CARD_AUTHORIZATION_VERIFY

import json
from flask import Flask, request, jsonify, abort
import hmac, hashlib, time

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_secret_here"

def verify_fyatu_signature(payload_bytes, signature_header, secret):
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    ts = parts.get("t", "")
    received = parts.get("v1", "")
    if abs(time.time() - int(ts)) > 300:
        return False
    signed = f"{ts}.{payload_bytes.decode()}"
    expected = hmac.new(secret.encode(), signed.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)

@app.route("/fyatu/authorization", methods=["POST"])
def authorize():
    sig = request.headers.get("X-Fyatu-Signature", "")
    if not verify_fyatu_signature(request.data, sig, WEBHOOK_SECRET):
        abort(401)

    event = request.get_json()
    data        = event["data"]
    action_type = data["type"]
    card_id     = data["cardId"]
    amount      = data["amount"]
    fee         = data.get("feeAmount", 0)
    mcc         = data.get("merchantMcc", "")

    if action_type == "AUTHORIZATION_VERIFY":
        return jsonify({"decision": "APPROVE"})

    BLOCKED_MCCS = {"7995", "7994", "7993"}
    if mcc in BLOCKED_MCCS:
        return jsonify({"decision": "DECLINE", "reason": "INVALID_MERCHANT"})

    if exceeds_card_limit(card_id, amount + fee):
        return jsonify({"decision": "DECLINE", "reason": "VELOCITY_EXCEED"})

    return jsonify({"decision": "APPROVE"})