digest.go

package mppx

import (
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
)

// ComputeDigest computes a SHA-256 digest of the given data.
// The returned string is in the format "sha-256=<base64>", suitable for the
// digest field in a Challenge.
//
// data may be a []byte, string, or a JSON-serializable value.
func ComputeDigest(data any) (string, error) {
	var raw []byte
	switch v := data.(type) {
	case []byte:
		raw = v
	case string:
		raw = []byte(v)
	default:
		b, err := json.Marshal(v)
		if err != nil {
			return "", fmt.Errorf("mpp: cannot serialize digest input: %w", err)
		}
		raw = b
	}
	sum := sha256.Sum256(raw)
	return "sha-256=" + base64.StdEncoding.EncodeToString(sum[:]), nil
}

// VerifyDigest verifies that a digest string matches the given data.
// digest must be in the format "sha-256=<base64>".
func VerifyDigest(digest string, data any) (bool, error) {
	expected, err := ComputeDigest(data)
	if err != nil {
		return false, err
	}
	// Use length-independent comparison to avoid leaking length information,
	// though timing-safe comparison of the full strings is sufficient here.
	return digest == expected, nil
}