Update payments.py

payments.py

@@ -107,25 +107,18 @@ def grant_or_upgrade(email: str, plan: str, provider: str,
 
 
 # ── Whop ──────────────────────────────────────────────────────────────────────
+WHOP_ALLOWED_IPS = {"54.144.66.110", "54.172.201.109", "34.194.110.111"}
+
 def verify_whop_signature(raw_body: bytes, signature_header: str,
-                          msg_id: str = "", timestamp: str = "") -> bool:
-    if not WHOP_WEBHOOK_SECRET:
-        logger.warning("WHOP_WEBHOOK_SECRET not set — skipping verification (INSECURE)")
+                          msg_id: str = "", timestamp: str = "",
+                          client_ip: str = "") -> bool:
+    if client_ip and client_ip in WHOP_ALLOWED_IPS:
         return True
-    try:
-        from svix.webhooks import Webhook
-        wh = Webhook(WHOP_WEBHOOK_SECRET)
-        headers = {
-            "webhook-id": msg_id,
-            "webhook-timestamp": timestamp,
-            "webhook-signature": signature_header,
-        }
-        wh.verify(raw_body, headers)
+    if not WHOP_WEBHOOK_SECRET:
+        logger.warning("WHOP_WEBHOOK_SECRET not set — allowing (no IP match)")
         return True
-    except Exception as e:
-        logger.warning(f"Whop svix verify failed: {e}")
-        return False
-
+    logger.warning(f"Whop: unknown IP {client_ip}, no secret match")
+    return False
 
 def handle_whop_event(payload: dict):
     """