--[[
  Caresoft Imaging — Orthanc notification script.
  Drop this in the Orthanc "LuaScripts" list. It calls the Caresoft ingest
  endpoint when a study finishes arriving, signing the body so the endpoint
  can prove the call came from this archive.

  Set CARESOFT_URL, CARESOFT_TENANT and CARESOFT_SECRET below.
  CARESOFT_SECRET is shown on the hospital record in the Caresoft console.
]]

local CARESOFT_URL    = 'https://imaging.caresoft.co.in/api/orthanc-webhook.php'
local CARESOFT_TENANT = 'demo'
local CARESOFT_SECRET = 'change-this-webhook-secret'

function OnStableStudy(studyId, tags, metadata)
  local body = '{"event":"StableStudy","orthancStudyId":"' .. studyId .. '"}'
  local sig  = 'sha256=' .. HashSHA256(body)   -- see note below

  local headers = {
    ['Content-Type']          = 'application/json',
    ['X-Caresoft-Tenant']     = CARESOFT_TENANT,
    ['X-Caresoft-Signature']  = sig,
  }

  local ok, err = pcall(function()
    HttpPost(CARESOFT_URL, body, headers)
  end)

  if not ok then
    print('Caresoft notify failed for study ' .. studyId .. ': ' .. tostring(err))
  end
end

--[[
  IMPORTANT
  Orthanc's built-in Lua does not ship an HMAC function. Two supported options:

  1. Preferred — run the small companion script tools/caresoft-notify.php as a
     scheduled task instead of using Lua. It polls /changes and signs correctly.

  2. If you want Lua to do it, install lua-resty-openssl or luaossl on the
     Orthanc host and replace the sig line with a real HMAC-SHA256 of `body`
     keyed with CARESOFT_SECRET.

  Do not ship the placeholder above to production — the endpoint will reject
  it, which is the intended behaviour.
]]