<?php

declare(strict_types=1);

namespace app\common\service;

/** 腾讯 IM 回调签名：sha256(Token . RequestTime)，只接受一分钟以内的请求。 */
class ImCallbackSignature
{
    public static function verify(string $token, mixed $requestTime, mixed $sign, ?int $now = null): bool
    {
        if (trim($token) === '' || (!is_string($requestTime) && !is_int($requestTime)) || !is_string($sign)) {
            return false;
        }
        $timestamp = (string) $requestTime;
        if (preg_match('/^[0-9]{1,12}$/D', $timestamp) !== 1 || preg_match('/^[a-fA-F0-9]{64}$/D', $sign) !== 1) {
            return false;
        }
        if (abs(($now ?? time()) - (int) $timestamp) > 60) {
            return false;
        }

        return hash_equals(hash('sha256', $token . $timestamp), strtolower($sign));
    }
}