Function verifyVonageSignature

verifyVonageSignature(
    signatureSecret: string,
    sig: string,
    params: Record<string, string>,
): boolean
Verifies a Vonage signed-request webhook per Vonage's documented scheme:
1. Take the request params (excluding the sig param itself), sort by key.
2. Join as &key=value pairs (& prefix on each), prepended with the signature secret rule, then HMAC-SHA256 with the account signature secret as the key; hex-encode the digest (uppercased).
3. Constant-time-compare against the supplied sig.
A missing/empty sig rejects. Comparison is constant-time (timingSafeEqual) to avoid leaking the expected signature via timing. Pure + exported so it unit-tests with a known vector and the MJAPI router calls it on every public Vonage endpoint (these can't carry an MJ JWT).
Parameters
- signatureSecret: string
  The Vonage account signature secret (the HMAC key; resolved upstream — never inlined).
- sig: string
  The sig param Vonage sent (the signature to check).
- params: Record<string, string>
  The webhook params (the sig param is ignored if present).
Returns boolean
true when the signature is valid; false otherwise (including a missing sig).
- Defined in Providers/Vonage/src/vonage-ingress.ts:47