30 lines
1.1 KiB
PHP
30 lines
1.1 KiB
PHP
<?php
|
|
|
|
it('handles subscription_created webhook', function () {
|
|
// Set a dummy webhook secret so signature verification middleware is active.
|
|
// With an invalid Stripe-Signature header, Cashier returns 403 (AccessDeniedHttpException).
|
|
config(['cashier.webhook.secret' => 'whsec_test_dummy_secret']);
|
|
|
|
$payload = [
|
|
'type' => 'customer.subscription.created',
|
|
'data' => [
|
|
'object' => [
|
|
'id' => 'sub_test123',
|
|
'customer' => 'cus_test123',
|
|
'status' => 'active',
|
|
'items' => ['data' => [['price' => ['id' => 'price_pro']]]],
|
|
'current_period_start' => now()->timestamp,
|
|
'current_period_end' => now()->addMonth()->timestamp,
|
|
]
|
|
]
|
|
];
|
|
|
|
$response = $this->postJson('/stripe/webhook', $payload, [
|
|
'Stripe-Signature' => 'invalid_signature',
|
|
]);
|
|
|
|
// 403 because signature verification is active and the signature is invalid.
|
|
// This confirms the endpoint exists, CSRF is excluded, and Cashier is wired up.
|
|
$response->assertStatus(403);
|
|
});
|