Class Signatures

java.lang.Object
lv.id.jc.dicechess.runtime.Signatures
public final class Signatures extends Object
HMAC-SHA256 signing and verification for the DiceChess webhook delivery protocol.

The signed payload is timestamp + "." + body, hex-encoded. A delivery is accepted only if its timestamp falls within REPLAY_WINDOW_SECONDS of the verifier's clock, and the comparison is constant-time to avoid leaking the secret through timing.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final long
    REPLAY_WINDOW_SECONDS
    The signature is only accepted within this many seconds of the current time, either side.

  • Method Summary

    Modifier and Type
    Method
    Description
    static String
    sign(String secret, long timestampEpochSeconds, String body)
    Computes the hex-encoded HMAC-SHA256 signature for a delivery.
    static boolean
    verify(String secret, long timestampEpochSeconds, String body, String signature, long nowEpochSeconds)
    Verifies a delivery's signature and freshness.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • REPLAY_WINDOW_SECONDS

      public static final long REPLAY_WINDOW_SECONDS
      The signature is only accepted within this many seconds of the current time, either side.
      See Also:

  • Method Details

    • sign

      public static String sign(String secret, long timestampEpochSeconds, String body)
      Computes the hex-encoded HMAC-SHA256 signature for a delivery.
      Parameters:
      secret - the webhook secret issued by the platform
      timestampEpochSeconds - the delivery timestamp, Unix epoch seconds
      body - the raw request body, exactly as transmitted
      Returns:
      the lowercase hex signature

    • verify

      public static boolean verify(String secret, long timestampEpochSeconds, String body, String signature, long nowEpochSeconds)
      Verifies a delivery's signature and freshness.
      Parameters:
      secret - the webhook secret issued by the platform
      timestampEpochSeconds - the delivery's claimed timestamp, Unix epoch seconds
      body - the raw request body, exactly as received
      signature - the hex signature supplied with the delivery
      nowEpochSeconds - the verifier's current time, Unix epoch seconds
      Returns:
      true if the timestamp is within REPLAY_WINDOW_SECONDS and the signature matches