import hmac
import hashlib
import json
import requests

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://uat-us.mcards.com"  # or https://app-us.mcards.com for production

def make_request(method, path, body=None):
    """Make an authenticated request to the mCards API."""
    payload_string = json.dumps(body) if body else json.dumps(None)
    
    signature = hmac.new(
        API_SECRET.encode("utf-8"),
        payload_string.encode("utf-8"),
        hashlib.sha256
    ).hexdigest()
    
    headers = {
        "Authorization": f"HMAC_256 {API_KEY};{signature}",
        "Content-Type": "application/json"
    }
    
    response = requests.request(
        method,
        f"{BASE_URL}{path}",
        headers=headers,
        data=payload_string if body else None
    )
    return response.json()

# Example: List distributors
distributors = make_request("GET", "/api/distributors/v1/distributors")

# Example: Create a webhook subscription
webhook = make_request("POST", "/api/webhook/webhooks", {
    "url": "https://your-server.com/webhooks",
    "event_type": "transaction"
})

require "openssl"
require "json"
require "net/http"

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://uat-us.mcards.com"  # or https://app-us.mcards.com for production

def make_request(method, path, body = nil)
  payload_string = body ? body.to_json : nil.to_json

  signature = OpenSSL::HMAC.hexdigest(
    "sha256",
    API_SECRET,
    payload_string
  )

  uri = URI("#{BASE_URL}#{path}")
  http = Net::HTTP.new(uri.host, uri.port)
  http.use_ssl = true

  request = case method
            when :get    then Net::HTTP::Get.new(uri)
            when :post   then Net::HTTP::Post.new(uri)
            when :put    then Net::HTTP::Put.new(uri)
            when :delete then Net::HTTP::Delete.new(uri)
            end

  request["Authorization"] = "HMAC_256 #{API_KEY};#{signature}"
  request["Content-Type"] = "application/json"
  request.body = payload_string if body

  response = http.request(request)
  JSON.parse(response.body)
end

# Example: List distributors
distributors = make_request(:get, "/api/distributors/v1/distributors")

const crypto = require("crypto");
const https = require("https");

const API_KEY = "your_api_key";
const API_SECRET = "your_api_secret";
const BASE_URL = "https://uat-us.mcards.com"; // or https://app-us.mcards.com for production

function makeRequest(method, path, body = null) {
  const payloadString = JSON.stringify(body);

  const signature = crypto
    .createHmac("sha256", API_SECRET)
    .update(payloadString)
    .digest("hex");

  const url = new URL(path, BASE_URL);

  return fetch(url, {
    method: method,
    headers: {
      Authorization: `HMAC_256 ${API_KEY};${signature}`,
      "Content-Type": "application/json",
    },
    body: method !== "GET" ? payloadString : undefined,
  }).then((res) => res.json());
}

// Example: List distributors
makeRequest("GET", "/api/distributors/v1/distributors")
  .then((data) => console.log(data));

# Set your credentials
API_KEY="your_api_key"
API_SECRET="your_api_secret"

# For GET requests (signing null payload)
PAYLOAD="null"
SIGNATURE=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$API_SECRET" | awk '{print $NF}')

curl -X GET "https://uat-us.mcards.com/api/distributors/v1/distributors" \
  -H "Authorization: HMAC_256 ${API_KEY};${SIGNATURE}" \
  -H "Content-Type: application/json"

# For POST requests (signing the JSON body)
PAYLOAD='{"url":"https://your-server.com/webhooks","event_type":"transaction"}'
SIGNATURE=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$API_SECRET" | awk '{print $NF}')

curl -X POST "https://uat-us.mcards.com/api/webhook/webhooks" \
  -H "Authorization: HMAC_256 ${API_KEY};${SIGNATURE}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD"

// Set these as Postman environment variables:
// - mcards_api_key
// - mcards_api_secret

const apiKey = pm.environment.get("mcards_api_key");
const apiSecret = pm.environment.get("mcards_api_secret");

const body = pm.request.body ? pm.request.body.raw : "null";

const signature = CryptoJS.HmacSHA256(body, apiSecret).toString(CryptoJS.enc.Hex);

pm.request.headers.add({
  key: "Authorization",
  value: `HMAC_256 ${apiKey};${signature}`
});

import jwt
import requests

JWKS_URL = "{base_url}/api/payments/.well-known/jwks.json"

def validate_mcards_token(token):
    """Validate an mCards JWT and return its claims."""
    # Fetch JWKS (cache this in production)
    jwks = requests.get(JWKS_URL).json()
    
    # Decode and verify the token
    header = jwt.get_unverified_header(token)
    
    # Find the matching key by kid
    key = next(k for k in jwks["keys"] if k["kid"] == header["kid"])
    public_key = jwt.algorithms.RSAAlgorithm.from_jwk(key)
    
    claims = jwt.decode(
        token,
        public_key,
        algorithms=["RS256"],
        audience="expected_audience"
    )
    return claims