Shangrilux Public API.
Integra tutto.

import hmac
import hashlib
from fastapi import Request, HTTPException

WEBHOOK_SECRET = "il_tuo_secret_shangrilux"  # da salvare in .env

async def verify_shangrilux_signature(request: Request) -> dict:
    """Verifica la firma HMAC-SHA256 del webhook Shangrilux."""
    signature_header = request.headers.get("X-Shangrilux-Signature", "")
    event_type = request.headers.get("X-Shangrilux-Event", "")

    body = await request.body()

    # Calcola HMAC-SHA256 del body raw con il tuo secret
    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode("utf-8"),
        body,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature_header):
        raise HTTPException(status_code=401, detail="Firma webhook non valida.")

    import json
    payload = json.loads(body)
    return payload

# Endpoint FastAPI di esempio
from fastapi import APIRouter
router = APIRouter()

@router.post("/webhook/shangrilux")
async def receive_webhook(request: Request):
    payload = await verify_shangrilux_signature(request)
    event = payload.get("event")

    if event == "booking.created":
        booking = payload["data"]
        print(f"Nuova prenotazione: {booking['guest_name']} → {booking['property_id']}")
        # Sincronizza con il tuo PMS qui...

    elif event == "booking.confirmed":
        print(f"Prenotazione confermata: {payload['data']['id']}")

    return {"received": True}

const express = require('express');
const crypto = require('crypto');

const WEBHOOK_SECRET = process.env.SHANGRILUX_SECRET; // da .env

// Middleware: verifica firma HMAC-SHA256
function verifyShangriluxSignature(req, res, next) {
  const signatureHeader = req.headers['x-shangrilux-signature'] || '';
  const rawBody = req.rawBody; // richiede bodyParser con verify

  if (!rawBody) {
    return res.status(400).json({ error: 'Body grezzo non disponibile.' });
  }

  const expected = 'sha256=' + crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(rawBody)
    .digest('hex');

  // Usa timingSafeEqual per prevenire timing attacks
  const sigBuffer = Buffer.from(signatureHeader);
  const expBuffer = Buffer.from(expected);

  if (sigBuffer.length !== expBuffer.length ||
      !crypto.timingSafeEqual(sigBuffer, expBuffer)) {
    return res.status(401).json({ error: 'Firma webhook non valida.' });
  }

  next();
}

const app = express();

// IMPORTANTE: usa il middleware con il body raw per l'HMAC
app.use('/webhook/shangrilux', express.json({
  verify: (req, res, buf) => { req.rawBody = buf; }
}));

app.post('/webhook/shangrilux', verifyShangriluxSignature, (req, res) => {
  const { event, data, tenant } = req.body;

  switch (event) {
    case 'booking.created':
      console.log(`Nuova prenotazione da ${tenant}:`, data.guest_name);
      // Sincronizza con PMS...
      break;
    case 'booking.confirmed':
      console.log(`Confermata prenotazione:`, data.id);
      break;
    case 'access.command':
      console.log(`Comando accesso:`, data.command, 'su', data.device);
      break;
  }

  res.json({ received: true });
});

app.listen(3000);