<?php

it('handles subscription_created webhook', function () {
    // Set a dummy webhook secret so signature verification middleware is active.
    // With an invalid Stripe-Signature header, Cashier returns 403 (AccessDeniedHttpException).
    config(['cashier.webhook.secret' => 'whsec_test_dummy_secret']);

    $payload = [
        'type' => 'customer.subscription.created',
        'data' => [
            'object' => [
                'id' => 'sub_test123',
                'customer' => 'cus_test123',
                'status' => 'active',
                'items' => ['data' => [['price' => ['id' => 'price_pro']]]],
                'current_period_start' => now()->timestamp,
                'current_period_end' => now()->addMonth()->timestamp,
            ],
        ],
    ];

    $response = $this->postJson('/stripe/webhook', $payload, [
        'Stripe-Signature' => 'invalid_signature',
    ]);

    // 403 because signature verification is active and the signature is invalid.
    // This confirms the endpoint exists, CSRF is excluded, and Cashier is wired up.
    $response->assertStatus(403);
});