"""Call with raw request bytes BEFORE parsing JSON; persist/deduplicate event['id']."""
import hashlib
import hmac
import json
import re
import time

def verify_webhook(raw_body, headers, secret, expected_partner_id, now=None):
    if not isinstance(raw_body, bytes) or len(raw_body) > 65536:
        raise ValueError("Invalid body")
    headers = {key.lower(): value for key, value in headers.items()}
    timestamp = headers.get("x-screenshare-timestamp", "")
    signature = headers.get("x-screenshare-signature", "")
    if not re.fullmatch(r"[0-9]{1,12}", timestamp) or abs((time.time() if now is None else now) - int(timestamp)) > 300:
        raise ValueError("Expired or invalid timestamp")
    if not re.fullmatch(r"v1=[a-f0-9]{64}", signature):
        raise ValueError("Invalid signature format")
    expected = hmac.new(secret.encode("utf-8"), timestamp.encode("ascii") + b"." + raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(signature[3:], expected):
        raise ValueError("Invalid signature")
    event = json.loads(raw_body)
    if event.get("id") != headers.get("x-screenshare-event-id") or event.get("partner_id") != expected_partner_id:
        raise ValueError("Invalid event or organization")
    return event