Outcome of BaseSignatureProvider.VerifyWebhookSignature. Three-state so the engine can
distinguish "no secret configured" (verification not possible) from "configured but the signature
didn't match" — enabling a verify-if-configured policy:
Verified — a secret is configured and the signature matched. Accept.
Failed — a secret is configured but the signature was missing/invalid. Reject.
NotConfigured — no secret is configured, so authenticity can't be checked. Accept with a
logged warning (the endpoint still functions during setup; tightens to
strict automatically once a key is set).
Outcome of BaseSignatureProvider.VerifyWebhookSignature. Three-state so the engine can distinguish "no secret configured" (verification not possible) from "configured but the signature didn't match" — enabling a verify-if-configured policy:
Verified— a secret is configured and the signature matched. Accept.Failed— a secret is configured but the signature was missing/invalid. Reject.NotConfigured— no secret is configured, so authenticity can't be checked. Accept with a logged warning (the endpoint still functions during setup; tightens to strict automatically once a key is set).