// internal/handler/handler.go
package handler

import (
    "github.com/gin-gonic/gin"
    "github.com/isa-sdk/sdk"
)

// Handler holds all application-wide dependencies.
type Handler struct {
    isa *sdk.Isa
}

func New(isa *sdk.Isa) *Handler {
    return &Handler{isa: isa}
}

func (h *Handler) RegisterRoutes(r *gin.Engine) {
    r.POST("/prequalify", h.Prequalify)
    r.POST("/webhooks/isa", h.Webhook)
}

// cmd/server/main.go
package main

import (
    "log"

    "github.com/gin-gonic/gin"
    "github.com/isa-sdk/sdk"
    "your-module/internal/handler"
)

func main() {
    // ISA_TOKEN is read from the environment when Token is empty.
    isa, err := sdk.WithBearerOptions(sdk.BearerOptions{
        APIVersion: map[string]string{"prequalify": "v3"},
    })
    if err != nil {
        log.Fatalf("isa: %v", err)
    }

    r := gin.Default()
    h := handler.New(isa)
    h.RegisterRoutes(r)

    if err := r.Run(":8080"); err != nil {
        log.Fatalf("server: %v", err)
    }
}

// internal/handler/prequalify.go
package handler

import (
    "errors"
    "net/http"

    "github.com/gin-gonic/gin"
    "github.com/isa-sdk/sdk"
    "github.com/isa-sdk/sdk/catalog"
    "github.com/isa-sdk/sdk/zyins"
)

// newbridgeFinalExpenseID is one product id from GET /v3/datasets?include=products.
// Fetch ids at startup rather than hard-coding them in production.
const newbridgeFinalExpenseID = "prod_007e74bf-671c-41cc-be27-28cfd75fd5d2"

type prequalifyRequest struct {
    DOB          string `json:"dob"           binding:"required"`
    State        string `json:"state"         binding:"required"`
    HeightInches int    `json:"height_inches" binding:"required"`
    WeightPounds int    `json:"weight_pounds" binding:"required"`
    FaceAmount   int    `json:"face_amount"   binding:"required"`
}

func (h *Handler) Prequalify(c *gin.Context) {
    var req prequalifyRequest
    if err := c.ShouldBindJSON(&req); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
        return
    }

    height, _ := zyins.NewHeightInches(req.HeightInches)
    weight, _ := zyins.NewWeight(req.WeightPounds)
    coverage, _ := zyins.NewFaceValueCoverage(req.FaceAmount)
    product, ok := catalog.ByID(newbridgeFinalExpenseID)
    if !ok {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "unknown product id"})
        return
    }
    products, _ := zyins.NewProductSelectionOf(product)

    input := zyins.PrequalifyRequest{
        Applicant: zyins.Applicant{
            DOB:         req.DOB,
            Sex:         zyins.SexMale,
            Height:      height,
            Weight:      weight,
            State:       catalog.State(req.State),
            NicotineUse: zyins.NicotineUsageInput{LastUsed: zyins.NicotineNever},
        },
        Coverage: coverage,
        Products: products,
    }

    result, err := h.isa.Zyins.Prequalify.Run(c.Request.Context(), &input)
    if err != nil {
        var apiErr *zyins.Error
        if errors.As(err, &apiErr) {
            // 4xx errors are the caller's to fix; surface the code and request id.
            c.JSON(http.StatusBadGateway, gin.H{
                "code":       apiErr.Code,
                "request_id": apiErr.RequestID,
            })
            return
        }
        c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
        return
    }

    type planOut struct {
        Carrier        string `json:"carrier"`
        Product        string `json:"product"`
        Category       string `json:"category"`
        PremiumDisplay string `json:"premium_display"`
        PremiumCents   int64  `json:"premium_cents"`
    }
    plans := make([]planOut, 0, len(result.Plans))
    for _, offer := range result.Plans {
        prem := zyins.OfferPremium(offer)
        if prem == nil {
            continue // no qualifying, priceable rate class for this applicant
        }
        var category string
        for _, row := range offer.Pricing {
            if row.Primary && row.Eligibility.Category != nil {
                category = string(*row.Eligibility.Category)
            }
        }
        plans = append(plans, planOut{
            Carrier:        offer.Carrier.Name,
            Product:        offer.Product.Name,
            Category:       category,
            PremiumDisplay: prem.Amount.Display,
            PremiumCents:   prem.Amount.Cents,
        })
    }
    c.JSON(http.StatusOK, gin.H{
        "plans":      plans,
        "request_id": result.RequestID,
    })
}

// internal/handler/webhook.go
package handler

import (
    "crypto/hmac"
    "crypto/sha256"
    "crypto/subtle"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "strconv"
    "strings"
    "time"

    "github.com/gin-gonic/gin"
)

const (
    signatureHeader         = "X-ZyINS-Signature"
    webhookToleranceSeconds = 300
)

func (h *Handler) Webhook(c *gin.Context) {
    raw, err := io.ReadAll(c.Request.Body)
    if err != nil {
        c.Status(http.StatusBadRequest)
        return
    }

    sig := c.GetHeader(signatureHeader)
    if err := verifyWebhookSignature(raw, sig, os.Getenv("ISA_WEBHOOK_SECRET")); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": "invalid signature"})
        return
    }

    var event struct {
        ID   string `json:"id"`
        Type string `json:"type"`
    }
    if err := json.Unmarshal(raw, &event); err != nil {
        c.Status(http.StatusBadRequest)
        return
    }

    // De-dupe on event.ID, then dispatch on event.Type.
    c.Status(http.StatusOK)
}

func verifyWebhookSignature(body []byte, header, secret string) error {
    timestamp, macHex, err := parseSignatureHeader(header)
    if err != nil {
        return err
    }

    ts, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil {
        return fmt.Errorf("parse webhook timestamp %q: %w", timestamp, err)
    }
    if delta := time.Now().Unix() - ts; delta > webhookToleranceSeconds || delta < -webhookToleranceSeconds {
        return fmt.Errorf("webhook timestamp %d is outside the %ds tolerance", ts, webhookToleranceSeconds)
    }

    mac := hmac.New(sha256.New, []byte(secret))
    fmt.Fprintf(mac, "%s.%s", timestamp, body)
    expected := hex.EncodeToString(mac.Sum(nil))

    if subtle.ConstantTimeCompare([]byte(expected), []byte(macHex)) != 1 {
        return fmt.Errorf("webhook signature mismatch")
    }
    return nil
}

// parseSignatureHeader splits "t=<ts>,v1=<hex>" into its timestamp and hex parts.
func parseSignatureHeader(header string) (timestamp, macHex string, err error) {
    for _, part := range strings.Split(header, ",") {
        key, value, ok := strings.Cut(strings.TrimSpace(part), "=")
        if !ok {
            continue
        }
        switch key {
        case "t":
            timestamp = value
        case "v1":
            macHex = value
        }
    }
    if timestamp == "" || macHex == "" {
        return "", "", fmt.Errorf("malformed %s header: %q", signatureHeader, header)
    }
    return timestamp, macHex, nil
}