signMessage method

String signMessage({ required String messageId, required String senderId, required String targetId, required Uint8List payload, required int createdAt, })

Signs a message and returns the hex-encoded HMAC-SHA256 signature.

The signature covers:

• messageId — prevents replay attacks with different IDs
• senderId — binds the signature to the sender
• targetId — prevents retargeting
• payload — covers the actual content
• createdAt — prevents timestamp manipulation

Returns a 64-character lowercase hex string.

Implementation

String signMessage({
  required String messageId,
  required String senderId,
  required String targetId,
  required Uint8List payload,
  required int createdAt,
}) {
  final hmac = Hmac(sha256, _keyBytes);
  final data = _buildSigningData(
    messageId: messageId,
    senderId: senderId,
    targetId: targetId,
    payload: payload,
    createdAt: createdAt,
  );
  final digest = hmac.convert(data);
  return digest.toString(); // hex string
}