test: add tests for EntitlementWebhookService #16

New issue

Open

opened 2026-02-20 16:38:28 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 16:38:28 +00:00

Member

Problem

Services/EntitlementWebhookService.php has no dedicated test file. The service handles webhook dispatch, signature verification, circuit breaker, and SSRF protection.

Key areas lacking coverage

Webhook registration and event dispatch (sync and async)
HMAC-SHA256 signature signing and verification
Circuit breaker trigger (after N consecutive failures) and reset
Delivery retry logic with exponential backoff
SSRF protection: block private IPs, localhost, .local domains
SafeWebhookUrl validation rule in store/update
InvalidWebhookUrlException thrown correctly

Acceptance Criteria

Create tests/Feature/EntitlementWebhookServiceTest.php using Pest
Mock HTTP client to simulate delivery success/failure
Test circuit breaker state transitions
Test all SSRF-blocked URL patterns
Test signature verification with correct and incorrect secrets

Discovered during automated scan (issue #3)

## Problem `Services/EntitlementWebhookService.php` has no dedicated test file. The service handles webhook dispatch, signature verification, circuit breaker, and SSRF protection. ## Key areas lacking coverage - Webhook registration and event dispatch (sync and async) - HMAC-SHA256 signature signing and verification - Circuit breaker trigger (after N consecutive failures) and reset - Delivery retry logic with exponential backoff - SSRF protection: block private IPs, localhost, .local domains - `SafeWebhookUrl` validation rule in store/update - `InvalidWebhookUrlException` thrown correctly ## Acceptance Criteria - Create `tests/Feature/EntitlementWebhookServiceTest.php` using Pest - Mock HTTP client to simulate delivery success/failure - Test circuit breaker state transitions - Test all SSRF-blocked URL patterns - Test signature verification with correct and incorrect secrets _Discovered during automated scan (issue #3)_