using System;
using System.Security.Cryptography;
using System.Text;

namespace BitzOrcas.Platform.WeChat.Mp.Infrastructure;

/// <summary>
/// 微信公众平台防伪签名验证器
/// </summary>
public static class WeChatSignatureValidator
{
    /// <summary>
    /// 校验微信服务器回调请求签名
    /// </summary>
    /// <param name="token">租户在后台配置的通信 Token</param>
    /// <param name="timestamp">请求时间戳</param>
    /// <param name="nonce">随机数</param>
    /// <param name="signature">微信附带的签名</param>
    /// <returns>校验是否通过</returns>
    public static bool VerifySignature(string token, string timestamp, string nonce, string signature)
    {
        if (string.IsNullOrWhiteSpace(token) || string.IsNullOrWhiteSpace(signature))
        {
            return false;
        }

        // 1. 将 token、timestamp、nonce 三个参数进行字典序排序
        var array = new[] { token, timestamp, nonce };
        Array.Sort(array, StringComparer.Ordinal);

        // 2. 将三个参数字符串拼接成一个字符串进行 sha1 加密
        var combined = string.Concat(array);
        var hashBytes = SHA1.HashData(Encoding.UTF8.GetBytes(combined));
        var computedSignature = Convert.ToHexString(hashBytes).ToLowerInvariant();

        // 3. 恒定时间比较防范定时攻击 (Constant-time comparison)
        return CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(computedSignature),
            Encoding.UTF8.GetBytes(signature.ToLowerInvariant()));
    }
}