import hmac
import hashlib
import time

def verify_convoy_signature(signature_header: str, secret: str,
                            method: str, path: str, body: str):
    """Verify HMAC signature from Convoy proxy."""
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    timestamp = int(parts["t"])

    if abs(time.time() - timestamp) > 300:
        raise ValueError("Signature expired")

    payload = f"{timestamp}\n{method.upper()}\n{path}\n{body}"
    expected = hmac.new(
        secret.strip().encode(), payload.encode(), hashlib.sha256
    ).hexdigest()

    # v1 = current secret, v2 = previous secret (during rotation)
    # Your env has one secret — it will match whichever version was signed with it
    for v in ["v1", "v2"]:
        if v in parts and hmac.compare_digest(parts[v], expected):
            return
    raise ValueError("Invalid signature")

import crypto from "crypto";

function verifyConvoySignature(
  signatureHeader: string,
  secret: string,
  method: string,
  path: string,
  body: string
) {
  const parts: Record<string, string> = {};
  for (const part of signatureHeader.split(",")) {
    const [key, value] = part.split("=", 2);
    parts[key] = value;
  }

  const timestamp = parseInt(parts.t, 10);

  if (Math.abs(Date.now() / 1000 - timestamp) > 300) {
    throw new Error("Signature expired");
  }

  const payload = `${timestamp}\n${method.toUpperCase()}\n${path}\n${body}`;
  const expected = crypto
    .createHmac("sha256", secret.trim())
    .update(payload)
    .digest("hex");

  // v1 = current secret, v2 = previous secret (during rotation)
  // Your env has one secret — it will match whichever version was signed with it
  for (const v of ["v1", "v2"]) {
    if (
      parts[v] &&
      crypto.timingSafeEqual(
        Buffer.from(parts[v], "hex"),
        Buffer.from(expected, "hex")
      )
    ) {
      return;
    }
  }
  throw new Error("Invalid signature");
}

import asyncio
import httpx
import time
import os

async def handle_agent_request(request):
    # 1. Verify signature — reject immediately if invalid
    try:
        verify_convoy_signature(
            request.headers["X-Convoy-Signature"],
            os.environ["CONVOY_SECRET"].strip(),
            request.method,
            request.url.path + ("?" + request.url.query if request.url.query else ""),
            await request.body(),
        )
    except (ValueError, KeyError):
        return JSONResponse(status_code=401, content={"error": "Unauthorized"})

    # 2. Extract Convoy headers
    session_id = request.headers["Session-ID"]
    agent_name = request.headers["X-Convoy-Agent-Name"]
    version_name = request.headers["X-Convoy-Version-Name"]

    # 3. Run your agent and measure
    start = time.time()
    result = await run_agent(request)  # your agent logic
    latency_ms = int((time.time() - start) * 1000)

    # 4. Report metrics (fire-and-forget with retries)
    payload = {
        "session_id": session_id,
        "agent_name": agent_name,
        "version_name": version_name,
        "outcome": "success" if result.ok else "error",
        "is_last_step": result.is_done,
        "step_index": result.step_index,
        "attempt_number": result.attempt_number,
    }
    if result.ok:
        payload["input"] = result.input
        payload["latency_ms"] = latency_ms
        payload["cost_usd"] = result.token_cost
        if result.is_done:
            payload["output"] = result.response
    else:
        # On error, include what's available — don't fabricate values
        if result.input:
            payload["input"] = result.input
        if latency_ms:
            payload["latency_ms"] = latency_ms

    async def report():
        async with httpx.AsyncClient() as client:
            for attempt in range(3):
                try:
                    r = await client.post(
                        "https://api.convoylabs.com/v1/ingest/sessions",
                        headers={"Authorization": f"Bearer {os.environ['CONVOY_SECRET'].strip()}"},
                        json=payload,
                    )
                    if r.status_code < 500:
                        return
                except httpx.TransportError:
                    pass
                await asyncio.sleep(0.5 * 2 ** attempt)

    asyncio.create_task(report())

    # 5. Return response to user
    return result.response

import express from "express";

app.post("/agent", async (req, res) => {
  // 1. Verify signature — reject immediately if invalid
  try {
    verifyConvoySignature(
      req.headers["x-convoy-signature"] as string,
      process.env.CONVOY_SECRET!.trim(),
      req.method,
      req.originalUrl,
      JSON.stringify(req.body)
    );
  } catch {
    return res.status(401).json({ error: "Unauthorized" });
  }

  // 2. Extract Convoy headers
  const sessionId = req.headers["session-id"] as string;
  const agentName = req.headers["x-convoy-agent-name"] as string;
  const versionName = req.headers["x-convoy-version-name"] as string;

  // 3. Run your agent and measure
  const start = Date.now();
  const result = await runAgent(req.body); // your agent logic
  const latencyMs = Date.now() - start;

  // 4. Report metrics (fire-and-forget with retries)
  const payload: Record<string, unknown> = {
    session_id: sessionId,
    agent_name: agentName,
    version_name: versionName,
    outcome: result.ok ? "success" : "error",
    is_last_step: result.isDone,
    step_index: result.stepIndex,
    attempt_number: result.attemptNumber,
  };
  if (result.ok) {
    payload.input = result.input;
    payload.latency_ms = latencyMs;
    payload.cost_usd = result.tokenCost;
    if (result.isDone) payload.output = result.response;
  } else {
    // On error, include what's available — don't fabricate values
    if (result.input) payload.input = result.input;
    if (latencyMs) payload.latency_ms = latencyMs;
  }

  (async () => {
    for (let i = 0; i < 3; i++) {
      try {
        const r = await fetch("https://api.convoylabs.com/v1/ingest/sessions", {
          method: "POST",
          headers: {
            "Content-Type": "application/json",
            Authorization: `Bearer ${process.env.CONVOY_SECRET!.trim()}`,
          },
          body: JSON.stringify(payload),
        });
        if (r.status < 500) return;
      } catch {}
      await new Promise((r) => setTimeout(r, 500 * 2 ** i));
    }
  })(); // no await — fire and forget

  // 5. Return response to user
  res.json({ response: result.response });
});