import { describe, expect, it } from 'vitest';
import { signWebhookBody, verifyWebhookSignature } from '../src/webhooks';

describe('webhook signing', () => {
  it('signs deterministically and verifies', () => {
    const body = JSON.stringify({ event: 'invoice.paid', id: 'inv-1' });
    const sig = signWebhookBody('secret-1', body);
    expect(sig).toMatch(/^[0-9a-f]{64}$/);
    expect(verifyWebhookSignature('secret-1', body, sig)).toBe(true);
  });

  it('rejects wrong secret, tampered body, and malformed signatures', () => {
    const body = '{"a":1}';
    const sig = signWebhookBody('secret-1', body);
    expect(verifyWebhookSignature('secret-2', body, sig)).toBe(false);
    expect(verifyWebhookSignature('secret-1', '{"a":2}', sig)).toBe(false);
    expect(verifyWebhookSignature('secret-1', body, 'short')).toBe(false);
  });
});