"""Billing blueprint - Stripe Checkout, webhook, subscription management.

Mounted at /checkout/* prefix for the customer-facing checkout flow.
The webhook (B-2.8) is exposed at /checkout/webhooks/stripe and is
CSRF-exempted via `exempt_webhook_csrf` (signature-verified instead).

Routes added in Tasks B-2.7 (checkout) and B-2.8 (webhook).
"""
from flask import Blueprint

# template_folder points at the project-level `templates/` so render_template
# can resolve names like 'billing/success.html' the same way the marketing
# and legal blueprints resolve 'marketing/...' / 'legal/...'.
billing_bp = Blueprint(
    'billing',
    __name__,
    url_prefix='/checkout',
    template_folder='../../templates',
    static_folder=None,
)

# Import routes to register them on billing_bp. Must come after blueprint
# instantiation. Keep the # noqa comments — these guards exist for ruff/flake8.
from src.billing import routes  # noqa: E402, F401
from src.billing import webhooks  # noqa: E402, F401


def exempt_webhook_csrf(csrf_protect):
    """Exempt the Stripe webhook view from CSRF protection.

    Called from app.py after CSRFProtect is initialized. Stripe webhooks have
    no CSRF token (server-to-server). The `stripe_webhook` view validates
    Stripe's signature header (`Stripe-Signature` + STRIPE_WEBHOOK_SECRET) instead.
    """
    from src.billing.webhooks import stripe_webhook
    csrf_protect.exempt(stripe_webhook)
