{
  "fixture_version": "mailwebhook-signature-v1",
  "created_at": "2026-09-06",
  "purpose": "Shared synthetic MailWebhook signature fixture for receiver examples, signature documentation, and the MailWebhook-aware HMAC verifier.",
  "body": {
    "filename": "mailwebhook-body-v1.json",
    "content_type": "application/json",
    "encoding": "utf-8",
    "preserve_final_newline": true,
    "byte_length": 1452,
    "sha256": "db71198e31397a66e7cead6e77a841ea1f98c25f5ea58fbbb423de6fe5e11445"
  },
  "signature": {
    "header_name": "X-MailWebhook-Signature",
    "header_value": "t=1700000000, kid=mw_test_kid_v1, v1=sb6J+BdzCGqOhPLuWoC/WIB5Er58mGur6vpHidghomA=",
    "algorithm": "HMAC-SHA256",
    "signed_input": "ascii(timestamp) + b'.' + raw_body_bytes",
    "digest_encoding": "base64",
    "timestamp": 1700000000,
    "timestamp_iso": "2023-11-14T22:13:20Z",
    "kid": "mw_test_kid_v1",
    "secret": "mw_test_secret_v1_DoNotUseInProduction_2026-09-06",
    "secret_encoding": "utf-8",
    "secret_is_synthetic": true,
    "v1": "sb6J+BdzCGqOhPLuWoC/WIB5Er58mGur6vpHidghomA="
  },
  "verification": {
    "fixed_now_seconds": 1700000120,
    "fixed_now_iso": "2023-11-14T22:15:20Z",
    "tolerance_seconds": 300,
    "expected_result": {
      "signature_status": "verified",
      "timestamp_status": "fresh",
      "accept_request": true
    }
  },
  "idempotency": {
    "header_name": "X-Idempotency-Key",
    "header_value": "fb288b82635266255b6cb6aee33415ec17fe6eef4676418790e2451743161dca",
    "algorithm": "sha256(strip_lower(message.message_id) + '|' + event.route_id)",
    "message_id": "<fixture.2026-09-06@mailwebhook.example>",
    "route_id": "7f75e9c6-1d08-4ed5-9a70-04551cd91e4a",
    "receiver_retention_seconds": 604800
  },
  "shared_test_cases": [
    {
      "name": "valid_fixture_at_fixed_clock",
      "body_filename": "mailwebhook-body-v1.json",
      "secret": "mw_test_secret_v1_DoNotUseInProduction_2026-09-06",
      "header_value": "t=1700000000, kid=mw_test_kid_v1, v1=sb6J+BdzCGqOhPLuWoC/WIB5Er58mGur6vpHidghomA=",
      "now_seconds": 1700000120,
      "tolerance_seconds": 300,
      "expected": {
        "signature_status": "verified",
        "timestamp_status": "fresh",
        "accept_request": true
      }
    },
    {
      "name": "wrong_secret",
      "mutate_secret": "wrong-secret",
      "expected": {
        "signature_status": "signature_mismatch",
        "accept_request": false
      }
    },
    {
      "name": "modified_raw_body",
      "append_to_body": " ",
      "expected": {
        "signature_status": "signature_mismatch",
        "accept_request": false
      }
    },
    {
      "name": "missing_required_field",
      "header_value": "t=1700000000, kid=mw_test_kid_v1",
      "expected": {
        "signature_status": "invalid_input",
        "field": "v1",
        "accept_request": false
      }
    },
    {
      "name": "duplicate_signature_field",
      "header_value": "t=1700000000, kid=mw_test_kid_v1, v1=sb6J+BdzCGqOhPLuWoC/WIB5Er58mGur6vpHidghomA=, v1=sb6J+BdzCGqOhPLuWoC/WIB5Er58mGur6vpHidghomA=",
      "expected": {
        "signature_status": "invalid_input",
        "field": "v1",
        "accept_request": false
      }
    },
    {
      "name": "invalid_base64_signature",
      "header_value": "t=1700000000, kid=mw_test_kid_v1, v1=not-base64!",
      "expected": {
        "signature_status": "invalid_input",
        "field": "v1",
        "accept_request": false
      }
    },
    {
      "name": "short_digest_signature",
      "header_value": "t=1700000000, kid=mw_test_kid_v1, v1=c2hvcnQ=",
      "expected": {
        "signature_status": "invalid_input",
        "field": "v1",
        "accept_request": false
      }
    },
    {
      "name": "stale_timestamp",
      "now_seconds": 1700000301,
      "expected": {
        "signature_status": "verified",
        "timestamp_status": "stale",
        "accept_request": false
      }
    },
    {
      "name": "future_timestamp",
      "now_seconds": 1699999699,
      "expected": {
        "signature_status": "verified",
        "timestamp_status": "future",
        "accept_request": false
      }
    }
  ]
}