hecks 2.9.0 → 3.0.0

data/rust/host/src/bin/expr_harness.rs

@@ -0,0 +1,46 @@
+//! Rust side of the expression differential: interprets each `{ast, instance}` case on stdin
+//! through the same `expr_json` the mint-time invariant checker uses, and prints one result each.
+//! `spec/rust_host_expr_json_conformance_spec.rb` diffs those against Ruby's own interpreters.
+
+#[allow(dead_code)]
+#[path = "../expr_json.rs"]
+mod expr_json;
+
+use expr_json::Value;
+use serde_json::{json, Value as Json};
+use std::io::Read;
+
+// Usage: `expr_harness < {"cases": [{"ast": <ast_json>, "instance": <json>}, ...]}`.
+// Prints `{"results": [{"ok": <value>} | {"error": <message>}, ...]}`, one per case, in order.
+fn main() -> anyhow::Result<()> {
+    let mut input = String::new();
+    std::io::stdin().read_to_string(&mut input)?;
+    let request: Json = serde_json::from_str(&input)?;
+    let cases = request.get("cases").and_then(Json::as_array).ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
+
+    let results: Vec<Json> = cases
+        .iter()
+        .map(|case| {
+            let outcome = expr_json::parse(&case["ast"]).and_then(|expr| expr_json::interpret(&expr, &case["instance"]));
+            match outcome {
+                Ok(value) => json!({ "ok": to_json(&value) }),
+                Err(error) => json!({ "error": error }),
+            }
+        })
+        .collect();
+
+    println!("{}", json!({ "results": results }));
+    Ok(())
+}
+
+fn to_json(value: &Value) -> Json {
+    match value {
+        Value::Int(i) => json!(i),
+        Value::Float(f) => serde_json::Number::from_f64(*f).map_or(Json::Null, Json::Number),
+        Value::Str(s) => json!(s),
+        Value::Bool(b) => json!(b),
+        Value::Nil => Json::Null,
+        Value::Array(items) => Json::Array(items.iter().map(to_json).collect()),
+        Value::Object(object) => object.clone(),
+    }
+}

data/rust/host/src/bin/lineage_harness.rs

@@ -0,0 +1,119 @@
+//! Rust side of the differential-parity harness: generic lineage reads and writes on Postgres.
+//! Usage: `lineage_harness <db_name> <app_role> <domain> <era>`, JSON on stdin and stdout.
+//!
+//! stdin is `{"operations": [...]}`, each one of:
+//!   {"op": "read_all", "storage_name": "order"}
+//!   {"op": "read_by_id", "storage_name": "order", "id": "order-1"}
+//!   {"op": "write", "aggregate": "Pizzas::Order", "id": "order-9", "state": {...}}
+//! stdout is `{"results": [...]}`, one entry per operation in order. A per-operation Postgres
+//! error (such as an RLS refusal) lands in that entry; only a failed connection exits nonzero.
+
+// journal.rs has no `crate::` references, so it is shared with `bootstrap` by path, not a lib
+// split.
+// The flat-journal functions it also carries are unused here.
+#[allow(dead_code)]
+#[path = "../journal.rs"]
+mod journal;
+
+// journal.rs's Postgres tests connect through `crate::test_pg`, so the harness's own test build
+// carries the same connection-string helpers.
+#[cfg(test)]
+#[path = "../test_pg.rs"]
+mod test_pg;
+
+use serde_json::{json, Value};
+use std::io::Read;
+use tokio_postgres::NoTls;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let args: Vec<String> = std::env::args().collect();
+    let [_, db_name, app_role, domain, era] = args.as_slice() else {
+        anyhow::bail!("usage: lineage_harness <db_name> <app_role> <domain> <era>");
+    };
+    let era: i32 = era.parse().map_err(|_| anyhow::anyhow!("era must be an integer, got {era:?}"))?;
+
+    let mut input = String::new();
+    std::io::stdin().read_to_string(&mut input)?;
+    let request: Value = serde_json::from_str(&input)?;
+    let operations = request
+        .get("operations")
+        .and_then(|v| v.as_array())
+        .ok_or_else(|| anyhow::anyhow!("stdin JSON missing \"operations\" array"))?;
+
+    // tokio_postgres ignores libpq's `PGPASSWORD`, so pass it through when the server asks for one.
+    let password = std::env::var("PGPASSWORD").ok().filter(|p| !p.is_empty()).map(|p| format!(" password={p}")).unwrap_or_default();
+    let conn_string = format!("host=localhost dbname={db_name} user={app_role}{password}");
+    let (client, connection) = tokio_postgres::connect(&conn_string, NoTls).await?;
+    tokio::spawn(async move {
+        if let Err(err) = connection.await {
+            eprintln!("postgres connection error: {err:#}");
+        }
+    });
+
+    let config = journal::LineageConfig { domain: domain.clone(), era: Some(era), mirrored: None };
+    let mut results = Vec::with_capacity(operations.len());
+
+    for operation in operations {
+        results.push(run_one(&client, &config, operation).await);
+    }
+
+    println!("{}", json!({ "results": results }));
+    Ok(())
+}
+
+async fn run_one(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> Value {
+    let op = operation.get("op").and_then(|v| v.as_str()).unwrap_or("");
+
+    let outcome = match op {
+        "read_all" => read_all(client, config, operation).await,
+        "read_by_id" => read_by_id(client, config, operation).await,
+        "write" => write(client, config, operation).await,
+        other => Err(anyhow::anyhow!("unknown op {other:?}")),
+    };
+
+    match outcome {
+        Ok(mut value) => {
+            value["op"] = json!(op);
+            value["ok"] = json!(true);
+            value
+        }
+        Err(err) => json!({ "op": op, "ok": false, "error": format!("{err:#}") }),
+    }
+}
+
+async fn read_all(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> anyhow::Result<Value> {
+    let storage_name = require_str(operation, "storage_name")?;
+    let rows = journal::read_lineage_head_all(client, &config.domain, storage_name).await?;
+    Ok(json!({ "rows": rows.into_iter().map(|(id, state)| json!([id, state])).collect::<Vec<_>>() }))
+}
+
+async fn read_by_id(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> anyhow::Result<Value> {
+    let storage_name = require_str(operation, "storage_name")?;
+    let id = require_str(operation, "id")?;
+    let state = journal::read_lineage_head_by_id(client, &config.domain, storage_name, id).await?;
+    Ok(json!({ "state": state }))
+}
+
+async fn write(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> anyhow::Result<Value> {
+    let aggregate = require_str(operation, "aggregate")?;
+    let id = require_str(operation, "id")?;
+    let state = operation
+        .get("state")
+        .ok_or_else(|| anyhow::anyhow!("write operation missing \"state\": {operation}"))?;
+
+    journal::append_lineage_mutation(
+        client,
+        config,
+        &journal::Mutation { aggregate, id, operation: "save", state },
+    )
+    .await?;
+    Ok(json!({}))
+}
+
+fn require_str<'a>(operation: &'a Value, field: &str) -> anyhow::Result<&'a str> {
+    operation
+        .get(field)
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow::anyhow!("operation missing {field:?}: {operation}"))
+}

data/rust/host/src/bin/mint_harness.rs

@@ -0,0 +1,135 @@
+//! Rust-mints-it-too side of the differential-parity harness: one boot decision per invocation.
+//! Lets the spec mint an edge with no Ruby process so the two `_head` views can be diffed.
+
+// Modules are shared with `bootstrap` by path, not a lib split, so `crate::` in mint.rs resolves
+// here.
+#[allow(dead_code)]
+#[path = "../log.rs"]
+mod log;
+#[allow(dead_code)]
+#[path = "../journal.rs"]
+mod journal;
+#[allow(dead_code)]
+#[path = "../storage_shape.rs"]
+mod storage_shape;
+#[allow(dead_code)]
+#[path = "../reference_transform.rs"]
+mod reference_transform;
+#[allow(dead_code)]
+#[path = "../expr_json.rs"]
+mod expr_json;
+#[allow(dead_code)]
+#[path = "../reference_validate.rs"]
+mod reference_validate;
+#[allow(dead_code)]
+#[path = "../approval.rs"]
+mod approval;
+#[allow(dead_code)]
+#[path = "../mint.rs"]
+mod mint;
+
+// The shared modules' Postgres tests connect through `crate::test_pg`, so the harness's own test
+// build carries the same connection-string helpers.
+#[cfg(test)]
+#[path = "../test_pg.rs"]
+mod test_pg;
+
+use serde_json::{json, Value};
+use std::collections::HashMap;
+use tokio_postgres::NoTls;
+
+// Usage: `mint_harness <db_name> <owner_role> <domain> <ir_json_path>`, as the schema owner.
+// `ir_json_path` is read like `ir::ir()` reads `HECKS_IR_PATH`, so two runs can boot two shapes.
+// Prints `{"era": <ordinal>, "label": <label>}`; a refusal exits nonzero with the error on stderr.
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let args: Vec<String> = std::env::args().collect();
+    let [_, db_name, owner_role, domain, ir_path] = args.as_slice() else {
+        anyhow::bail!("usage: mint_harness <db_name> <owner_role> <domain> <ir_json_path>");
+    };
+
+    let ir_text = std::fs::read_to_string(ir_path).map_err(|e| anyhow::anyhow!("reading {ir_path}: {e}"))?;
+    let ir: Value = serde_json::from_str(&ir_text).map_err(|e| anyhow::anyhow!("parsing {ir_path}: {e}"))?;
+
+    // A server that wants a password over TCP gets it from PGPASSWORD, as libpq would read it.
+    // Built field by field, not spliced into a connection string, so a password with a space,
+    // quote or backslash reaches the server as typed.
+    let mut config = tokio_postgres::Config::new();
+    config.host("localhost").dbname(db_name).user(owner_role);
+    if let Ok(password) = std::env::var("PGPASSWORD") {
+        config.password(password);
+    }
+    let (client, connection) = config.connect(NoTls).await?;
+    tokio::spawn(async move {
+        if let Err(err) = connection.await {
+            eprintln!("postgres connection error: {err:#}");
+        }
+    });
+
+    journal::ensure_schema(&client).await?;
+    mint::ensure_base(&client, domain).await?;
+
+    let my_hash = storage_shape::mint_hash(&ir);
+    let my_label = storage_shape::mint_label(&ir);
+
+    // Every fixture is fully lineage-capable, so the `lineage_capable_aggregates` filter is
+    // skipped.
+    let aggregates: Vec<mint::Aggregate> = ir
+        .get("aggregates")
+        .and_then(Value::as_array)
+        .cloned()
+        .unwrap_or_default()
+        .iter()
+        .map(|agg| {
+            let name = agg.get("name").and_then(Value::as_str).unwrap_or("").to_string();
+            let storage_name = journal::snake(&name);
+            mint::Aggregate { name, storage_name }
+        })
+        .collect();
+
+    let held = journal::held_eras(&client, domain).await?;
+
+    let era = match mint::decide_boot_action(&held, &my_label) {
+        mint::BootDecision::UseExisting { ordinal } => ordinal,
+        mint::BootDecision::HoldFirst => {
+            let source_text = ir.get("source_text").and_then(Value::as_str).unwrap_or("mint_harness fixture source");
+            mint::hold_first(&client, domain, source_text, &ir, &aggregates, None).await?;
+            1
+        }
+        mint::BootDecision::LatestUnnamed { ordinal } => {
+            anyhow::bail!("latest held era {ordinal} has no label -- mint_harness has no bluebook parser to name it with");
+        }
+        mint::BootDecision::Mint { ordinal, from_ordinal, from_label } => {
+            let mut labels: Vec<String> = held.iter().map(|h| h.label.clone().unwrap_or_default()).collect();
+            labels.push(my_label.clone());
+            let edges = mint::parse_edges(&ir, domain);
+            let chain = mint::edge_chain(&edges, &labels)
+                .map_err(|e| anyhow::anyhow!("drifted from era {from_ordinal} ({from_label}) to {my_label} with no covering edge -- {e}"))?;
+
+            // The same gate the host runs: a compute/rekey edge mints only on an approval, from the
+            // journal or committed in ir.json's `approvals`.
+            let raw_edges = ir.get("translations").and_then(Value::as_array).cloned().unwrap_or_default();
+            let committed_approvals = approval::committed(&ir);
+            for edge in &chain {
+                // An edge with no raw entry fails closed, as the host does, and never skips the gate.
+                let Some(raw_edge) = raw_edges.iter().find(|candidate| {
+                    candidate.get("domain").and_then(Value::as_str) == Some(domain.as_str())
+                        && candidate.get("from").and_then(Value::as_str) == Some(edge.from.as_str())
+                        && candidate.get("to").and_then(Value::as_str) == Some(edge.to.as_str())
+                }) else {
+                    anyhow::bail!("cannot boot: {domain}'s edge {} -> {} vanished between parsing and approval-checking it", edge.from, edge.to);
+                };
+                approval::check(&client, domain, raw_edge, ordinal, &committed_approvals).await?;
+            }
+            let watermarks: HashMap<i32, Option<i64>> = held.iter().map(|h| (h.ordinal, h.watermark)).collect();
+            mint::audit_before_mint(&client, domain, &ir, &aggregates, ordinal, &chain, &raw_edges, &watermarks).await?;
+
+            let held_text = ir.get("source_text").and_then(Value::as_str).unwrap_or("mint_harness fixture source");
+            mint::mint_era(&client, domain, ordinal, &my_hash, &my_label, held_text, &aggregates, &chain, None, &mint::lifecycle_defaults(&ir)).await?;
+            ordinal
+        }
+    };
+
+    println!("{}", json!({ "era": era, "label": my_label }));
+    Ok(())
+}

data/rust/host/src/checkout.rs

@@ -0,0 +1,265 @@
+//! Stripe checkout and webhook mechanics for the registration routes: HMAC
+//! signature verification, an embedded Checkout Session, and a mock session.
+
+use hmac::{Hmac, Mac};
+use serde_json::Value;
+use sha2::Sha256;
+
+type HmacSha256 = Hmac<Sha256>;
+
+// docs.stripe.com/webhooks#verify-events — 5 minutes, guards against a
+// replayed old payload even against a leaked (not yet rotated) secret.
+const TOLERANCE_SECONDS: i64 = 300;
+
+pub struct SignatureError(pub String);
+
+impl std::fmt::Display for SignatureError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+// Signs `<timestamp>.<raw body>`, the exact bytes Stripe sent -- re-serializing
+// the JSON would disagree on whitespace or key order and break every match.
+// `now` is a parameter, not read internally, so a test can hold time fixed.
+pub fn verify_signature(payload: &str, header: &str, secret: &str, now: i64) -> Result<(), SignatureError> {
+    let mut timestamp: Option<i64> = None;
+    let mut signatures: Vec<&str> = Vec::new();
+    for part in header.split(',') {
+        let Some((key, value)) = part.split_once('=') else { continue };
+        match key {
+            "t" => timestamp = value.parse().ok(),
+            "v1" => signatures.push(value),
+            _ => {}
+        }
+    }
+    let Some(timestamp) = timestamp else {
+        return Err(SignatureError("Stripe-Signature header has no t= timestamp".to_string()));
+    };
+    if signatures.is_empty() {
+        return Err(SignatureError("Stripe-Signature header has no v1= signature".to_string()));
+    }
+    if (now - timestamp).abs() > TOLERANCE_SECONDS {
+        return Err(SignatureError(format!(
+            "timestamp {timestamp} is outside the {TOLERANCE_SECONDS}s tolerance (now: {now})"
+        )));
+    }
+
+    let signed_payload = format!("{timestamp}.{payload}");
+    let mut mac = HmacSha256::new_from_slice(secret.as_bytes())
+        .map_err(|e| SignatureError(format!("webhook secret unusable as an HMAC key: {e}")))?;
+    mac.update(signed_payload.as_bytes());
+    let expected_hex = hex_encode(&mac.finalize().into_bytes());
+
+    if signatures.iter().any(|sig| constant_time_eq(sig.as_bytes(), expected_hex.as_bytes())) {
+        Ok(())
+    } else {
+        Err(SignatureError("signature does not match — wrong secret, or the payload was tampered with in transit".to_string()))
+    }
+}
+
+fn hex_encode(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+// A bare `==` short-circuits at the first differing byte, opening a timing
+// side-channel on the signature comparison, so this compares every byte.
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    a.iter().zip(b.iter()).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
+}
+
+// Encodes success_url/cancel_url as query params, matching the Ruby local
+// checkout adapter's own `URI.encode_www_form` output exactly.
+pub fn mock_checkout_session(registration_id: &str, success_url: &str, cancel_url: &str, site_url: &str) -> String {
+    let mut url = reqwest::Url::parse(&format!("{site_url}/pay/{registration_id}.html"))
+        .unwrap_or_else(|_| reqwest::Url::parse("http://invalid.invalid/").unwrap());
+    url.query_pairs_mut().append_pair("success_url", success_url).append_pair("cancel_url", cancel_url);
+    url.to_string()
+}
+
+// Embedded, not Stripe-hosted, so Stripe returns a `client_secret` instead of
+// a `url`. `ui_mode` must be `embedded_page`; Stripe rejects the older
+// `embedded` value. No success_url/cancel_url: the browser stays on the site
+// and learns of completion from Stripe.js, with the webhook settling payment.
+
+// Pinned: `embedded_page` needs this version line, not whatever the account defaults to.
+pub const STRIPE_API_VERSION: &str = "2026-04-22.dahlia";
+
+pub struct StripeAuth<'a> {
+    pub api_key: &'a str,
+    pub base_url: &'a str,
+}
+
+pub struct EmbeddedSession {
+    pub session_id: String,
+    pub client_secret: String,
+}
+
+// 31, not 30: Stripe requires an expiry at least 30 minutes out.
+pub const SESSION_HOLD_SECONDS: i64 = 31 * 60;
+
+pub fn session_expires_at(now: i64) -> i64 {
+    now + SESSION_HOLD_SECONDS
+}
+
+// Errors carry Stripe's message when it refuses, never a secret.
+pub async fn create_checkout_session(
+    auth: &StripeAuth<'_>,
+    price_cents: i64,
+    product_name: &str,
+    registration_id: &str,
+    expires_at: i64,
+) -> anyhow::Result<EmbeddedSession> {
+    let unit_amount = price_cents.to_string();
+    let expires_at = expires_at.to_string();
+    let params = [
+        ("mode", "payment"),
+        ("ui_mode", "embedded_page"),
+        ("redirect_on_completion", "never"),
+        ("expires_at", expires_at.as_str()),
+        ("line_items[0][price_data][currency]", "usd"),
+        ("line_items[0][price_data][unit_amount]", unit_amount.as_str()),
+        ("line_items[0][price_data][product_data][name]", product_name),
+        ("line_items[0][quantity]", "1"),
+        ("metadata[registration_id]", registration_id),
+    ];
+
+    let response = reqwest::Client::new()
+        .post(format!("{}/v1/checkout/sessions", auth.base_url))
+        .bearer_auth(auth.api_key)
+        .header("Stripe-Version", STRIPE_API_VERSION)
+        .form(&params)
+        .send()
+        .await?;
+
+    let status = response.status();
+    let body: Value = response.json().await?;
+    if !status.is_success() {
+        let message = body
+            .get("error")
+            .and_then(|e| e.get("message"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("unknown Stripe error");
+        anyhow::bail!("Stripe checkout session creation failed ({status}): {message}");
+    }
+
+    let text = |field: &str| body.get(field).and_then(|v| v.as_str()).map(String::from);
+    match (text("id"), text("client_secret")) {
+        (Some(session_id), Some(client_secret)) => Ok(EmbeddedSession { session_id, client_secret }),
+        // The body is left out of the message: it may carry the client secret.
+        _ => anyhow::bail!("Stripe's response carried no \"id\" and \"client_secret\" for the embedded session"),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sign(secret: &str, timestamp: i64, payload: &str) -> String {
+        let signed_payload = format!("{timestamp}.{payload}");
+        let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).unwrap();
+        mac.update(signed_payload.as_bytes());
+        hex_encode(&mac.finalize().into_bytes())
+    }
+
+    #[test]
+    fn mock_checkout_session_matches_local_checkouts_own_pay_page_shape() {
+        // The Ruby local checkout adapter's own real output, same three parts: this
+        // site's own /pay/<registration_id>.html page, with success_url
+        // and cancel_url riding along as encoded query params.
+        let url = mock_checkout_session(
+            "REG-1",
+            "https://example.com/yoga.html?registered=1",
+            "https://example.com/yoga.html?registered=0",
+            "https://example.com",
+        );
+        assert_eq!(
+            url,
+            "https://example.com/pay/REG-1.html?success_url=https%3A%2F%2Fexample.com%2Fyoga.html%3Fregistered%3D1&cancel_url=https%3A%2F%2Fexample.com%2Fyoga.html%3Fregistered%3D0"
+        );
+    }
+
+    #[test]
+    fn mock_checkout_session_carries_the_registration_id_in_its_own_path_not_a_query_param() {
+        let url = mock_checkout_session("REG-2", "https://example.com/yoga.html", "https://example.com/yoga.html", "https://example.com");
+        assert!(url.starts_with("https://example.com/pay/REG-2.html?"));
+    }
+
+    #[test]
+    fn a_correctly_signed_payload_verifies() {
+        let payload = r#"{"type":"checkout.session.completed"}"#;
+        let secret = "whsec_test";
+        let now = 1_700_000_000;
+        let header = format!("t={now},v1={}", sign(secret, now, payload));
+
+        assert!(verify_signature(payload, &header, secret, now).is_ok());
+    }
+
+    #[test]
+    fn a_payload_tampered_with_after_signing_is_rejected() {
+        let secret = "whsec_test";
+        let now = 1_700_000_000;
+        let header = format!("t={now},v1={}", sign(secret, now, r#"{"type":"checkout.session.completed"}"#));
+
+        // Same header, different body — exactly what an attacker
+        // intercepting and rewriting the request in transit would send.
+        let tampered = r#"{"type":"checkout.session.expired"}"#;
+        assert!(verify_signature(tampered, &header, secret, now).is_err());
+    }
+
+    #[test]
+    fn the_wrong_secret_is_rejected() {
+        let payload = r#"{"type":"checkout.session.completed"}"#;
+        let now = 1_700_000_000;
+        let header = format!("t={now},v1={}", sign("whsec_real", now, payload));
+
+        assert!(verify_signature(payload, &header, "whsec_wrong", now).is_err());
+    }
+
+    #[test]
+    fn a_timestamp_outside_the_tolerance_window_is_rejected_even_with_a_correct_signature() {
+        let payload = r#"{"type":"checkout.session.completed"}"#;
+        let secret = "whsec_test";
+        let signed_at = 1_700_000_000;
+        let header = format!("t={signed_at},v1={}", sign(secret, signed_at, payload));
+
+        // A replayed webhook -- the signature is genuinely correct for
+        // its own timestamp, which is exactly why the tolerance check has
+        // to be a separate, independent gate rather than folded into
+        // "does the signature verify at all."
+        let much_later = signed_at + TOLERANCE_SECONDS + 1;
+        assert!(verify_signature(payload, &header, secret, much_later).is_err());
+    }
+
+    #[test]
+    fn a_second_v1_during_a_secret_rotation_window_verifies_against_either() {
+        let payload = r#"{"type":"checkout.session.completed"}"#;
+        let old_secret = "whsec_old";
+        let new_secret = "whsec_new";
+        let now = 1_700_000_000;
+        let header = format!(
+            "t={now},v1={},v1={}",
+            sign(old_secret, now, payload),
+            sign(new_secret, now, payload)
+        );
+
+        assert!(verify_signature(payload, &header, old_secret, now).is_ok());
+        assert!(verify_signature(payload, &header, new_secret, now).is_ok());
+    }
+
+    #[test]
+    fn a_header_with_no_v1_at_all_is_rejected() {
+        let now = 1_700_000_000;
+        let header = format!("t={now}");
+        assert!(verify_signature("{}", &header, "whsec_test", now).is_err());
+    }
+
+    #[test]
+    fn a_header_with_no_timestamp_at_all_is_rejected() {
+        let header = "v1=deadbeef".to_string();
+        assert!(verify_signature("{}", &header, "whsec_test", 1_700_000_000).is_err());
+    }
+}