"""HMAC verification for the **user** GitHub App webhook secret (separate from P2HS org app)."""
from __future__ import annotations

import hashlib
import hmac
from typing import Optional

from src.config import get_settings


def verify_github_user_app_signature(payload: bytes, signature_header: Optional[str]) -> bool:
    if not signature_header or not signature_header.startswith("sha256="):
        return False
    secret = (get_settings().github_user_app_webhook_secret or "").encode("utf-8")
    if not secret.strip():
        return False
    expected_sig = signature_header[7:]
    computed = hmac.new(secret, payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(computed, expected_sig)