<?php
// +----------------------------------------------------------------------
// | YwxApp [ WE CAN DO IT JUST THINK ]
// +----------------------------------------------------------------------
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
// +----------------------------------------------------------------------
// | Author: ywxapp<admin@ywxapp.cn>
// +----------------------------------------------------------------------
// server/utils/SignUtil.php

namespace ywxapp\utils;

/**
 * SignUtil 类
 *
 * @author ywxapp <admin@ywxapp.cn>
 */
class SignUtil
{ 
 
     
     public static function generateSign(array $params, string $secret): string
    {
        unset($params['sign']);
        ksort($params); 
        $signString = urldecode(http_build_query($params, '', '&'));
        return hash_hmac('sha256', $signString, $secret);
    }

    
    public static function verifySign(array $params, string $secret): bool
    {
        if (!isset($params['sign'])) return false;
        $sign     = (string) $params['sign'];
        $expected = self::generateSign($params, $secret);
        // 必须用 hash_equals()：strtolower() 比较会在首个不同字节处返回，
        // 响应时间可被用来逐字节猜出正确签名（时序侧信道）。
        return hash_equals(strtolower($expected), strtolower($sign));
    }   
}