import { describe, expect, it } from "vitest";
import { createRequestSignature, isSignedRequestAuthorized } from "./hmac-signature";

describe("WooCommerce bridge signatures", () => {
  const body = '{"customerId":"wc_customer_1"}';
  const secret = "a-long-test-shared-secret";

  it("accepts a valid body signature", () => {
    const request = new Request("https://app.example.com/webhook", {
      headers: { "x-aiwebcommand-signature": createRequestSignature(body, secret) },
    });
    expect(isSignedRequestAuthorized(request, body, secret)).toBe(true);
  });

  it("does not accept a raw shared secret in a header", () => {
    const request = new Request("https://app.example.com/webhook", {
      headers: { "x-aiwebcommand-internal-secret": secret },
    });
    expect(isSignedRequestAuthorized(request, body, secret)).toBe(false);
  });
});