Swift 6 & iOS E-Signature Integration: URLSession, CryptoKit & SwiftUI (2026)

import Foundation
#if canImport(FoundationNetworking)
import FoundationNetworking
#endif

public struct SendDocumentRequest: Codable, Sendable, Equatable {
    public let title: String
    public let markdown: String?
    public let pdfBase64: String?
    public let pdfUrl: String?
    public let senderName: String
    public let senderEmail: String
    public let recipientName: String
    public let recipientEmail: String
    public let expiresInDays: Int
    public let webhookUrl: String?
    public let redirectUrl: String?
    public let metadata: [String: String]?

    public init(
        title: String,
        markdown: String? = nil,
        pdfBase64: String? = nil,
        pdfUrl: String? = nil,
        senderName: String,
        senderEmail: String,
        recipientName: String,
        recipientEmail: String,
        expiresInDays: Int = 14,
        webhookUrl: String? = nil,
        redirectUrl: String? = nil,
        metadata: [String: String]? = nil
    ) {
        self.title = title
        self.markdown = markdown
        self.pdfBase64 = pdfBase64
        self.pdfUrl = pdfUrl
        self.senderName = senderName
        self.senderEmail = senderEmail
        self.recipientName = recipientName
        self.recipientEmail = recipientEmail
        self.expiresInDays = expiresInDays
        self.webhookUrl = webhookUrl
        self.redirectUrl = redirectUrl
        self.metadata = metadata
    }
}

public struct SendDocumentResponse: Codable, Sendable, Equatable, Identifiable {
    public let id: String
    public let status: String
    public let title: String
    public let signingUrl: URL
    public let verifyUrl: URL
    public let expiresAt: String
    public let createdAt: String
}

public enum SignbeeClientError: Error, Sendable, LocalizedError {
    case invalidResponse
    case httpError(statusCode: Int, message: String)

    public var errorDescription: String? {
        switch self {
        case .invalidResponse:
            return "Received a non-HTTP response from Signbee API."
        case let .httpError(statusCode, message):
            return "Signbee API error (HTTP \(statusCode)): \(message)"
        }
    }
}

public actor SignbeeClient {
    private let apiKey: String
    private let baseURL: URL
    private let session: URLSession
    private let encoder: JSONEncoder
    private let decoder: JSONDecoder

    public init(
        apiKey: String,
        baseURL: URL = URL(string: "https://signb.ee")!,
        session: URLSession = .shared
    ) {
        self.apiKey = apiKey
        self.baseURL = baseURL
        self.session = session

        let enc = JSONEncoder()
        enc.keyEncodingStrategy = .convertToSnakeCase
        self.encoder = enc

        let dec = JSONDecoder()
        dec.keyDecodingStrategy = .convertFromSnakeCase
        self.decoder = dec
    }

    public func sendDocument(
        _ payload: SendDocumentRequest,
        idempotencyKey: String = UUID().uuidString
    ) async throws -> SendDocumentResponse {
        let endpoint = baseURL.appendingPathComponent("/api/v1/send")
        var request = URLRequest(url: endpoint)
        request.httpMethod = "POST"
        request.timeoutInterval = 15
        request.setValue("Bearer \(apiKey)", forHTTPHeaderField: "Authorization")
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
        request.setValue("application/json", forHTTPHeaderField: "Accept")
        request.setValue(idempotencyKey, forHTTPHeaderField: "Idempotency-Key")
        request.httpBody = try encoder.encode(payload)

        let (data, response) = try await session.data(for: request)
        guard let httpResponse = response as? HTTPURLResponse else {
            throw SignbeeClientError.invalidResponse
        }

        guard (200...299).contains(httpResponse.statusCode) else {
            let rawBody = String(data: data, encoding: .utf8) ?? "Unknown error"
            throw SignbeeClientError.httpError(statusCode: httpResponse.statusCode, message: rawBody)
        }

        return try decoder.decode(SendDocumentResponse.self, from: data)
    }

    public func fetchDocumentStatus(documentId: String) async throws -> SendDocumentResponse {
        let endpoint = baseURL.appendingPathComponent("/api/v1/documents/\(documentId)")
        var request = URLRequest(url: endpoint)
        request.httpMethod = "GET"
        request.setValue("Bearer \(apiKey)", forHTTPHeaderField: "Authorization")
        request.setValue("application/json", forHTTPHeaderField: "Accept")

        let (data, response) = try await session.data(for: request)
        guard let httpResponse = response as? HTTPURLResponse else {
            throw SignbeeClientError.invalidResponse
        }
        guard (200...299).contains(httpResponse.statusCode) else {
            let rawBody = String(data: data, encoding: .utf8) ?? "Unknown error"
            throw SignbeeClientError.httpError(statusCode: httpResponse.statusCode, message: rawBody)
        }

        return try decoder.decode(SendDocumentResponse.self, from: data)
    }
}

import SwiftUI
import SafariServices
import Observation

struct SafariSigningView: UIViewControllerRepresentable {
    let signingURL: URL

    func makeUIViewController(context: Context) -> SFSafariViewController {
        let config = SFSafariViewController.Configuration()
        config.entersReaderIfAvailable = false
        config.barCollapsingEnabled = true

        let safariVC = SFSafariViewController(url: signingURL, configuration: config)
        safariVC.preferredBarTintColor = UIColor(red: 0.04, green: 0.04, blue: 0.05, alpha: 1.0)
        safariVC.preferredControlTintColor = UIColor(red: 0.96, green: 0.62, blue: 0.04, alpha: 1.0)
        safariVC.dismissButtonStyle = .close
        return safariVC
    }

    func updateUIViewController(_ uiViewController: SFSafariViewController, context: Context) {}
}

@Observable
@MainActor
final class ContractSigningViewModel {
    var activeSigningURL: URL?
    var isSigned: Bool = false
    var verificationURL: URL?
    var errorMessage: String?

    func presentSigningCeremony(signingURL: URL, verifyURL: URL) {
        self.verificationURL = verifyURL
        self.activeSigningURL = signingURL
    }

    func handleIncomingUniversalLink(_ url: URL) {
        // Matches redirect_url: https://app.yourcompany.com/contracts/complete?doc_id=...
        guard url.path.contains("/contracts/complete") else { return }
        self.activeSigningURL = nil
        self.isSigned = true
    }
}

public struct ContractSigningFlowView: View {
    @State private var viewModel = ContractSigningViewModel()
    let initialSigningURL: URL
    let initialVerifyURL: URL

    public var body: some View {
        VStack(spacing: 20) {
            if viewModel.isSigned {
                Label("Agreement Cryptographically Signed", systemImage: "checkmark.seal.fill")
                    .font(.headline)
                    .foregroundStyle(.green)

                if let verifyURL = viewModel.verificationURL {
                    Link("View SHA-256 Audit Certificate", destination: verifyURL)
                        .buttonStyle(.borderedProminent)
                }
            } else {
                Button("Review & Sign Agreement") {
                    viewModel.presentSigningCeremony(
                        signingURL: initialSigningURL,
                        verifyURL: initialVerifyURL
                    )
                }
                .buttonStyle(.borderedProminent)
            }
        }
        .sheet(item: Binding(
            get: { viewModel.activeSigningURL.map { IdentifiableURL(url: $0) } },
            set: { if $0 == nil { viewModel.activeSigningURL = nil } }
        )) { item in
            SafariSigningView(signingURL: item.url)
                .ignoresSafeArea()
        }
        .onOpenURL { incomingURL in
            viewModel.handleIncomingUniversalLink(incomingURL)
        }
    }
}

private struct IdentifiableURL: Identifiable {
    let id = UUID()
    let url: URL
}

import Vapor
import Crypto

struct SignbeeWebhookPayload: Content, Sendable {
    let eventId: String
    let event: String
    let documentId: String
    let status: String
    let sha256Hash: String?
    let signedPdfUrl: String?
    let verifyUrl: String?
    let signerIp: String?
    let signedAt: String?

    enum CodingKeys: String, CodingKey {
        case eventId = "event_id"
        case event
        case documentId = "document_id"
        case status
        case sha256Hash = "sha256_hash"
        case signedPdfUrl = "signed_pdf_url"
        case verifyUrl = "verify_url"
        case signerIp = "signer_ip"
        case signedAt = "signed_at"
    }
}

enum SignbeeSignatureVerifier {
    static func verify(
        rawBody: ByteBuffer,
        signatureHeader: String?,
        webhookSecret: String
    ) -> Bool {
        guard let signatureHeader = signatureHeader else { return false }
        let hexString = signatureHeader.replacingOccurrences(of: "sha256=", with: "")
            .trimmingCharacters(in: .whitespacesAndNewlines)

        guard let signatureBytes = Data(hexEncoded: hexString) else {
            return false
        }

        let payloadData = Data(buffer: rawBody)
        let symmetricKey = SymmetricKey(data: Data(webhookSecret.utf8))

        return HMAC<SHA256>.isValidAuthenticationCode(
            signatureBytes,
            authenticating: payloadData,
            using: symmetricKey
        )
    }
}

extension Data {
    init?(hexEncoded hex: String) {
        guard hex.count.isMultiple(of: 2) else { return nil }
        var bytes = Data(capacity: hex.count / 2)
        var index = hex.startIndex
        while index < hex.endIndex {
            let nextIndex = hex.index(index, offsetBy: 2)
            guard let b = UInt8(hex[index..<nextIndex], radix: 16) else { return nil }
            bytes.append(b)
            index = nextIndex
        }
        self = bytes
    }
}

func registerSignbeeWebhookRoutes(_ app: Application, webhookSecret: String) {
    app.on(.POST, "webhooks", "signbee", body: .collect(maxSize: "2mb")) { req async throws -> HTTPStatus in
        guard let rawBuffer = req.body.data else {
            throw Abort(.badRequest, reason: "Missing webhook request body")
        }

        let signatureHeader = req.headers.first(name: "X-Signbee-Signature")
        guard SignbeeSignatureVerifier.verify(
            rawBody: rawBuffer,
            signatureHeader: signatureHeader,
            webhookSecret: webhookSecret
        ) else {
            req.logger.warning("Rejected Signbee webhook with invalid HMAC-SHA256 signature")
            throw Abort(.unauthorized, reason: "Invalid X-Signbee-Signature")
        }

        let payload = try req.content.decode(SignbeeWebhookPayload.self)
        req.logger.info("Verified Signbee event=\(payload.event) doc=\(payload.documentId) sha256=\(payload.sha256Hash ?? "pending")")

        // Persist status & trigger APNs push notification to iOS device
        return .ok
    }
}