import hashlib
import hmac


def verify_meta_signature(body: bytes, signature_header: str | None, app_secret: str) -> bool:
    if not signature_header or not signature_header.startswith("sha256="):
        return False

    expected = "sha256=" + hmac.new(
        app_secret.encode("utf-8"),
        body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)


def verify_webhook_challenge(
    mode: str | None,
    verify_token: str | None,
    expected_verify_token: str,
) -> bool:
    return mode == "subscribe" and verify_token == expected_verify_token