import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Base64;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class sample {
  public static void main(String args[]) {
    Rfc9421SignatureVerifier signature = new Rfc9421SignatureVerifier("[JOB_OFFER_KEY]");
    Rfc9421SignatureVerifier.VerificationResult result = signature.verifySignature(
        "[POSTED_JSON_DOBY]}",
        "[POSTED_CONTENT_DIGEST_HEADER]",
        "[POSTED_SIGNATURE_HEADER]"
    );

    System.out.println(result);
  }

 public static class Rfc9421SignatureVerifier {
    private final String webhookSecret;

    public Rfc9421SignatureVerifier(String webhookSecret) {
        this.webhookSecret = webhookSecret;
    }

    public VerificationResult verifySignature(String body, String contentDigestHeader,
                                              String signatureHeader) {
        try {
            // 1. Verify Content-Digest
            String calculatedContentDigest = calculateContentDigest(body);
            if (!calculatedContentDigest.equals(contentDigestHeader)) {
                return new VerificationResult.Failure("Content-Digest mismatch");
            }

            // 2. Build signature base
            String signatureBase = buildSignatureBase(calculatedContentDigest);

            // 3. Calculate expected signature
            String calculatedSignature = calculateSignature(signatureBase, webhookSecret);

            // 4. Compare signatures
            if (!calculatedSignature.equals(signatureHeader)) {
                return new VerificationResult.Failure("Signature mismatch");
            }

            return new VerificationResult.Success();
        } catch (Exception e) {
            return new VerificationResult.Failure("Error: " + e.getMessage());
        }
    }

    private String calculateContentDigest(String payload) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(payload.getBytes(StandardCharsets.UTF_8));
        String encoded = Base64.getEncoder().encodeToString(hash);
        return "sha-256=:" + encoded + ":";
    }

    private String buildSignatureBase(String contentDigest) {
        return "\"content-digest\": " + contentDigest + "\n" +
               "\"@signature-params\": (\"content-digest\");alg=\"hmac-sha256\"";
    }

    private String calculateSignature(String signatureBase, String secret) throws Exception {
        Mac hmacSha256 = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(
            secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        hmacSha256.init(secretKey);
        byte[] hash = hmacSha256.doFinal(signatureBase.getBytes(StandardCharsets.UTF_8));
        String encoded = Base64.getEncoder().encodeToString(hash);
        return "sig=:" + encoded + ":";
    }

    public static abstract class VerificationResult {
        public static class Success extends VerificationResult {}
        public static class Failure extends VerificationResult {
            public final String reason;
            public Failure(String reason) { this.reason = reason; }
        }
    }
 }
}

using System;
using System.Security.Cryptography;
using System.Text;
using System.Text.RegularExpressions;

public class Sample
{
    public static void Main(string[] args)
    {
        var signature = new Rfc9421SignatureVerifier("[JOB_OFFER_KEY]");
        var result = signature.VerifySignature(
            "[POSTED_JSON_DOBY]",
            "[POSTED_CONTENT_DIGEST_HEADER]",
            "[POSTED_SIGNATURE_HEADER]"
        );

        Console.WriteLine(result);
    }
}

public class Rfc9421SignatureVerifier
{
    private readonly string webhookSecret;

    public Rfc9421SignatureVerifier(string webhookSecret)
    {
        this.webhookSecret = webhookSecret;
    }

    public VerificationResult VerifySignature(string body, string contentDigestHeader,
                                              string signatureHeader)
    {
        try
        {
            // 1. Verify Content-Digest
            var calculatedContentDigest = CalculateContentDigest(body);
            if (calculatedContentDigest != contentDigestHeader)
            {

                return new VerificationResult.Failure("Content-Digest mismatch");
            }


            // 2. Build signature base
            var signatureBase = BuildSignatureBase(calculatedContentDigest);

            // 3. Calculate expected signature
            var calculatedSignature = CalculateSignature(signatureBase, webhookSecret);

            // 4. Compare signatures
            if (calculatedSignature != signatureHeader)
            {
                return new VerificationResult.Failure("Signature mismatch");
            }

            return new VerificationResult.Success();
        }
        catch (Exception e)
        {
            return new VerificationResult.Failure($"Error: {e.Message}");
        }
    }

    private string CalculateContentDigest(string payload)
    {
        using (var sha256 = SHA256.Create())
        {
            var hash = sha256.ComputeHash(Encoding.UTF8.GetBytes(payload));
            var encoded = Convert.ToBase64String(hash);
            return $"sha-256=:{encoded}:";
        }
    }

    private string BuildSignatureBase(string contentDigest)
    {
        return $"\"content-digest\": {contentDigest}\n" +
               $"\"@signature-params\": (\"content-digest\");alg=\"hmac-sha256\"";
    }

    private string CalculateSignature(string signatureBase, string secret)
    {
        using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
        {
            var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(signatureBase));
            var encoded = Convert.ToBase64String(hash);
            return $"sig=:{encoded}:";
        }
    }

    public abstract class VerificationResult
    {
        public class Success : VerificationResult { }
        public class Failure : VerificationResult
        {
            public string Reason { get; }
            public Failure(string reason) { Reason = reason; }
        }
    }
}

import hashlib
import hmac
import base64
import re
from typing import Optional

class Rfc9421SignatureVerifier:
    def __init__(self, webhook_secret: str):
        self.webhook_secret = webhook_secret

    def verify_signature(self, body: str, content_digest_header: str,
                        signature_header: str) -> 'VerificationResult':
        try:
            # 1. Verify Content-Digest
            calculated_content_digest = self._calculate_content_digest(body)
            if calculated_content_digest != content_digest_header:
                return VerificationResult.Failure("Content-Digest mismatch")

            # 2. Build signature base
            signature_base = self._build_signature_base(calculated_content_digest)

            # 3. Calculate expected signature
            calculated_signature = self._calculate_signature(signature_base, self.webhook_secret)

            # 5. Compare signatures
            if calculated_signature != signature_header:
                return VerificationResult.Failure("Signature mismatch")

            return VerificationResult.Success()
        except Exception as e:
            return VerificationResult.Failure(f"Error: {str(e)}")

    def _calculate_content_digest(self, payload: str) -> str:
        hash_obj = hashlib.sha256(payload.encode('utf-8'))
        encoded = base64.b64encode(hash_obj.digest()).decode('utf-8')
        return f"sha-256=:{encoded}:"

    def _build_signature_base(self, content_digest: str) -> str:
        return (
            f'"content-digest": {content_digest}\n'
            f'"@signature-params": ("content-digest");alg="hmac-sha256"'
        )

    def _calculate_signature(self, signature_base: str, secret: str) -> str:
        hmac_obj = hmac.new(
            secret.encode('utf-8'),
            signature_base.encode('utf-8'),
            hashlib.sha256
        )
        encoded = base64.b64encode(hmac_obj.digest()).decode('utf-8')
        return f"sig=:{encoded}:"

class VerificationResult:
    class Success:
        pass

    class Failure:
        def __init__(self, reason: str):
            self.reason = reason

verifier = Rfc9421SignatureVerifier(webhook_secret='[JOB_OFFER_KEY]')
resultado = verifier.verify_signature(
    body='[POSTED_JSON_DOBY]',
    content_digest_header='[POSTED_CONTENT_DIGEST_HEADER]',
    signature_header='[POSTED_SIGNATURE_HEADER]'
)

print(resultado)