add test batches

2026-06-08 23:45:55 -04:00
parent c792b8be05
commit 8d4d610b82
1480 changed files with 22587 additions and 10762 deletions
@@ -0,0 +1,39 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiBatch12WebhookProviderMatrixContractTest extends FullSurfaceE2EContractCase
+{
+    public function test_provider_callbacks_reject_missing_mismatched_and_replayed_signatures(): void
+    {
+        $routes = array_slice($this->apiRoutesContainingAny(['webhook', 'callback', 'paypal', 'stripe', 'payment', 'provider']), 0, 120);
+        $headerSets = [
+            [],
+            ['X-Signature' => 'bad-signature'],
+            ['PayPal-Transmission-Id' => 'replay-id', 'PayPal-Transmission-Sig' => 'bad'],
+            ['Stripe-Signature' => 't=1,v1=bad'],
+        ];
+
+        foreach ($routes as $route) {
+            $method = $this->primaryMethod($route);
+            if (! in_array($method, ['POST', 'PUT', 'PATCH'], true)) {
+                continue;
+            }
+
+            foreach ($headerSets as $headers) {
+                $response = $this->withHeaders($headers)->json($method, $this->materializePath($route->uri()), [
+                    'id' => 'evt_batch_12',
+                    'type' => 'payment.succeeded',
+                    'amount' => 10,
+                    'metadata' => ['invoice_id' => $this->ids['invoiceId']],
+                ]);
+
+                $this->assertStatusIn($response, [200, 202, 400, 401, 403, 404, 405, 409, 419, 422], 'provider callback '.$method.' '.$route->uri());
+                $this->assertNoServerError($response, 'provider callback '.$method.' '.$route->uri());
+                $this->assertStringNotContainsString('secret', strtolower($response->getContent()), 'provider callback must not expose secrets');
+            }
+        }
+    }
+}