Multicoin\Api\Http\Middlewares\VerifySignature

Complexity

Total Complexity

5

Size/Duplication

Total Lines	29
Duplicated Lines	0 %

Importance

Changes	2
Bugs	2	Features	0

2 Methods

Rating	Name	Duplication	Size	Complexity
A	handle()	0	13	3
A	isValid()	0	12	2

<?php

namespace Multicoin\Api\Http\Middlewares;

use Closure;
use Multicoin\Api\Exceptions\WebhookFailed;

class VerifySignature
{
    public function handle($request, Closure $next)
    {
        $signature = $request->header('X-Multicoin-Signature');

        if (! $signature) {
            throw WebhookFailed::missingSignature();
        }

        if (! $this->isValid($signature, $request)) {
            throw WebhookFailed::invalidSignature($signature);
        }

        return $next($request);
    }

    protected function isValid(string $signature, $request): bool
    {
        $payload = $request->getContent();

The assignment to $payload is dead and can be removed.

        $secret = config('multicoin.api_key');
        if (empty($secret)) {
            throw WebhookFailed::signingSecretNotSet();
        }
        $timestamp = $request->header('timestamp');
        $token = $request->header('token');
        $computedSignature = hash_hmac('sha256', $token.$timestamp, $secret);

        return hash_equals($signature, $computedSignature);
    }
}