-webhook-demo-') as tmp:
        path = Path(tmp) / 'consumer.sqlite'
        with sqlite3.connect(path) as db:
            setup(db)
            first = consume(db, raw, signature, 'delivery-42', secret, receiver)
        db.close()
        # Reopen the database to prove deduplication survives a process restart.
        with sqlite3.connect(path) as db:
            retry = consume(db, raw, signature, 'delivery-42', secret, receiver)
            count = db.execute('SELECT COUNT(*) FROM order_updates').fetchone()[0]
            tampered = consume(db, raw + b' ', signature, 'delivery-43', secret, receiver)
            another_endpoint = consume(db, raw, signature, 'delivery-99', secret, receiver)
            final_count = db.execute('SELECT COUNT(*) FROM order_updates').fetchone()[0]
        db.close()
    assert (first, retry, count) == ('order updated', 'duplicate skipped', 1)
    assert tampered == 'invalid signature'
    assert another_endpoint == 'order already updated' and final_count == 1
    return {
        'mode': 'offline demo; synthetic event; temporary SQLite database',
        'event': 'checkout.completed', 'delivery_id': 'delivery-42',
        'first_delivery': first, 'retry_after_reopen': retry, 'order_updates': count,
        'tampered_body': tampered, 'other_delivery_id': another_endpoint,
        'final_order_updates': final_count,
    }


if __name__ == '__main__':
    result = demo()
    if '--json' in sys.argv:
        print(json.dumps(result, indent=2))
    else:
        print('OrderCore | offline webhook consumer demo')
        print('Synthetic event. No network or payment calls.\n')
        print('First delivery:       ' + result['first_delivery'])
        print('Retry after restart:  ' + result['retry_after_reopen'])
        print('Order updates:        ' + str(result['order_updates']))
        print('Tampered body:        ' + result['tampered_body'])
        print('Other delivery ID:    ' + result['other_delivery_id'])
        print('\nPASS: all checks; one local order update.')