zCjndZddlZddlZddlZdededefdZdedededefdZdefd Z d ed edefd Z dS) u Crypto helpers for the params server. Uses Python's stdlib hashlib/hmac (SHA-256), which is byte-for-byte identical to the hand-rolled SHA-256/HMAC implementation in LicenseValidator.mqh — MQL5 has no built-in crypto library, which is why that file reimplements SHA-256 from scratch. Server-side, we just use the real stdlib; no need to reimplement anything, only to match the exact message construction so both sides compute the same signature. Nsecretmessagereturnctj|d|dtjS)zHex-encoded HMAC-SHA256, matching _LV_HMAC()'s output format (lowercase hex, via StringFormat("%02x", ...) per byte in the MQL5 version).zutf-8)hmacnewencodehashlibsha256 hexdigest)rrs $/wd/td-params-server/crypto_utils.pyhmac_sha256_hexrsB 8 gw 7 7  ikk candidate_hexcLt||}tj||S)uConstant-time comparison — avoid timing side-channels on signature checks. Plain == comparison on the request HMAC would be a real (if narrow) vulnerability for an endpoint gating paid trading params.)rrcompare_digest)rrrexpecteds r verify_hmac_hexrs&vw//H  x 7 77rcBttjSN)inttimerr current_unix_tsr"s ty{{  r client_ts skew_secondscFtt|z |kSr)absr)rrs r timestamp_in_skewr&s   9, - - ==r) __doc__r rrstrrboolrrrrrrr r#s   C##8C8#8c8d8888>>C>D>>>>>>r