package com.teplot.sign;

import javax.servlet.http.HttpServletRequest;

import com.jfinal.kit.HashKit;
import com.jfinal.kit.StrKit;

/**
 * Depiction: 校验接口请求签名
 * <p>
 * Modify:
 * <p>
 * Author: Kevin Lynn
 * <p>
 * Create Date：2017年6月1日 上午12:31:18
 * 
 */
public class VerifySign {
	private static final String APPKEY = "DT-AppKey";
	private static final String NONCE = "DT-Nonce";
	private static final String TIMESTAMP = "DT-Timestamp";
	private static final String SIGNATURE = "DT-Signature";

	public static boolean verify(HttpServletRequest req) {
		String appKey = req.getHeader(APPKEY);
		String nonce = req.getHeader(NONCE);
		String timestamp = req.getHeader(TIMESTAMP);
		String signature = req.getHeader(SIGNATURE);

		if (StrKit.isBlank(appKey) || StrKit.isBlank(nonce) || StrKit.isBlank(timestamp) || StrKit.isBlank(signature)) {
			return false;
		}

		long time = 0L;
		try {
			time = Long.parseLong(timestamp);
		} catch (Exception e) {
		}

		long tmp = Math.abs(System.currentTimeMillis() / 1000 - time);
		if (tmp > 60) {
			// 一分钟之外的请求无效
			return false;
		}

		String appSecret = AppKey.getAppSecret(appKey);
		StringBuilder source = new StringBuilder(appSecret).append(nonce).append(timestamp);
		String sign = HashKit.sha256(source.toString());
		if (signature.equalsIgnoreCase(sign)) {
			return true;
		}

		return false;
	}

}