fix: resolve cors error with sign header

Author: mcquenji

bin/main.dart

@@ -25,7 +25,11 @@ void main(List<String> args) async {
     final modularHandler = Modular(
       module: ServerModule(prisma),
       middlewares: [
-        corsHeaders(),
+        corsHeaders(
+          headers: {
+            ACCESS_CONTROL_ALLOW_HEADERS: 'Content-Type, Authorization, X-Signature, client-id',
+          },
+        ),
         contentTypeJson,
       ],
     );

lib/modules/client/infra/services/hmac_signature_service.dart

@@ -17,14 +17,22 @@ class HmacSignatureService extends SignatureService {
     final hmac = Hmac(sha256, utf8.encode(secret));
     final signature = hmac.convert(utf8.encode(body)).toString();
 
+    log('Generated signature: $signature, secret: $secret, body: $body');
+
     return signature;
   }
 
   @override
   bool verifySignature(String signature, String body, String secret) {
     final serverSignature = sign(body, secret);
 
-    return signature == serverSignature;
+    final valid = signature == serverSignature;
+
+    if (!valid) {
+      log('Invalid signature: Signature is "$signature", expected "$serverSignature"');
+    }
+
+    return valid;
   }
 
   @override

lib/modules/client/presentation/guards/signature_guard.dart

@@ -2,27 +2,41 @@ import 'dart:async';
 import 'dart:convert';
 
 import 'package:echidna_server/echidna_server.dart';
-import 'package:echidna_server/modules/client/client.dart';
 import 'package:shelf/shelf.dart';
 import 'package:shelf_modular/shelf_modular.dart';
 
 /// Verifies that the client key is valid.
 class SignatureGuard extends RouteGuard {
   @override
   FutureOr<bool> canActivate(Request request, [ModularRoute? route]) async {
+    request.log('Checking signature');
+
     final body = await request.readAsString();
 
     final signatureService = Modular.get<SignatureService>();
 
     final clientKey = await signatureService.extractClientKey(request);
 
-    if (clientKey == null) return false;
+    if (clientKey == null) {
+      request.log('No client key found');
+
+      return false;
+    }
 
     final signature = request.headers['x-signature'];
 
-    if (signature == null) return false;
+    if (signature == null) {
+      request.log('No signature provided');
+      return false;
+    }
+
+    request.log('Signature provided: $signature');
+
+    final isValid = signatureService.verifySignature(signature, body, clientKey.key!);
+
+    request.log(isValid ? 'Signature verification succeeded' : 'Signature verification failed');
 
-    return signatureService.verifySignature(signature, body, clientKey.key!);
+    return isValid;
   }
 
   @override