import crypto from "node:crypto";
import { describe, expect, it } from "vitest";
import { verifyHmacSignature } from "@/server/payments/webhooks";

describe("payment webhook signature", () => {
  it("validates HMAC SHA-256 signatures", () => {
    const raw = JSON.stringify({ id: "evt_1" });
    const secret = "super-secret";
    const signature = crypto.createHmac("sha256", secret).update(raw).digest("hex");
    expect(verifyHmacSignature(raw, `sha256=${signature}`, secret)).toBe(true);
    expect(verifyHmacSignature(raw, "sha256=bad", secret)).toBe(false);
  });
});