7 files changed, 54 insertions, 69 deletions
diff --git a/lib/unstable/Security/Signature/Exceptions/IncomingRequestNotFoundException.php b/lib/unstable/Security/Signature/Exceptions/SignatureElementNotFoundException.php
index 1953af39ec5..f40f79410ae 100644
--- a/lib/unstable/Security/Signature/Exceptions/IncomingRequestNotFoundException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatureElementNotFoundException.php
@@ -12,5 +12,5 @@ namespace NCU\Security\Signature\Exceptions;
  * @since 31.0.0
  * @experimental 31.0.0
  */
-class IncomingRequestNotFoundException extends SignatureException {
+class SignatureElementNotFoundException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/ISignatoryManager.php b/lib/unstable/Security/Signature/ISignatoryManager.php
index 825ccac1ce9..19ba83a4206 100644
--- a/lib/unstable/Security/Signature/ISignatoryManager.php
+++ b/lib/unstable/Security/Signature/ISignatoryManager.php
@@ -8,7 +8,6 @@ declare(strict_types=1);
  */
 namespace NCU\Security\Signature;
 
-use NCU\Security\Signature\Model\IIncomingSignedRequest;
 use NCU\Security\Signature\Model\ISignatory;
 
 /**
@@ -34,6 +33,7 @@ interface ISignatoryManager {
 	/**
 	 * options that might affect the way the whole process is handled:
 	 * [
+	 *   'bodyMaxSize' => 10000,
 	 *   'ttl' => 300,
 	 *   'ttlSignatory' => 86400*3,
 	 *   'extraSignatureHeaders' => [],
@@ -62,10 +62,10 @@ interface ISignatoryManager {
 	 *
 	 * Used to confirm authenticity of incoming request.
 	 *
-	 * @param IIncomingSignedRequest $signedRequest
+	 * @param string $remote
 	 *
 	 * @return ISignatory|null must be NULL if no signatory is found
 	 * @since 31.0.0
 	 */
-	public function getRemoteSignatory(IIncomingSignedRequest $signedRequest): ?ISignatory;
+	public function getRemoteSignatory(string $remote): ?ISignatory;
 }
diff --git a/lib/unstable/Security/Signature/ISignatureManager.php b/lib/unstable/Security/Signature/ISignatureManager.php
index cc0297224dc..1969b970aa6 100644
--- a/lib/unstable/Security/Signature/ISignatureManager.php
+++ b/lib/unstable/Security/Signature/ISignatureManager.php
@@ -28,7 +28,7 @@ use NCU\Security\Signature\Model\ISignatory;
  *     "date": "Mon, 08 Jul 2024 14:16:20 GMT",
  *     "digest": "SHA-256=U7gNVUQiixe5BRbp4Tg0xCZMTcSWXXUZI2\\/xtHM40S0=",
  *     "host": "hostname.of.the.recipient",
- *     "Signature": "keyId=\"https://author.hostname/key\",algorithm=\"ras-sha256\",headers=\"content-length date digest host\",signature=\"DzN12OCS1rsA[...]o0VmxjQooRo6HHabg==\""
+ *     "Signature": "keyId=\"https://author.hostname/key\",algorithm=\"sha256\",headers=\"content-length date digest host\",signature=\"DzN12OCS1rsA[...]o0VmxjQooRo6HHabg==\""
  * }
  *
  * 'content-length' is the total length of the data/content
diff --git a/lib/unstable/Security/Signature/Model/IIncomingSignedRequest.php b/lib/unstable/Security/Signature/Model/IIncomingSignedRequest.php
index a6682eff33c..3e2ebb22a5f 100644
--- a/lib/unstable/Security/Signature/Model/IIncomingSignedRequest.php
+++ b/lib/unstable/Security/Signature/Model/IIncomingSignedRequest.php
@@ -8,6 +8,7 @@ declare(strict_types=1);
  */
 namespace NCU\Security\Signature\Model;
 
+use NCU\Security\Signature\Exceptions\SignatureElementNotFoundException;
 use NCU\Security\Signature\ISignatureManager;
 use OCP\IRequest;
 
@@ -21,15 +22,6 @@ use OCP\IRequest;
  */
 interface IIncomingSignedRequest extends ISignedRequest {
 	/**
-	 * set the core IRequest that might be signed
-	 *
-	 * @param IRequest $request
-	 * @return IIncomingSignedRequest
-	 * @since 31.0.0
-	 */
-	public function setRequest(IRequest $request): IIncomingSignedRequest;
-
-	/**
 	 * returns the base IRequest
 	 *
 	 * @return IRequest
@@ -38,23 +30,6 @@ interface IIncomingSignedRequest extends ISignedRequest {
 	public function getRequest(): IRequest;
 
 	/**
-	 * set the time, extracted from the base request headers
-	 *
-	 * @param int $time
-	 * @return IIncomingSignedRequest
-	 * @since 31.0.0
-	 */
-	public function setTime(int $time): IIncomingSignedRequest;
-
-	/**
-	 * get the time, extracted from the base request headers
-	 *
-	 * @return int
-	 * @since 31.0.0
-	 */
-	public function getTime(): int;
-
-	/**
 	 * set the hostname at the source of the request,
 	 * based on the keyId defined in the signature header.
 	 *
@@ -78,28 +53,8 @@ interface IIncomingSignedRequest extends ISignedRequest {
 	 * keyId is a mandatory entry in the headers of a signed request.
 	 *
 	 * @return string
+	 * @throws SignatureElementNotFoundException
 	 * @since 31.0.0
 	 */
 	public function getKeyId(): string;
-
-	/**
-	 * store a clear and estimated version of the signature, based on payload and headers.
-	 * This clear version will be compared with the real signature using
-	 * the public key of remote instance at the origin of the request.
-	 *
-	 * @param string $signature
-	 * @return IIncomingSignedRequest
-	 * @since 31.0.0
-	 */
-	public function setEstimatedSignature(string $signature): IIncomingSignedRequest;
-
-	/**
-	 * returns a clear and estimated version of the signature, based on payload and headers.
-	 * This clear version will be compared with the real signature using
-	 * the public key of remote instance at the origin of the request.
-	 *
-	 * @return string
-	 * @since 31.0.0
-	 */
-	public function getEstimatedSignature(): string;
 }
diff --git a/lib/unstable/Security/Signature/Model/IOutgoingSignedRequest.php b/lib/unstable/Security/Signature/Model/IOutgoingSignedRequest.php
index b2ca221e126..3c9445af745 100644
--- a/lib/unstable/Security/Signature/Model/IOutgoingSignedRequest.php
+++ b/lib/unstable/Security/Signature/Model/IOutgoingSignedRequest.php
@@ -9,6 +9,7 @@ declare(strict_types=1);
 namespace NCU\Security\Signature\Model;
 
 use NCU\Security\Signature\ISignatureManager;
+use NCU\Security\Signature\SignatureAlgorithm;
 
 /**
  * extends ISignedRequest to add info requested at the generation of the signature
@@ -41,12 +42,12 @@ interface IOutgoingSignedRequest extends ISignedRequest {
 	 * add a key/value pair to the headers of the request
 	 *
 	 * @param string $key
-	 * @param string|int|float|bool|array $value
+	 * @param string|int|float $value
 	 *
 	 * @return IOutgoingSignedRequest
 	 * @since 31.0.0
 	 */
-	public function addHeader(string $key, string|int|float|bool|array $value): IOutgoingSignedRequest;
+	public function addHeader(string $key, string|int|float $value): IOutgoingSignedRequest;
 
 	/**
 	 * returns list of headers value that will be added to the base request
@@ -57,38 +58,38 @@ interface IOutgoingSignedRequest extends ISignedRequest {
 	public function getHeaders(): array;
 
 	/**
-	 * store a clear version of the signature
+	 * set the ordered list of used headers in the Signature
 	 *
-	 * @param string $estimated
+	 * @param list<string> $list
 	 *
 	 * @return IOutgoingSignedRequest
 	 * @since 31.0.0
 	 */
-	public function setClearSignature(string $estimated): IOutgoingSignedRequest;
+	public function setHeaderList(array $list): IOutgoingSignedRequest;
 
 	/**
-	 * returns the clear version of the signature
+	 * returns ordered list of used headers in the Signature
 	 *
-	 * @return string
+	 * @return list<string>
 	 * @since 31.0.0
 	 */
-	public function getClearSignature(): string;
+	public function getHeaderList(): array;
 
 	/**
 	 * set algorithm to be used to sign the signature
 	 *
-	 * @param string $algorithm
+	 * @param SignatureAlgorithm $algorithm
 	 *
 	 * @return IOutgoingSignedRequest
 	 * @since 31.0.0
 	 */
-	public function setAlgorithm(string $algorithm): IOutgoingSignedRequest;
+	public function setAlgorithm(SignatureAlgorithm $algorithm): IOutgoingSignedRequest;
 
 	/**
 	 * returns the algorithm set to sign the signature
 	 *
-	 * @return string
+	 * @return SignatureAlgorithm
 	 * @since 31.0.0
 	 */
-	public function getAlgorithm(): string;
+	public function getAlgorithm(): SignatureAlgorithm;
 }
diff --git a/lib/unstable/Security/Signature/Model/ISignedRequest.php b/lib/unstable/Security/Signature/Model/ISignedRequest.php
index ebb0e1c5b58..76c033970fe 100644
--- a/lib/unstable/Security/Signature/Model/ISignedRequest.php
+++ b/lib/unstable/Security/Signature/Model/ISignedRequest.php
@@ -9,6 +9,7 @@ declare(strict_types=1);
 namespace NCU\Security\Signature\Model;
 
 use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
+use NCU\Security\Signature\Exceptions\SignatureElementNotFoundException;
 
 /**
  * model that store data related to a possible signature.
@@ -39,19 +40,47 @@ interface ISignedRequest {
 	/**
 	 * set the list of headers related to the signature of the request
 	 *
-	 * @param array $signatureHeader
+	 * @param array $elements
+	 *
 	 * @return ISignedRequest
 	 * @since 31.0.0
 	 */
-	public function setSignatureHeader(array $signatureHeader): ISignedRequest;
+	public function setSignatureElements(array $elements): ISignedRequest;
 
 	/**
-	 * get the list of headers related to the signature of the request
+	 * get the list of elements in the Signature header of the request
 	 *
 	 * @return array
 	 * @since 31.0.0
 	 */
-	public function getSignatureHeader(): array;
+	public function getSignatureElements(): array;
+
+	/**
+	 * @param string $key
+	 *
+	 * @return string
+	 * @throws SignatureElementNotFoundException
+	 * @since 31.0.0
+	 */
+	public function getSignatureElement(string $key): string;
+
+	/**
+	 * store a clear version of the signature
+	 *
+	 * @param string $clearSignature
+	 *
+	 * @return ISignedRequest
+	 * @since 31.0.0
+	 */
+	public function setClearSignature(string $clearSignature): ISignedRequest;
+
+	/**
+	 * returns the clear version of the signature
+	 *
+	 * @return string
+	 * @since 31.0.0
+	 */
+	public function getClearSignature(): string;
 
 	/**
 	 * set the signed version of the signature
diff --git a/lib/unstable/Security/Signature/Model/SignatoryStatus.php b/lib/unstable/Security/Signature/Model/SignatoryStatus.php
index 1c28f6580e7..4174102beae 100644
--- a/lib/unstable/Security/Signature/Model/SignatoryStatus.php
+++ b/lib/unstable/Security/Signature/Model/SignatoryStatus.php
@@ -12,7 +12,7 @@ namespace NCU\Security\Signature\Model;
  * current status of signatory. is it trustable or not ?
  *
  * - SYNCED = the remote instance is trustable.
- * - BROKEN = the remote instance does not use the same key pairs
+ * - BROKEN = the remote instance does not use the same key pairs than previously
  *
  * @experimental 31.0.0
  * @since 31.0.0