54 lines
2.1 KiB
Python
54 lines
2.1 KiB
Python
import time
|
|
|
|
from infrasynth.webhooks.signature import sign_payload, verify_signature
|
|
|
|
|
|
class TestSignPayload:
|
|
def test_signature_format(self):
|
|
signature = sign_payload("secret", '{"a": 1}')
|
|
assert signature.startswith("t=")
|
|
assert ",v1=" in signature
|
|
|
|
def test_signature_changes_with_payload(self):
|
|
sig1 = sign_payload("secret", "payload-one")
|
|
sig2 = sign_payload("secret", "payload-two")
|
|
assert sig1 != sig2
|
|
|
|
def test_signature_changes_with_secret(self):
|
|
sig1 = sign_payload("secret-a", "payload")
|
|
sig2 = sign_payload("secret-b", "payload")
|
|
assert sig1 != sig2
|
|
|
|
def test_timestamp_param(self):
|
|
signature = sign_payload("secret", "payload", timestamp=1000)
|
|
assert signature.startswith("t=1000,")
|
|
|
|
|
|
class TestVerifySignature:
|
|
def test_verify_roundtrip(self):
|
|
payload = '{"event": "ticket.created"}'
|
|
signature = sign_payload("secret", payload)
|
|
assert verify_signature("secret", payload, signature) is True
|
|
|
|
def test_wrong_secret_rejected(self):
|
|
payload = "payload"
|
|
signature = sign_payload("secret-a", payload)
|
|
assert verify_signature("secret-b", payload, signature) is False
|
|
|
|
def test_tampered_payload_rejected(self):
|
|
signature = sign_payload("secret", "original")
|
|
assert verify_signature("secret", "tampered", signature) is False
|
|
|
|
def test_expired_timestamp_rejected(self):
|
|
old_timestamp = int(time.time()) - 600
|
|
signature = sign_payload("secret", "payload", timestamp=old_timestamp)
|
|
assert verify_signature("secret", "payload", signature, tolerance_seconds=300) is False
|
|
|
|
def test_fresh_timestamp_accepted(self):
|
|
signature = sign_payload("secret", "payload")
|
|
assert verify_signature("secret", "payload", signature, tolerance_seconds=300) is True
|
|
|
|
def test_malformed_header_rejected(self):
|
|
assert verify_signature("secret", "payload", "garbage") is False
|
|
assert verify_signature("secret", "payload", "") is False
|
|
assert verify_signature("secret", "payload", "t=x,v1=y") is False
|