use reevit::verify_webhook_signature;
#[test]
fn webhook_signatures_require_the_exact_raw_body() {
let secret = "whsec_test_secret";
let payload = br#"{"id":"evt_123","type":"payment.succeeded"}"#;
let signature = "sha256=4c500144dd7f1eeaa27e2bd1058a873c46264c1c17532b0a06c5d065c220a1d1";
assert!(verify_webhook_signature(payload, signature, secret));
assert!(!verify_webhook_signature(
br#"{"type":"payment.succeeded","id":"evt_123"}"#,
signature,
secret
));
assert!(!verify_webhook_signature(payload, "sha256=invalid", secret));
assert!(!verify_webhook_signature(payload, signature, ""));
}