Class: OmniEvent::SignatureVerifier

Inherits:
Object
  • Object
show all
Defined in:
lib/omni_event/signature_verifier.rb

Overview

Verifies the authenticity and freshness of an incoming webhook request.

Two independent checks (both only active when secret_key is set):

1. Timestamp — rejects requests outside the tolerance window (replay attack protection).
 Header: X-OmniEvent-Timestamp  (Unix timestamp, e.g. 1711800000)

2. HMAC Signature — verifies the payload was signed with the shared secret.
 Header: X-OmniEvent-Signature  (e.g. "sha256=abc123...")
 Algorithm: HMAC-SHA256(secret_key, raw_body)

If the Notifier has no secret_key, all checks are skipped (backward compatible).

Usage:

result = OmniEvent::SignatureVerifier.call(notifier, request)
result.success? # => true / false
result.error    # => "Invalid signature — payload may have been tampered"

Defined Under Namespace

Classes: Result

Constant Summary collapse

TIMESTAMP_HEADER = 
'X-OmniEvent-Timestamp'
SIGNATURE_HEADER = 
'X-OmniEvent-Signature'

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(notifier, request) ⇒ SignatureVerifier

Returns a new instance of SignatureVerifier.



34
35
36
37
 
# File 'lib/omni_event/signature_verifier.rb', line 34

def initialize(notifier, request)
  @notifier = notifier
  @request  = request
end

Class Method Details

.call(notifier, request) ⇒ Object 



30
31
32
 
# File 'lib/omni_event/signature_verifier.rb', line 30

def self.call(notifier, request)
  new(notifier, request).verify
end

Instance Method Details

#verify ⇒ Object 



39
40
41
42
43
44
45
46
47
 
# File 'lib/omni_event/signature_verifier.rb', line 39

def verify
  # No secret configured — skip all checks (opt-in security)
  return success unless @notifier.secret_key.present?

  result = verify_timestamp
  return result unless result.success?

  verify_signature
end