Two-way conversations and SMS chatbots.

import hashlib, hmac, json, os, time
from urllib.request import Request, urlopen

STOP_WORDS = {"STOP", "STOPALL", "UNSUBSCRIBE", "CANCEL", "END", "QUIT"}
opted_out = set()  # In production, save this to durable storage.

def ask_bot(message):
    """Placeholder for the business's own bot."""
    raise NotImplementedError("Connect your own bot here")

def receive_sms(headers, raw_body):
    """Verify an incoming event and send its answer through the event's phone and SIM."""
    ts = headers.get("X-SMSKit-Timestamp", "")
    signature = headers.get("X-SMSKit-Signature-256", "")
    if not ts.isascii() or not ts.isdigit() or abs(time.time() - int(ts)) > 300:
        raise ValueError("Invalid webhook timestamp")
    expected = hmac.new(
        os.environ["SMSKIT_WEBHOOK_SECRET"].encode(),
        ts.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, signature):
        raise ValueError("Invalid webhook signature")
    event = json.loads(raw_body)
    if event["event"] != "sms:received":
        return
    sender = event["sender"]
    if event["messageBody"].strip().upper() in STOP_WORDS:
        opted_out.add(sender)  # Record the opt-out and send nothing.
        return
    if sender in opted_out:
        return
    if not event.get("deviceId") or type(event.get("simSlot")) is not int or event["simSlot"] not in (0, 1):
        raise ValueError("Missing reply phone or SIM")
    payload = {
        "recipient": sender,
        "message": ask_bot(event["messageBody"]),
        "devices": [{"deviceId": event["deviceId"], "simSlots": [event["simSlot"]]}],
        "idempotencyKey": event["eventId"]
    }
    request = Request("https://api.smskit.cloud/api/v1/sms/send",
        data=json.dumps(payload).encode(), method="POST",
        headers={"X-Api-Key": os.environ["SMSKIT_API_KEY"], "Content-Type": "application/json"})
    with urlopen(request, timeout=15) as response:
        return json.load(response)