Account and key reference

import hashlib, hmac, os, re, time

SIGNING_SECRETS = {"hsec_k5nq0v7m3d8p": os.environ["ZEROCLICK_SIGNING_SECRET"]}
TOLERANCE_SECONDS = 300

def verify_access(method, raw_path_and_query, raw_body, headers, purpose):
    """purpose is "access.write" or "access.mint", from the matched route."""
    header = headers.get("zc-signature")
    if header is None:
        return None
    members = {}
    for entry in header.split(","):
        key, sep, value = entry.partition("=")
        key = key.strip()
        if not sep or not key or key in members:  # malformed or duplicate member
            return None
        members[key] = value.strip()              # unknown members are ignored
    t, kid, v1 = members.get("t"), members.get("kid"), members.get("v1")
    if not (t and kid and v1):
        return None
    if not re.fullmatch(r"\d{1,20}", t) or not re.fullmatch(r"[0-9a-f]{64}", v1):
        return None
    if abs(int(time.time()) - int(t)) > TOLERANCE_SECONDS:
        return None
    request_id = headers.get("zc-request-id")
    if not request_id:
        return None
    agent_id = headers.get("zc-agent-id") or ""
    secret = SIGNING_SECRETS.get(kid)
    if secret is None:
        return None
    canonical = "\n".join([
        t,
        method.upper(),
        raw_path_and_query,                       # as sent, never URL-decoded
        hashlib.sha256(raw_body).hexdigest(),
        request_id,
        agent_id,
        purpose,                                  # the seventh line
    ])
    expected = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, v1):
        return None
    return {"zc_request_id": request_id, "zc_agent_id": agent_id}

var signingSecrets = map[string]string{
	"hsec_k5nq0v7m3d8p": os.Getenv("ZEROCLICK_SIGNING_SECRET"),
}

const toleranceSeconds = 300

// purpose is "access.write" or "access.mint", from the matched route.
func verifyAccess(r *http.Request, rawPathAndQuery string, rawBody []byte, purpose string) bool {
	members := map[string]string{}
	for _, part := range strings.Split(r.Header.Get("zc-signature"), ",") {
		key, value, found := strings.Cut(part, "=")
		key = strings.TrimSpace(key)
		if !found || key == "" {
			return false // malformed member
		}
		if _, duplicate := members[key]; duplicate {
			return false // duplicate member; unknown members are ignored
		}
		members[key] = strings.TrimSpace(value)
	}
	t, kid, v1 := members["t"], members["kid"], members["v1"]
	if t == "" || len(t) > 20 || kid == "" || len(v1) != 64 {
		return false
	}
	timestamp, err := strconv.ParseUint(t, 10, 64)
	if err != nil {
		return false
	}
	if delta := time.Now().Unix() - int64(timestamp); delta > toleranceSeconds || delta < -toleranceSeconds {
		return false
	}
	requestID := r.Header.Get("zc-request-id")
	if requestID == "" {
		return false
	}
	agentID := r.Header.Get("zc-agent-id")
	secret, ok := signingSecrets[kid]
	if !ok || secret == "" {
		return false
	}
	bodyDigest := sha256.Sum256(rawBody)
	canonical := strings.Join([]string{
		t,
		strings.ToUpper(r.Method),
		rawPathAndQuery, // as sent, never URL-decoded
		hex.EncodeToString(bodyDigest[:]),
		requestID,
		agentID,
		purpose, // the seventh line
	}, "\n")
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(canonical))
	expected, err := hex.DecodeString(v1)
	if err != nil {
		return false
	}
	return hmac.Equal(expected, mac.Sum(nil))
}