verifySignature function

SignatureCheck verifySignature({ required String secret, required String rawBody, String? signature, String? timestamp, int toleranceSeconds = 300, })

Verify X-Norbix-Signature against the raw body.

Implementation

SignatureCheck verifySignature({
  required String secret,
  required String rawBody,
  String? signature,
  String? timestamp,
  int toleranceSeconds = 300,
}) {
  if (signature == null || signature.isEmpty) {
    return const SignatureCheck(false, 'missing X-Norbix-Signature header');
  }
  if (timestamp == null || timestamp.isEmpty) {
    return const SignatureCheck(false, 'missing X-Norbix-Timestamp header');
  }

  if (toleranceSeconds > 0) {
    final sent = double.tryParse(timestamp);
    if (sent == null) {
      return const SignatureCheck(false, 'X-Norbix-Timestamp is not a number');
    }
    final nowSeconds = DateTime.now().millisecondsSinceEpoch / 1000.0;
    final age = (nowSeconds - sent).abs();
    if (age > toleranceSeconds) {
      return SignatureCheck(
        false,
        'timestamp outside ${toleranceSeconds}s tolerance (age ${age.round()}s)',
      );
    }
  }

  final expected = computeSignature(secret, timestamp, rawBody);
  if (!_constantTimeEquals(expected, signature)) {
    return const SignatureCheck(false, 'signature mismatch');
  }
  return const SignatureCheck(true);
}