verify_signature
Return None iff signature is valid AND fresh.
Raises plain AuthError: one class, one
message, for every failure: a mismatched signature, a missing or
wrong v1= prefix, a mutated body, a wrong secret, and a
timestamp outside the window are INDISTINGUISHABLE to the caller.
Freshness is abs(now_ms - timestamp_ms) <= tolerance_ms
(inclusive at both edges, past and future). Comparison is
hmac.compare_digest, never str.__eq__.
Parameters
secretrequired, strThe endpoint secret, shown once at registration.
timestamp_msrequired, intThe X-Auradefi-Timestamp header value.
bodyrequired, strThe RAW request body. Re-serialising breaks the signature.
signaturerequired, strThe X-Auradefi-Signature header value.
now_msrequired, intYour current time, for the staleness window.
tolerance_msoptional, int, default 300000none
Raises
Returns
None