import os
import hmac
import hashlib
from fastapi import FastAPI, Request, HTTPException, Header
from huggingface_hub import HfApi

app = FastAPI()

# Configuration and Admin Keys
HF_ADMIN_TOKEN = os.getenv("HF_ADMIN_TOKEN")
WEBHOOK_SECRET = os.getenv("HF_WEBHOOK_SECRET") # Verifies the payload source
REPO_ID = "omegaT4224/Emulator.exe"

hf_api = HfApi(token=HF_ADMIN_TOKEN)
adversarial_signatures = ["ANDREWLEECRUZ.sh", "Emulator.exe", "ReflectChain", "EternalQuantum"]

@app.post("/webhook/hf-gatekeeper")
async def evaluate_huggingface_push(
    request: Request, 
    x_webhook_signature: str = Header(None)
):
    # 1. Cryptographic Handshake Verification
    payload_bytes = await request.body()
    if WEBHOOK_SECRET and x_webhook_signature:
        signature = hmac.new(WEBHOOK_SECRET.encode(), payload_bytes, hashlib.sha256).hexdigest()
        if not hmac.compare_digest(signature, x_webhook_signature):
            raise HTTPException(status_code=401, detail="Invalid signature source.")

    # 2. Extract Event Data From Repository
    event_data = await request.json()
    event_type = event_data.get("event", {}).get("action")
    
    # Only monitor actual code modifications or pull requests
    if event_type in ["repo:update", "pr:open"]:
        updated_files = event_data.get("updatedRefs", [])
        
        for ref in updated_files:
            for file_info in ref.get("files", []):
                file_path = file_info.get("path", "")
                
                # Check file metadata path names directly
                if any(token in file_path for token in adversarial_signatures):
                    execute_gan_reversion(file_path)
                    return {"status": "Adversarial payload intercepted. Mitigation triggered."}
                    
    return {"status": "Repository path verified clean."}

def execute_gan_reversion(malicious_file):
    print(f"[CRITICAL] Discriminator isolated target structure match: {malicious_file}")
    try:
        # Purge the file from the main branch tracking sequence immediately
        hf_api.delete_file(
            path_in_repo=malicious_file,
            repo_id=REPO_ID,
            repo_type="model",
            commit_message="GAN Defense Framework: Removing malicious structure profile."
        )
        print("[SUCCESS] Unauthorized generation layer purged.")
    except Exception as e:
        print(f"[ERROR] Auto-reversion failed: {e}")