Verify and deduplicate signed bytes

Intermediate50 min

Implement verify_webhook(raw, timestamp, supplied, secret, now, seen, tolerance=300). This original teaching protocol signs b'v1.' + timestamp ASCII + b'.' + raw using HMAC-SHA256 and lowercase hex. Timestamp must be a nonempty ASCII decimal string and be within an inclusive tolerance of now. Signature must be 64 lowercase hexadecimal characters. The seen dictionary maps signatures to exclusive-after expiry: entries with expiry >= now remain active. Reject active replays. On acceptance, prune expired entries and store the signature with expiry timestamp+tolerance. Return (accepted, new_seen) without mutating seen; invalid requests return an unchanged copy. Reject negative tolerance with ValueError. This is not a provider-compatible webhook implementation.

Your task

Complete the starter function using the contract above.
Use the examples and visible tests to check normal inputs, boundaries, and rejected inputs.
Run tests to record your result, then compare with the explained reference solution.

Examples

EXAMPLE 1

InputCorrect signature, timestamp 1000, now 1000, empty cache

Output(True, cache containing signature)

Authenticity and time checks pass.

EXAMPLE 2

InputSame signature again before expiry

Output(False, unchanged cache)

An authenticated request can still be a replay.

def verify_webhook(raw, timestamp, supplied, secret, now, seen, tolerance=300):
    raise NotImplementedError