paystack-webhook 0.1.1__tar.gz

paystack_webhook-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mgkvibez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

paystack_webhook-0.1.1/PKG-INFO

@@ -0,0 +1,189 @@
+Metadata-Version: 2.4
+Name: paystack-webhook
+Version: 0.1.1
+Summary: Verify Paystack and Flutterwave webhooks in Python: HMAC-SHA512, idempotency, replay-safe retries. Zero dependencies.
+Author: mgkvibez
+License: MIT
+Project-URL: Homepage, https://github.com/mgkvibez/paystack-webhooks
+Project-URL: Issues, https://github.com/mgkvibez/paystack-webhooks/issues
+Keywords: paystack,flutterwave,webhooks,payments,africa,nigeria,hmac,fastapi
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Framework :: FastAPI
+Classifier: Framework :: Flask
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: fastapi>=0.110; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
+Requires-Dist: flask>=3.0; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Dynamic: license-file
+
+# paystack-webhooks
+
+**Verify Paystack and Flutterwave webhooks in Python, including the part the docs skip: retries.**
+
+[![ci](https://github.com/mgkvibez/paystack-webhooks/actions/workflows/ci.yml/badge.svg)](https://github.com/mgkvibez/paystack-webhooks/actions/workflows/ci.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![python](https://img.shields.io/badge/python-3.9%2B-blue.svg)](pyproject.toml)
+[![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](pyproject.toml)
+
+```python
+from paystack_webhooks import PaystackWebhook
+
+paystack = PaystackWebhook("sk_live_...")
+
+event = paystack.process(raw_body, headers)   # None means you already handled it
+```
+
+That is the whole library. The rest of this page is why `process` exists and the
+four-line snippet on Stack Overflow is not enough.
+
+## The snippet everyone copies, and what it misses
+
+```python
+if hmac.new(key, request.body, hashlib.sha512).hexdigest() != request.headers["x-paystack-signature"]:
+    abort(401)
+```
+
+The signature check is right. Two other things are missing, and both cost money.
+
+**1. Retries.** Paystack and Flutterwave both retry when your endpoint does not return
+a 2xx: a timeout, a 500, a deploy that restarts the worker mid-request. Your handler
+then runs twice for one payment. If the second run grants value again, you have given
+away product, and no amount of signature checking prevents it.
+
+**2. Verifying after parsing.** If you call `request.json()` first, the bytes you
+hash are not the bytes that arrived: key order and whitespace change, the digest never
+matches, and the usual "fix" is to drop the check.
+
+This library handles the raw bytes, derives a stable event id, and gives you a
+single call that is safe to repeat.
+
+## Install
+
+```bash
+pipx install paystack-webhook
+```
+
+The distribution is called `paystack-webhook`, singular, because PyPI refused
+`paystack-webhooks` as too similar to a project that already exists. Nothing a user
+types changes: the import is `paystack_webhooks` and the repo keeps its name.
+
+Python 3.9+, **zero runtime dependencies**. FastAPI and Flask are optional extras that
+only the adapters import.
+
+## FastAPI
+
+```python
+from fastapi import FastAPI
+from paystack_webhooks import MemoryStore, PaystackWebhook
+from paystack_webhooks.contrib.fastapi import webhook_route
+
+app = FastAPI()
+
+def on_event(event):
+    if event.name == "charge.success":
+        fulfil(event.data["reference"], event.data["amount"])
+
+app.include_router(webhook_route(
+    PaystackWebhook("sk_live_..."),
+    store=MemoryStore(),          # dedupe across retries
+    on_event=on_event,
+    path="/webhooks/paystack",
+))
+```
+
+Duplicates return **200**, not 409. Both providers retry on non-2xx, so answering
+409 to something you already handled starts a retry storm.
+
+## Flask
+
+```python
+from flask import Flask
+from paystack_webhooks import MemoryStore, PaystackWebhook
+from paystack_webhooks.contrib.flask import webhook_view
+
+app = Flask(__name__)
+app.add_url_rule("/webhooks/paystack", methods=["POST"], view_func=webhook_view(
+    PaystackWebhook("sk_live_..."), store=MemoryStore(), on_event=on_event))
+```
+
+Anywhere else, the core is framework-agnostic: pass the raw bytes and a header mapping
+you can read case-insensitively.
+
+## Flutterwave, and the weaker guarantee it actually offers
+
+```python
+from paystack_webhooks import FlutterwaveWebhook
+
+flutterwave = FlutterwaveWebhook("your_verif_hash")
+event = flutterwave.process(raw_body, headers)
+```
+
+Flutterwave does not sign the body. It sends your static secret in a `verif-hash`
+header, which proves the sender knows the hash and nothing else. A valid header can
+accompany a tampered payload if the hash leaks. This library says so instead of
+implying parity with Paystack.
+
+## The security model, stated plainly
+
+| | Paystack | Flutterwave |
+|---|---|---|
+| What is checked | HMAC-SHA512 over the raw body | static `verif-hash` header |
+| Does it cover the body | yes | **no** |
+| Signed timestamp | none | none |
+| Replay defence | dedupe on `event_id` | dedupe, plus compare amount and currency |
+
+Neither provider sends a signed timestamp, so a "5 minute replay window" is theatre:
+there is nothing authentic to compare a clock against. Deduplication is the only
+honest defence available, which is why `event_id` is computed for you and why the store
+is part of the API.
+
+For Flutterwave, always compare `event.data["amount"]` and `currency` against your own
+record before fulfilling. The header cannot tell you the amount is right.
+
+## What this deliberately does not do
+
+- **It is not an API client.** Use `paystackapi` or `rave-python` to charge cards. This
+  library only consumes webhooks.
+- **It does not validate amounts for you.** That requires your records, not the payload.
+- **`MemoryStore` is single-process.** It is correct for one worker. On several
+  instances implement the four-line `Store` protocol against Redis or a table with a
+  unique constraint; a check-then-insert will race and double-charge.
+- **It does not decide your response codes for unknown events.** The adapter returns
+  200 and calls your handler; ignore event types you do not care about.
+
+## Errors map to status codes
+
+| Exception | Meaning | Status |
+|---|---|---|
+| `SignatureError` | wrong secret, forged header, tampered body | 401 |
+| `MalformedPayload` | valid signature, unusable body | 400 |
+| `RawBodyRequired` | you passed text or a dict instead of bytes | 500, and it is a bug in your code |
+
+## Tests
+
+The suite runs offline: signatures are computed in the tests with `hmac`/`hashlib`
+directly, so a bug in this library cannot make its own tests pass. It covers valid and
+forged signatures, tampered bodies, non-ASCII headers, text bodies, validly signed
+garbage, idempotency including a 50-thread race on one event id, TTL and capacity
+eviction, both adapters, and a check that importing the core pulls in no web framework.
+
+```bash
+pip install -e ".[dev]"
+python -m pytest -q
+bash scripts/verify.sh
+```
+
+## License
+
+MIT.

paystack_webhook-0.1.1/README.md

@@ -0,0 +1,160 @@
+# paystack-webhooks
+
+**Verify Paystack and Flutterwave webhooks in Python, including the part the docs skip: retries.**
+
+[![ci](https://github.com/mgkvibez/paystack-webhooks/actions/workflows/ci.yml/badge.svg)](https://github.com/mgkvibez/paystack-webhooks/actions/workflows/ci.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![python](https://img.shields.io/badge/python-3.9%2B-blue.svg)](pyproject.toml)
+[![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](pyproject.toml)
+
+```python
+from paystack_webhooks import PaystackWebhook
+
+paystack = PaystackWebhook("sk_live_...")
+
+event = paystack.process(raw_body, headers)   # None means you already handled it
+```
+
+That is the whole library. The rest of this page is why `process` exists and the
+four-line snippet on Stack Overflow is not enough.
+
+## The snippet everyone copies, and what it misses
+
+```python
+if hmac.new(key, request.body, hashlib.sha512).hexdigest() != request.headers["x-paystack-signature"]:
+    abort(401)
+```
+
+The signature check is right. Two other things are missing, and both cost money.
+
+**1. Retries.** Paystack and Flutterwave both retry when your endpoint does not return
+a 2xx: a timeout, a 500, a deploy that restarts the worker mid-request. Your handler
+then runs twice for one payment. If the second run grants value again, you have given
+away product, and no amount of signature checking prevents it.
+
+**2. Verifying after parsing.** If you call `request.json()` first, the bytes you
+hash are not the bytes that arrived: key order and whitespace change, the digest never
+matches, and the usual "fix" is to drop the check.
+
+This library handles the raw bytes, derives a stable event id, and gives you a
+single call that is safe to repeat.
+
+## Install
+
+```bash
+pipx install paystack-webhook
+```
+
+The distribution is called `paystack-webhook`, singular, because PyPI refused
+`paystack-webhooks` as too similar to a project that already exists. Nothing a user
+types changes: the import is `paystack_webhooks` and the repo keeps its name.
+
+Python 3.9+, **zero runtime dependencies**. FastAPI and Flask are optional extras that
+only the adapters import.
+
+## FastAPI
+
+```python
+from fastapi import FastAPI
+from paystack_webhooks import MemoryStore, PaystackWebhook
+from paystack_webhooks.contrib.fastapi import webhook_route
+
+app = FastAPI()
+
+def on_event(event):
+    if event.name == "charge.success":
+        fulfil(event.data["reference"], event.data["amount"])
+
+app.include_router(webhook_route(
+    PaystackWebhook("sk_live_..."),
+    store=MemoryStore(),          # dedupe across retries
+    on_event=on_event,
+    path="/webhooks/paystack",
+))
+```
+
+Duplicates return **200**, not 409. Both providers retry on non-2xx, so answering
+409 to something you already handled starts a retry storm.
+
+## Flask
+
+```python
+from flask import Flask
+from paystack_webhooks import MemoryStore, PaystackWebhook
+from paystack_webhooks.contrib.flask import webhook_view
+
+app = Flask(__name__)
+app.add_url_rule("/webhooks/paystack", methods=["POST"], view_func=webhook_view(
+    PaystackWebhook("sk_live_..."), store=MemoryStore(), on_event=on_event))
+```
+
+Anywhere else, the core is framework-agnostic: pass the raw bytes and a header mapping
+you can read case-insensitively.
+
+## Flutterwave, and the weaker guarantee it actually offers
+
+```python
+from paystack_webhooks import FlutterwaveWebhook
+
+flutterwave = FlutterwaveWebhook("your_verif_hash")
+event = flutterwave.process(raw_body, headers)
+```
+
+Flutterwave does not sign the body. It sends your static secret in a `verif-hash`
+header, which proves the sender knows the hash and nothing else. A valid header can
+accompany a tampered payload if the hash leaks. This library says so instead of
+implying parity with Paystack.
+
+## The security model, stated plainly
+
+| | Paystack | Flutterwave |
+|---|---|---|
+| What is checked | HMAC-SHA512 over the raw body | static `verif-hash` header |
+| Does it cover the body | yes | **no** |
+| Signed timestamp | none | none |
+| Replay defence | dedupe on `event_id` | dedupe, plus compare amount and currency |
+
+Neither provider sends a signed timestamp, so a "5 minute replay window" is theatre:
+there is nothing authentic to compare a clock against. Deduplication is the only
+honest defence available, which is why `event_id` is computed for you and why the store
+is part of the API.
+
+For Flutterwave, always compare `event.data["amount"]` and `currency` against your own
+record before fulfilling. The header cannot tell you the amount is right.
+
+## What this deliberately does not do
+
+- **It is not an API client.** Use `paystackapi` or `rave-python` to charge cards. This
+  library only consumes webhooks.
+- **It does not validate amounts for you.** That requires your records, not the payload.
+- **`MemoryStore` is single-process.** It is correct for one worker. On several
+  instances implement the four-line `Store` protocol against Redis or a table with a
+  unique constraint; a check-then-insert will race and double-charge.
+- **It does not decide your response codes for unknown events.** The adapter returns
+  200 and calls your handler; ignore event types you do not care about.
+
+## Errors map to status codes
+
+| Exception | Meaning | Status |
+|---|---|---|
+| `SignatureError` | wrong secret, forged header, tampered body | 401 |
+| `MalformedPayload` | valid signature, unusable body | 400 |
+| `RawBodyRequired` | you passed text or a dict instead of bytes | 500, and it is a bug in your code |
+
+## Tests
+
+The suite runs offline: signatures are computed in the tests with `hmac`/`hashlib`
+directly, so a bug in this library cannot make its own tests pass. It covers valid and
+forged signatures, tampered bodies, non-ASCII headers, text bodies, validly signed
+garbage, idempotency including a 50-thread race on one event id, TTL and capacity
+eviction, both adapters, and a check that importing the core pulls in no web framework.
+
+```bash
+pip install -e ".[dev]"
+python -m pytest -q
+bash scripts/verify.sh
+```
+
+## License
+
+MIT.

paystack_webhook-0.1.1/paystack_webhook.egg-info/PKG-INFO

@@ -0,0 +1,189 @@
+Metadata-Version: 2.4
+Name: paystack-webhook
+Version: 0.1.1
+Summary: Verify Paystack and Flutterwave webhooks in Python: HMAC-SHA512, idempotency, replay-safe retries. Zero dependencies.
+Author: mgkvibez
+License: MIT
+Project-URL: Homepage, https://github.com/mgkvibez/paystack-webhooks
+Project-URL: Issues, https://github.com/mgkvibez/paystack-webhooks/issues
+Keywords: paystack,flutterwave,webhooks,payments,africa,nigeria,hmac,fastapi
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Framework :: FastAPI
+Classifier: Framework :: Flask
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: fastapi>=0.110; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
+Requires-Dist: flask>=3.0; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Dynamic: license-file
+
+# paystack-webhooks
+
+**Verify Paystack and Flutterwave webhooks in Python, including the part the docs skip: retries.**
+
+[![ci](https://github.com/mgkvibez/paystack-webhooks/actions/workflows/ci.yml/badge.svg)](https://github.com/mgkvibez/paystack-webhooks/actions/workflows/ci.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![python](https://img.shields.io/badge/python-3.9%2B-blue.svg)](pyproject.toml)
+[![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](pyproject.toml)
+
+```python
+from paystack_webhooks import PaystackWebhook
+
+paystack = PaystackWebhook("sk_live_...")
+
+event = paystack.process(raw_body, headers)   # None means you already handled it
+```
+
+That is the whole library. The rest of this page is why `process` exists and the
+four-line snippet on Stack Overflow is not enough.
+
+## The snippet everyone copies, and what it misses
+
+```python
+if hmac.new(key, request.body, hashlib.sha512).hexdigest() != request.headers["x-paystack-signature"]:
+    abort(401)
+```
+
+The signature check is right. Two other things are missing, and both cost money.
+
+**1. Retries.** Paystack and Flutterwave both retry when your endpoint does not return
+a 2xx: a timeout, a 500, a deploy that restarts the worker mid-request. Your handler
+then runs twice for one payment. If the second run grants value again, you have given
+away product, and no amount of signature checking prevents it.
+
+**2. Verifying after parsing.** If you call `request.json()` first, the bytes you
+hash are not the bytes that arrived: key order and whitespace change, the digest never
+matches, and the usual "fix" is to drop the check.
+
+This library handles the raw bytes, derives a stable event id, and gives you a
+single call that is safe to repeat.
+
+## Install
+
+```bash
+pipx install paystack-webhook
+```
+
+The distribution is called `paystack-webhook`, singular, because PyPI refused
+`paystack-webhooks` as too similar to a project that already exists. Nothing a user
+types changes: the import is `paystack_webhooks` and the repo keeps its name.
+
+Python 3.9+, **zero runtime dependencies**. FastAPI and Flask are optional extras that
+only the adapters import.
+
+## FastAPI
+
+```python
+from fastapi import FastAPI
+from paystack_webhooks import MemoryStore, PaystackWebhook
+from paystack_webhooks.contrib.fastapi import webhook_route
+
+app = FastAPI()
+
+def on_event(event):
+    if event.name == "charge.success":
+        fulfil(event.data["reference"], event.data["amount"])
+
+app.include_router(webhook_route(
+    PaystackWebhook("sk_live_..."),
+    store=MemoryStore(),          # dedupe across retries
+    on_event=on_event,
+    path="/webhooks/paystack",
+))
+```
+
+Duplicates return **200**, not 409. Both providers retry on non-2xx, so answering
+409 to something you already handled starts a retry storm.
+
+## Flask
+
+```python
+from flask import Flask
+from paystack_webhooks import MemoryStore, PaystackWebhook
+from paystack_webhooks.contrib.flask import webhook_view
+
+app = Flask(__name__)
+app.add_url_rule("/webhooks/paystack", methods=["POST"], view_func=webhook_view(
+    PaystackWebhook("sk_live_..."), store=MemoryStore(), on_event=on_event))
+```
+
+Anywhere else, the core is framework-agnostic: pass the raw bytes and a header mapping
+you can read case-insensitively.
+
+## Flutterwave, and the weaker guarantee it actually offers
+
+```python
+from paystack_webhooks import FlutterwaveWebhook
+
+flutterwave = FlutterwaveWebhook("your_verif_hash")
+event = flutterwave.process(raw_body, headers)
+```
+
+Flutterwave does not sign the body. It sends your static secret in a `verif-hash`
+header, which proves the sender knows the hash and nothing else. A valid header can
+accompany a tampered payload if the hash leaks. This library says so instead of
+implying parity with Paystack.
+
+## The security model, stated plainly
+
+| | Paystack | Flutterwave |
+|---|---|---|
+| What is checked | HMAC-SHA512 over the raw body | static `verif-hash` header |
+| Does it cover the body | yes | **no** |
+| Signed timestamp | none | none |
+| Replay defence | dedupe on `event_id` | dedupe, plus compare amount and currency |
+
+Neither provider sends a signed timestamp, so a "5 minute replay window" is theatre:
+there is nothing authentic to compare a clock against. Deduplication is the only
+honest defence available, which is why `event_id` is computed for you and why the store
+is part of the API.
+
+For Flutterwave, always compare `event.data["amount"]` and `currency` against your own
+record before fulfilling. The header cannot tell you the amount is right.
+
+## What this deliberately does not do
+
+- **It is not an API client.** Use `paystackapi` or `rave-python` to charge cards. This
+  library only consumes webhooks.
+- **It does not validate amounts for you.** That requires your records, not the payload.
+- **`MemoryStore` is single-process.** It is correct for one worker. On several
+  instances implement the four-line `Store` protocol against Redis or a table with a
+  unique constraint; a check-then-insert will race and double-charge.
+- **It does not decide your response codes for unknown events.** The adapter returns
+  200 and calls your handler; ignore event types you do not care about.
+
+## Errors map to status codes
+
+| Exception | Meaning | Status |
+|---|---|---|
+| `SignatureError` | wrong secret, forged header, tampered body | 401 |
+| `MalformedPayload` | valid signature, unusable body | 400 |
+| `RawBodyRequired` | you passed text or a dict instead of bytes | 500, and it is a bug in your code |
+
+## Tests
+
+The suite runs offline: signatures are computed in the tests with `hmac`/`hashlib`
+directly, so a bug in this library cannot make its own tests pass. It covers valid and
+forged signatures, tampered bodies, non-ASCII headers, text bodies, validly signed
+garbage, idempotency including a 50-thread race on one event id, TTL and capacity
+eviction, both adapters, and a check that importing the core pulls in no web framework.
+
+```bash
+pip install -e ".[dev]"
+python -m pytest -q
+bash scripts/verify.sh
+```
+
+## License
+
+MIT.

paystack_webhook-0.1.1/paystack_webhook.egg-info/SOURCES.txt

@@ -0,0 +1,24 @@
+LICENSE
+README.md
+pyproject.toml
+paystack_webhook.egg-info/PKG-INFO
+paystack_webhook.egg-info/SOURCES.txt
+paystack_webhook.egg-info/dependency_links.txt
+paystack_webhook.egg-info/requires.txt
+paystack_webhook.egg-info/top_level.txt
+paystack_webhooks/__init__.py
+paystack_webhooks/errors.py
+paystack_webhooks/event.py
+paystack_webhooks/flutterwave.py
+paystack_webhooks/idempotency.py
+paystack_webhooks/paystack.py
+paystack_webhooks/signature.py
+paystack_webhooks/contrib/__init__.py
+paystack_webhooks/contrib/fastapi.py
+paystack_webhooks/contrib/flask.py
+tests/test_adapters.py
+tests/test_event.py
+tests/test_flutterwave.py
+tests/test_idempotency.py
+tests/test_paystack.py
+tests/test_signature.py

paystack_webhook-0.1.1/paystack_webhook.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

paystack_webhook-0.1.1/paystack_webhook.egg-info/requires.txt

@@ -0,0 +1,8 @@
+
+[dev]
+pytest>=8
+fastapi>=0.110
+httpx>=0.27
+flask>=3.0
+ruff>=0.4
+build>=1.0

paystack_webhook-0.1.1/paystack_webhook.egg-info/top_level.txt

@@ -0,0 +1 @@
+paystack_webhooks

paystack_webhook-0.1.1/paystack_webhooks/__init__.py

@@ -0,0 +1,28 @@
+"""Verify Paystack and Flutterwave webhooks without getting it wrong.
+
+    from paystack_webhooks import PaystackWebhook, MemoryStore
+
+    paystack = PaystackWebhook("sk_live_...")
+    event = paystack.process(raw_body, headers)   # None means already handled
+"""
+
+from .errors import MalformedPayload, RawBodyRequired, SignatureError, WebhookError
+from .event import Event
+from .flutterwave import FlutterwaveWebhook
+from .idempotency import MemoryStore, Store
+from .paystack import PaystackWebhook
+
+__version__ = "0.1.1"
+
+__all__ = [
+    "Event",
+    "FlutterwaveWebhook",
+    "MalformedPayload",
+    "MemoryStore",
+    "PaystackWebhook",
+    "RawBodyRequired",
+    "SignatureError",
+    "Store",
+    "WebhookError",
+    "__version__",
+]

paystack_webhook-0.1.1/paystack_webhooks/contrib/__init__.py

@@ -0,0 +1 @@
+"""Framework adapters. Importing this package pulls in nothing heavy."""

paystack_webhook-0.1.1/paystack_webhooks/contrib/fastapi.py

@@ -0,0 +1,46 @@
+"""Mount a verified webhook route in four lines.
+
+    app.include_router(webhook_route(PaystackWebhook(secret), store=MemoryStore()))
+
+Duplicates return 200 on purpose. Paystack retries on any non-2xx, so answering
+409 to a duplicate starts a retry storm for an event you already handled.
+"""
+
+import inspect
+from typing import Awaitable, Callable, Optional, Union
+
+from fastapi import APIRouter, HTTPException, Request
+
+from ..errors import MalformedPayload, RawBodyRequired, SignatureError
+from ..event import Event
+from ..idempotency import Store
+
+Handler = Callable[[Event], Union[None, Awaitable[None]]]
+
+
+def webhook_route(verifier, *, store: Optional[Store] = None,
+                  on_event: Optional[Handler] = None, path: str = "/webhooks/paystack"):
+    router = APIRouter()
+
+    @router.post(path)
+    async def receive(request: Request) -> dict:
+        body = await request.body()
+        try:
+            event = verifier.parse(body, request.headers)
+        except RawBodyRequired as exc:
+            raise HTTPException(status_code=500, detail=str(exc)) from exc
+        except SignatureError as exc:
+            raise HTTPException(status_code=401, detail="invalid signature") from exc
+        except MalformedPayload as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+        if store is not None and store.seen(event.event_id):
+            return {"status": "duplicate", "event_id": event.event_id}
+
+        if on_event is not None:
+            result = on_event(event)
+            if inspect.isawaitable(result):
+                await result
+        return {"status": "accepted", "event": event.name, "event_id": event.event_id}
+
+    return router