CARD_AUTHORIZATION_VERIFY

import json
from flask import Flask, request, jsonify, abort
import hmac, hashlib, time

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_secret_here"

def verify_fyatu_signature(payload_bytes, signature_header, secret):
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    ts = parts.get("t", "")
    received = parts.get("v1", "")
    if abs(time.time() - int(ts)) > 300:
        return False
    signed = f"{ts}.{payload_bytes.decode()}"
    expected = hmac.new(secret.encode(), signed.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)

@app.route("/fyatu/authorization", methods=["POST"])
def authorize():
    sig = request.headers.get("X-Fyatu-Signature", "")
    if not verify_fyatu_signature(request.data, sig, WEBHOOK_SECRET):
        abort(401)

    event = request.get_json()
    data        = event["data"]
    action_type = data["type"]
    card_id     = data["cardId"]
    amount      = data["amount"]
    fee         = data.get("feeAmount", 0)
    mcc         = data.get("merchantMcc", "")

    if action_type == "AUTHORIZATION_VERIFY":
        return jsonify({"decision": "APPROVE"})

    BLOCKED_MCCS = {"7995", "7994", "7993"}
    if mcc in BLOCKED_MCCS:
        return jsonify({"decision": "DECLINE", "reason": "INVALID_MERCHANT"})

    if exceeds_card_limit(card_id, amount + fee):
        return jsonify({"decision": "DECLINE", "reason": "VELOCITY_EXCEED"})

    return jsonify({"decision": "APPROVE"})

import express from 'express'
import crypto from 'crypto'

const app = express()
app.use(express.raw({ type: 'application/json' }))

const WEBHOOK_SECRET = process.env.FYATU_WEBHOOK_SECRET!

function verifySignature(payload: Buffer, header: string): boolean {
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=')))
  const ts = parts['t']
  const received = parts['v1']
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false
  const signed = `${ts}.${payload.toString()}`
  const expected = crypto.createHmac('sha256', WEBHOOK_SECRET).update(signed).digest('hex')
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
}

app.post('/fyatu/authorization', (req, res) => {
  const sig = req.headers['x-fyatu-signature'] as string
  if (!verifySignature(req.body, sig)) return res.status(401).send()

  const event = JSON.parse(req.body.toString())
  const { type, cardId, amount, feeAmount = 0, merchantMcc } = event.data

  if (type === 'AUTHORIZATION_VERIFY') {
    return res.json({ decision: 'APPROVE' })
  }

  const BLOCKED_MCCS = new Set(['7995', '7994', '7993'])
  if (BLOCKED_MCCS.has(merchantMcc)) {
    return res.json({ decision: 'DECLINE', reason: 'INVALID_MERCHANT' })
  }

  if (exceedsCardLimit(cardId, amount + feeAmount)) {
    return res.json({ decision: 'DECLINE', reason: 'VELOCITY_EXCEED' })
  }

  return res.json({ decision: 'APPROVE' })
})