0pt/tests/api/stripe-webhook-config.test.ts

import { afterEach, expect, it } from "vitest";
import { NextRequest } from "next/server";
import { POST } from "@/app/api/webhooks/stripe/route";

const savedSecretKey = process.env.STRIPE_SECRET_KEY;
const savedWebhookSecret = process.env.STRIPE_WEBHOOK_SECRET;

afterEach(() => {
  if (savedSecretKey === undefined) delete process.env.STRIPE_SECRET_KEY;
  else process.env.STRIPE_SECRET_KEY = savedSecretKey;
  if (savedWebhookSecret === undefined) delete process.env.STRIPE_WEBHOOK_SECRET;
  else process.env.STRIPE_WEBHOOK_SECRET = savedWebhookSecret;
});

it("does not acknowledge an unverified Stripe event when credentials are absent", async () => {
  delete process.env.STRIPE_SECRET_KEY;
  delete process.env.STRIPE_WEBHOOK_SECRET;
  const req = new NextRequest("https://0pt.app/api/webhooks/stripe", {
    method: "POST",
    headers: { "stripe-signature": "unverified" },
    body: "{}",
  });

  const res = await POST(req);
  expect(res.status).toBe(503);
  expect(await res.json()).toEqual({ received: false, reason: "not_configured" });
});

it("rejects a delivery with no Stripe signature even when configured", async () => {
  process.env.STRIPE_SECRET_KEY = "sk_test_fake_local_regression";
  process.env.STRIPE_WEBHOOK_SECRET = "whsec_fake_local_regression";
  const req = new NextRequest("https://0pt.app/api/webhooks/stripe", {
    method: "POST",
    body: "{}",
  });

  const res = await POST(req);
  expect(res.status).toBe(400);
  expect(await res.json()).toEqual({ error: "missing_signature" });
});