Sentinel

"""
Sentinel Webhook Validation Engine: HMAC Verification & Anti-Replay Protection
"""
import hmac
import hashlib
import time
from typing import Dict, Any, Optional
from pydantic import BaseModel, Field

class ValidationResult(BaseModel):
    authorized: bool
    status_code: int
    message: str
    drift_seconds: float

class SentinelValidator:
    def __init__(self, secret: str, max_drift_sec: int = 300):
        self.secret = secret.encode()
        self.max_drift_sec = max_drift_sec
        self.seen_nonces = set()

    def validate(self, body: bytes, signature_header: str, timestamp_header: str, nonce: str) -> ValidationResult:
        current_time = time.time()
        try:
            ts = float(timestamp_header)
        except ValueError:
            return ValidationResult(authorized=False, status_code=400, message="Malformed timestamp header", drift_seconds=999.0)

        drift = abs(current_time - ts)
        if drift > self.max_drift_sec:
            return ValidationResult(authorized=False, status_code=401, message=f"Timestamp expired (> {self.max_drift_sec}s)", drift_seconds=drift)

        if nonce in self.seen_nonces:
            return ValidationResult(authorized=False, status_code=409, message="Nonce replay detected", drift_seconds=drift)

        expected_sig = hmac.new(self.secret, f"{timestamp_header}.{nonce}".encode() + body, hashlib.sha256).hexdigest()

        if not hmac.compare_digest(expected_sig, signature_header):
            return ValidationResult(authorized=False, status_code=401, message="Cryptographic signature mismatch", drift_seconds=drift)

        self.seen_nonces.add(nonce)
        return ValidationResult(authorized=True, status_code=200, message="HMAC signature and timestamp verified", drift_seconds=drift)