import { describe, expect, it } from "vitest";
import { signWebhook, verifyWebhook } from "./hmac.util";

describe("HMAC webhook signing", () => {
  const secret = "whsec_test_secret";
  const body = JSON.stringify({ id: "evt_1", type: "payment_intent.approved" });

  it("verifies its own signature", () => {
    const sig = signWebhook(body, secret);
    expect(verifyWebhook(body, sig, secret)).toBe(true);
  });

  it("rejects wrong secret", () => {
    const sig = signWebhook(body, secret);
    expect(verifyWebhook(body, sig, "other_secret")).toBe(false);
  });

  it("rejects tampered body", () => {
    const sig = signWebhook(body, secret);
    expect(verifyWebhook(body + " tampered", sig, secret)).toBe(false);
  });

  it("rejects old timestamps (replay)", () => {
    const oldSig = signWebhook(body, secret, Date.now() - 1000 * 60 * 60);
    expect(verifyWebhook(body, oldSig, secret)).toBe(false);
  });

  it("rejects malformed signature", () => {
    expect(verifyWebhook(body, "garbage", secret)).toBe(false);
  });
});