Hi, I'm
Thu Paing Oo

# Anti-replay HMAC middleware
import hmac, hashlib, time
from fastapi import HTTPException, Request
from functools import wraps

_used_nonces: set = set()

def verify_request(secret: str):
    def decorator(func):
        @wraps(func)
        async def wrapper(req: Request, **kwargs):
            token = req.headers.get("X-Auth-Token")
            nonce = req.headers.get("X-Nonce")
            ts    = float(req.headers.get("X-Timestamp", 0))

            # 1. ±30s timestamp window
            if abs(time.time() - ts) > 30:
                raise HTTPException(401, "Request expired")

            # 2. One-time nonce → prevent replay
            if nonce in _used_nonces:
                raise HTTPException(401, "Replay detected")
            _used_nonces.add(nonce)

            # 3. HMAC-SHA256 verify
            expected = hmac.new(
                secret.encode(),
                f"{nonce}:{ts}".encode(),
                hashlib.sha256
            ).hexdigest()
            if not hmac.compare_digest(token, expected):
                raise HTTPException(403, "Invalid signature")

            return await func(req, **kwargs)
        return wrapper
    return decorator