Rewrite example

Author: Rabsztok

README.md

@@ -248,31 +248,6 @@ The same situation applies to both `client.batch_send()` and `client.sending_api
 - Webhooks management – [`webhooks/webhooks.py`](examples/webhooks/webhooks.py)
 - Verifying webhook signatures – [`webhooks/verify_signature.py`](examples/webhooks/verify_signature.py)
 
-#### Verifying webhook signatures
-
-Mailtrap signs every outbound webhook with HMAC-SHA256 and sends the
-lowercase hex digest in the `Mailtrap-Signature` header. Verify the signature
-against the raw request body using the `signing_secret` returned when you
-created the webhook:
-
-```python
-import mailtrap as mt
-
-# `raw_body` must be the unparsed request body bytes — do NOT re-serialize
-# the parsed JSON, as that may reorder keys and invalidate the signature.
-valid = mt.verify_signature(
-    raw_body,
-    request.headers.get("Mailtrap-Signature", ""),
-    os.environ["MAILTRAP_WEBHOOK_SIGNING_SECRET"],
-)
-
-if not valid:
-    abort(401)
-```
-
-The helper performs a constant-time comparison and returns `False` (rather
-than raising) for empty, missing, or malformed signatures.
-
 ### Suppressions API:
 - Suppressions (find & delete) – [`suppressions/suppressions.py`](examples/suppressions/suppressions.py)
 

examples/webhooks/verify_signature.py

@@ -1,16 +1,26 @@
-import hashlib
-import hmac
+import os
+from wsgiref.simple_server import make_server
 
 import mailtrap as mt
 
-# --- Direct verification (e.g. for unit tests or custom routers) ----------
-payload = '{"event":"delivery","message_id":"abc-123"}'
-signing_secret = "8d9a3c0e7f5b2d4a6c1e9f8b3a7d5c2e"
-signature = hmac.new(
-    signing_secret.encode("utf-8"),
-    payload.encode("utf-8"),
-    hashlib.sha256,
-).hexdigest()
-
-if not mt.verify_signature(payload, signature, signing_secret):
-    raise SystemExit("Signature verification failed!")
+SIGNING_SECRET = os.environ["MAILTRAP_WEBHOOK_SIGNING_SECRET"]
+
+
+def app(environ, start_response):
+    # Use the raw request body — parsing and re-serializing the JSON may
+    # reorder keys or alter whitespace and invalidate the signature.
+    length = int(environ.get("CONTENT_LENGTH") or 0)
+    payload = environ["wsgi.input"].read(length).decode("utf-8")
+    signature = environ.get("HTTP_MAILTRAP_SIGNATURE", "")
+
+    if not mt.verify_signature(payload, signature, SIGNING_SECRET):
+        start_response("401 Unauthorized", [("Content-Type", "text/plain")])
+        return [b"Invalid signature"]
+
+    start_response("200 OK", [("Content-Type", "text/plain")])
+    return [b""]
+
+
+if __name__ == "__main__":
+    with make_server("", 9292, app) as server:
+        server.serve_forever()