@owlmeans/server-payment 0.1.18-rc.2 → 0.1.18-rc.21

package/tests/usage.integration.spec.ts

@@ -0,0 +1,101 @@
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { LimitExhausted, SubscriptionStatus } from '@owlmeans/payment'
+import { createEventHandler } from '../src/plugins/events.js'
+import { ensureWebhookEndpoint } from '../src/plugins/webhook-manager.js'
+import {
+  entitlements, fulfillments, gateway, paymentWebhooks, subscriptions, usageCounters, usageEvents,
+} from '../src/utils.js'
+import { BURST_PLAN, gate, makeSuite } from './context.js'
+import type { Booted } from './context.js'
+import { CREDITS_PRODUCT, eventOf, makeFakeStripe, PRO, subscriptionOf, TEAM } from './fake-stripe.js'
+
+const suite = makeSuite('payusage')
+const it = gate.skip ? test.skip : test
+
+describe('@owlmeans/server-payment — usage ledger on Mongo', () => {
+  if (gate.skip) {
+    test.skip(gate.reason ?? 'mongo gate closed', () => {})
+    return
+  }
+
+  let booted: Booted
+  beforeAll(async () => { booted = await suite.boot() }, 60_000)
+  afterAll(async () => { await suite.teardown() }, 60_000)
+
+  it('admits exactly the limit out of 20 concurrent consumes', async () => {
+    const { ctx } = booted
+    await gateway(ctx).grantInternalPlan(ctx, 'burst-1', BURST_PLAN, { force: true })
+    const results = await Promise.allSettled(Array.from({ length: 20 }, async (_, index) =>
+      await entitlements(ctx).consume({ entityId: 'burst-1', limitKey: 'burst', eventKey: `burst:${index}` })))
+
+    expect(results.filter(result => result.status === 'fulfilled')).toHaveLength(5)
+    const refused = results.filter((result): result is PromiseRejectedResult => result.status === 'rejected')
+    expect(refused).toHaveLength(15)
+    expect(refused.every(result => result.reason instanceof LimitExhausted)).toBe(true)
+    expect(await usageEvents(ctx).count({ entityId: 'burst-1', limitKey: 'burst' })).toBe(5)
+    expect((await usageCounters(ctx).load({ entityId: 'burst-1', limitKey: 'burst' }))?.used).toBe(5)
+  }, 60_000)
+
+  it('admits a concurrently repeated event key once', async () => {
+    const { ctx } = booted
+    await gateway(ctx).grantInternalPlan(ctx, 'dup-1', TEAM, { force: true })
+    const outcomes = await Promise.all(Array.from({ length: 10 }, async () =>
+      await entitlements(ctx).consume({ entityId: 'dup-1', limitKey: 'exports', eventKey: 'export:same', ref: 'same' })))
+
+    expect(outcomes.every(outcome => outcome.admitted)).toBe(true)
+    expect(outcomes.filter(outcome => !outcome.replayed)).toHaveLength(1)
+    expect(await usageEvents(ctx).count({ entityId: 'dup-1', limitKey: 'exports' })).toBe(1)
+    expect((await usageCounters(ctx).load({ entityId: 'dup-1', limitKey: 'exports' }))?.used).toBe(1)
+    expect((await entitlements(ctx).consumptionByRef('dup-1', 'exports', 'same'))?.eventKey).toBe('export:same')
+  }, 60_000)
+
+  it('recomputes counters to the ledger sum and reconciles occupancy', async () => {
+    const { ctx } = booted
+    await gateway(ctx).grantInternalPlan(ctx, 'rec-1', PRO, { force: true })
+    const service = entitlements(ctx)
+    for (const key of ['a', 'b', 'c']) {
+      await service.consume({ entityId: 'rec-1', limitKey: 'reports', eventKey: `report:${key}` })
+    }
+    await service.release({ entityId: 'rec-1', limitKey: 'reports', eventKey: 'report:b' })
+    await usageCounters(ctx).collection.updateOne({ entityId: 'rec-1', limitKey: 'reports' }, { $set: { used: 7 } })
+
+    const result = await service.reconcileCounters('rec-1')
+    expect(result.repaired).toBeGreaterThanOrEqual(1)
+    const { items } = await usageEvents(ctx).list({ entityId: 'rec-1', limitKey: 'reports' }, { size: 0 })
+    const sum = items.reduce((total, event) => total + event.delta, 0)
+    expect(sum).toBe(2)
+    expect((await usageCounters(ctx).load({ entityId: 'rec-1', limitKey: 'reports' }))?.used).toBe(sum)
+
+    const over = await service.reconcileOccupancy('rec-1', 'seats', 4)
+    expect(over.overSince).toBeInstanceOf(Date)
+    const within = await service.reconcileOccupancy('rec-1', 'seats', 2)
+    expect(within).toEqual({ limitKey: 'seats', used: 2, limit: 2, over: 0 })
+    expect((await usageCounters(ctx).load({ entityId: 'rec-1', limitKey: 'seats' }))?.overSince ?? null).toBeNull()
+    expect(await usageEvents(ctx).count({ entityId: 'rec-1', limitKey: 'seats' })).toBe(1)
+  }, 60_000)
+
+  it('stores subscriptions, fulfillments and webhook endpoints through their collection validators', async () => {
+    const { ctx } = booted
+    const { stripe } = makeFakeStripe()
+    const handler = createEventHandler(ctx, stripe)
+    await handler.process(eventOf('customer.subscription.updated', subscriptionOf({ entityId: 'sub-1' })))
+    await handler.process(eventOf('customer.subscription.updated', subscriptionOf({ entityId: 'sub-1', cancelAtPeriodEnd: true })))
+    await handler.process(eventOf('checkout.session.completed', {
+      id: 'cs_int', mode: 'payment', payment_status: 'paid', customer: 'cus_1', currency: 'usd', amount_subtotal: 1021,
+      payment_intent: 'pi_int',
+      metadata: {
+        pricingMode: 'amount', amountMinor: '1000', chargeAmountMinor: '1021', currency: 'usd',
+        entityId: 'sub-1', service: 'app', productSku: CREDITS_PRODUCT,
+      },
+    }))
+    await ensureWebhookEndpoint(ctx, stripe)
+
+    const row = await subscriptions(ctx).byExternalId('sub_1', 'stripe')
+    expect(row).toEqual(expect.objectContaining({ status: SubscriptionStatus.Active, cancelAtPeriodEnd: true, rank: 10 }))
+    expect(row?.propagated?.cancelAtPeriodEnd).toBe(true)
+    expect(row?.createdAt).toBeInstanceOf(Date)
+    expect((await entitlements(ctx).entitlements('sub-1')).plan.sku).toBe(PRO)
+    expect((await fulfillments(ctx).byExternalId('cs_int', 'stripe'))?.fulfilledAt).toBeInstanceOf(Date)
+    expect((await paymentWebhooks(ctx).load({ service: 'app' }))?.secret).toStartWith('whsec_')
+  }, 60_000)
+})

package/tests/usage.spec.ts

@@ -0,0 +1,171 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  LimitExhausted, LimitKind, LimitMisdeclared, LimitUnknown, LimitWindow, windowBoundsOf, windowKeyOf,
+} from '@owlmeans/payment'
+import { UnsupportedArgumentError } from '@owlmeans/resource'
+import { entitlements, gateway } from '../src/utils.js'
+import { makeFakeContext, past, PRO } from './fake-stripe.js'
+import type { FakeContext } from './fake-stripe.js'
+
+const ledger = (fake: FakeContext) => fake.stores['payment-usage'].rows
+const counters = (fake: FakeContext) => fake.stores['payment-usage-counter'].rows
+
+const pro = async (fake: FakeContext, entityId = 'entity-1'): Promise<void> => {
+  await gateway(fake.ctx).grantInternalPlan(fake.ctx, entityId, PRO, { force: true })
+}
+
+describe('@owlmeans/server-payment — consume', () => {
+  test('admits up to the ceiling, then refuses without writing an event', async () => {
+    const fake = await makeFakeContext()
+    const service = entitlements(fake.ctx)
+    const first = await service.consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'export:a', ref: 'a' })
+    expect(first).toEqual(expect.objectContaining({
+      admitted: true, replayed: false, used: 1, limit: 1, remaining: 0,
+      window: windowKeyOf(LimitKind.Window, LimitWindow.Month),
+    }))
+
+    const refusal = await service.consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'export:b' })
+      .catch(error => error)
+    expect(refusal).toBeInstanceOf(LimitExhausted)
+    expect(refusal).toEqual(expect.objectContaining({
+      limitKey: 'exports', used: 1, limit: 1, resetsAt: windowBoundsOf(LimitWindow.Month).resetsAt,
+    }))
+    expect(ledger(fake)).toHaveLength(1)
+    expect(counters(fake)[0].used).toBe(1)
+  })
+
+  test('replays an event key — at the ceiling too — without counting it twice', async () => {
+    const fake = await makeFakeContext()
+    const service = entitlements(fake.ctx)
+    await service.consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'export:a' })
+    const replay = await service.consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'export:a' })
+
+    expect(replay).toEqual(expect.objectContaining({ admitted: true, replayed: true, used: 1 }))
+    expect(ledger(fake)).toHaveLength(1)
+    expect(counters(fake)[0].used).toBe(1)
+    expect(await service.consumption('entity-1', 'exports', 'export:a')).toEqual(expect.objectContaining({ delta: 1 }))
+    expect(await service.consumption('entity-1', 'exports', 'export:unknown')).toBeNull()
+  })
+
+  test('a lapsed promo refuses; a grandfathered subscription keeps the allowance', async () => {
+    const fake = await makeFakeContext({ catalogue: { reportsUntil: past(1) } })
+    await pro(fake, 'late')
+    await expect(entitlements(fake.ctx).consume({ entityId: 'late', limitKey: 'reports', eventKey: 'r:1' }))
+      .rejects.toBeInstanceOf(LimitExhausted)
+
+    await pro(fake, 'early')
+    const row = fake.stores['payment-subscription'].rows.find(item => item.entityId === 'early')!
+    row.createdAt = past(5)
+    expect((await entitlements(fake.ctx).consume({ entityId: 'early', limitKey: 'reports', eventKey: 'r:1' })).limit).toBe(4)
+  })
+
+  test('an undeclared key is LimitUnknown; a non-positive amount is refused', async () => {
+    const fake = await makeFakeContext()
+    await expect(entitlements(fake.ctx).consume({ entityId: 'entity-1', limitKey: 'nope', eventKey: 'n:1' }))
+      .rejects.toBeInstanceOf(LimitUnknown)
+    await expect(entitlements(fake.ctx).consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'n:1', amount: 0 }))
+      .rejects.toBeInstanceOf(UnsupportedArgumentError)
+  })
+})
+
+describe('@owlmeans/server-payment — release', () => {
+  test('frees the unit once; a second release replays; the consumption is gone', async () => {
+    const fake = await makeFakeContext()
+    await pro(fake)
+    const service = entitlements(fake.ctx)
+    await service.consume({ entityId: 'entity-1', limitKey: 'reports', eventKey: 'report:1', ref: '1' })
+
+    expect(await service.release({ entityId: 'entity-1', limitKey: 'reports', eventKey: 'report:1' }))
+      .toEqual(expect.objectContaining({ admitted: true, replayed: false, used: 0 }))
+    expect(await service.release({ entityId: 'entity-1', limitKey: 'reports', eventKey: 'report:1' }))
+      .toEqual(expect.objectContaining({ admitted: true, replayed: true, used: 0 }))
+    expect(ledger(fake).map(event => event.delta)).toEqual([1, -1])
+    expect(await service.consumption('entity-1', 'reports', 'report:1')).toBeNull()
+    expect(await service.release({ entityId: 'entity-1', limitKey: 'reports', eventKey: 'report:never' }))
+      .toEqual(expect.objectContaining({ admitted: false, replayed: false }))
+  })
+
+  test('consumptionByRef finds the unit a record holds under a fresh key per cycle', async () => {
+    const fake = await makeFakeContext()
+    await pro(fake)
+    const service = entitlements(fake.ctx)
+    expect(await service.consumptionByRef('entity-1', 'seats', 'record-1')).toBeNull()
+
+    await service.consume({ entityId: 'entity-1', limitKey: 'seats', eventKey: 'seats:record-1:1', ref: 'record-1' })
+    expect(await service.consumptionByRef('entity-1', 'seats', 'record-1'))
+      .toEqual(expect.objectContaining({ eventKey: 'seats:record-1:1', delta: 1 }))
+
+    await Bun.sleep(3)
+    await service.consume({ entityId: 'entity-1', limitKey: 'seats', eventKey: 'seats:record-1:2', ref: 'record-1' })
+    expect((await service.consumptionByRef('entity-1', 'seats', 'record-1'))?.eventKey).toBe('seats:record-1:2')
+    expect(await service.consumptionByRef('entity-1', 'seats', 'record-2')).toBeNull()
+
+    await service.release({ entityId: 'entity-1', limitKey: 'seats', eventKey: 'seats:record-1:2' })
+    expect((await service.consumptionByRef('entity-1', 'seats', 'record-1'))?.eventKey).toBe('seats:record-1:1')
+    await service.release({ entityId: 'entity-1', limitKey: 'seats', eventKey: 'seats:record-1:1' })
+    expect(await service.consumptionByRef('entity-1', 'seats', 'record-1')).toBeNull()
+  })
+
+  test('never takes a counter below zero', async () => {
+    const fake = await makeFakeContext()
+    await pro(fake)
+    const service = entitlements(fake.ctx)
+    await service.consume({ entityId: 'entity-1', limitKey: 'reports', eventKey: 'report:1' })
+    counters(fake)[0].used = 0
+
+    expect((await service.release({ entityId: 'entity-1', limitKey: 'reports', eventKey: 'report:1' })).used).toBe(0)
+    expect(counters(fake)[0].used).toBe(0)
+  })
+})
+
+describe('@owlmeans/server-payment — reconciliation', () => {
+  test('reconcileCounters repairs drift from the ledger, drops empty past windows and creates the current one', async () => {
+    const fake = await makeFakeContext()
+    await pro(fake)
+    const service = entitlements(fake.ctx)
+    await service.consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'export:1' })
+    await service.consume({ entityId: 'entity-1', limitKey: 'exports', eventKey: 'export:2' })
+    counters(fake)[0].used = 3
+    counters(fake).push({ entityId: 'entity-1', limitKey: 'exports', window: '2001-01-01', used: 2, limit: 3, updatedAt: past(9000) })
+    counters(fake).push({ entityId: 'entity-1', limitKey: 'reports', window: 'lifetime', used: 2, limit: 4, updatedAt: past(1) })
+
+    const result = await service.reconcileCounters('entity-1')
+    expect(result.repaired).toBe(2)
+    const today = windowKeyOf(LimitKind.Window, LimitWindow.Day)
+    expect(counters(fake).find(counter => counter.window === today)?.used).toBe(2)
+    expect(counters(fake).some(counter => counter.window === '2001-01-01')).toBe(false)
+    expect(counters(fake).find(counter => counter.window === 'lifetime')?.used).toBe(0)
+
+    const fresh = await makeFakeContext()
+    await entitlements(fresh.ctx).reconcileCounters('entity-9')
+    expect(counters(fresh)).toEqual([expect.objectContaining({
+      entityId: 'entity-9', limitKey: 'exports', window: windowKeyOf(LimitKind.Window, LimitWindow.Month), used: 0,
+    })])
+  })
+
+  test('reconcileOccupancy writes one adjusting event a day and flags an entity over its limit', async () => {
+    const fake = await makeFakeContext()
+    await pro(fake)
+    const service = entitlements(fake.ctx)
+    await service.consume({ entityId: 'entity-1', limitKey: 'seats', eventKey: 'seat:1' })
+
+    const over = await service.reconcileOccupancy('entity-1', 'seats', 3)
+    expect(over).toEqual(expect.objectContaining({ used: 3, limit: 2, over: 1 }))
+    expect(over.overSince).toBeInstanceOf(Date)
+    const again = await service.reconcileOccupancy('entity-1', 'seats', 3)
+    expect(again.overSince?.getTime()).toBe(over.overSince?.getTime())
+
+    const within = await service.reconcileOccupancy('entity-1', 'seats', 1)
+    expect(within).toEqual({ limitKey: 'seats', used: 1, limit: 2, over: 0 })
+    const adjustments = ledger(fake).filter(event => event.eventKey.startsWith('reconcile:seats:'))
+    expect(adjustments).toHaveLength(1)
+    expect(ledger(fake).reduce((sum, event) => sum + event.delta, 0)).toBe(1)
+    expect(counters(fake).find(counter => counter.limitKey === 'seats')?.overSince).toBeUndefined()
+  })
+
+  test('reconcileOccupancy refuses a limit that is not an occupancy', async () => {
+    const fake = await makeFakeContext()
+    await expect(entitlements(fake.ctx).reconcileOccupancy('entity-1', 'exports', 1))
+      .rejects.toBeInstanceOf(LimitMisdeclared)
+  })
+})

package/tests/webhook-manager.spec.ts

@@ -0,0 +1,152 @@
+import { describe, expect, test } from 'bun:test'
+import { WebhookSetupError } from '@owlmeans/payment'
+import { STRIPE_SIGNATURE, WEBHOOK_EVENTS } from '../src/consts.js'
+import { handleStripeWebhook } from '../src/plugins/stripe.js'
+import {
+  ensureWebhookEndpoint, stripeWebhookSecret, webhookUrlOf,
+} from '../src/plugins/webhook-manager.js'
+import { HOST, makeFakeContext, SDK_API_VERSION, SERVICE } from './fake-stripe.js'
+
+const URL = 'https://api.example.com/payment-gate/webhook/stripe'
+const ours = { owlmeans: 'payment', service: SERVICE }
+
+describe('@owlmeans/server-payment — webhook endpoint management', () => {
+  test('skips a URL Stripe cannot deliver to without calling Stripe', async () => {
+    for (const host of ['localhost', '127.0.0.1', 'api', 'payments.local']) {
+      const fake = await makeFakeContext({ host })
+      expect(await ensureWebhookEndpoint(fake.ctx, fake.stripe)).toBeNull()
+      expect(fake.state.calls).toEqual([])
+    }
+    const plain = await makeFakeContext()
+    ;(plain.ctx.cfg as { security?: { unsecure?: boolean } }).security = { unsecure: true }
+    expect(await ensureWebhookEndpoint(plain.ctx, plain.stripe)).toBeNull()
+    expect(plain.state.calls).toEqual([])
+  })
+
+  test('creates the endpoint on the client API version, persists its secret, makes no call while nothing changed, and a forced run recreates it once deleted from outside', async () => {
+    const fake = await makeFakeContext()
+    expect(webhookUrlOf(fake.ctx)).toBe(URL)
+
+    const row = await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    expect(fake.state.calls).toEqual(['webhookEndpoints.list', 'webhookEndpoints.create'])
+    const [endpoint] = fake.state.webhookEndpoints
+    expect(endpoint).toEqual(expect.objectContaining({
+      url: URL, api_version: SDK_API_VERSION, enabled_events: [...WEBHOOK_EVENTS].sort(), metadata: ours,
+      description: `owlmeans:${SERVICE}`,
+    }))
+    expect(row).toEqual(expect.objectContaining({
+      externalId: endpoint.id, secret: endpoint.secret, apiVersion: SDK_API_VERSION, url: URL,
+    }))
+
+    fake.state.calls.length = 0
+    await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    expect(fake.state.calls).toEqual([])
+
+    fake.state.webhookEndpoints = []
+    await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    expect(fake.state.calls).toEqual([])
+
+    const healed = await ensureWebhookEndpoint(fake.ctx, fake.stripe, { force: true })
+    expect(fake.state.calls).toEqual(['webhookEndpoints.retrieve', 'webhookEndpoints.list', 'webhookEndpoints.create'])
+    const [recreated] = fake.state.webhookEndpoints
+    expect(recreated).toEqual(expect.objectContaining({ id: healed?.externalId, url: URL, metadata: ours }))
+    expect(fake.stores['payment-webhook'].rows).toEqual([
+      expect.objectContaining({ url: URL, externalId: recreated.id, secret: recreated.secret }),
+    ])
+  })
+
+  test('updates changed events in place, and recreates the endpoint for a new API version', async () => {
+    const fake = await makeFakeContext()
+    await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    const stored = fake.stores['payment-webhook'].rows[0]
+    const firstSecret = stored.secret
+    stored.hash = 'events-of-an-older-release'
+    fake.state.calls.length = 0
+
+    await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    expect(fake.state.calls).toEqual(['webhookEndpoints.update'])
+    expect(fake.stores['payment-webhook'].rows[0].secret).toBe(firstSecret)
+
+    fake.state.apiVersion = '2099-01-01.future'
+    fake.state.calls.length = 0
+    await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    expect(fake.state.calls).toEqual(['webhookEndpoints.del', 'webhookEndpoints.list', 'webhookEndpoints.create'])
+    expect(fake.state.webhookEndpoints).toHaveLength(1)
+    expect(fake.state.webhookEndpoints[0].api_version).toBe('2099-01-01.future')
+    expect(fake.stores['payment-webhook'].rows).toHaveLength(1)
+    expect(fake.stores['payment-webhook'].rows[0].secret).not.toBe(firstSecret)
+  })
+
+  test('leaves another deployment\'s endpoint in a shared account alone, and replaces an untracked one at its own URL', async () => {
+    const STAGE_URL = 'https://stage.example.com/payment-gate/webhook/stripe'
+    const STAGING_URL = 'https://staging.example.com/payment-gate/webhook/stripe'
+    const stage = await makeFakeContext({
+      host: 'stage.example.com',
+      stripe: {
+        webhookEndpoints: [{ id: 'we_manual', url: STAGING_URL, metadata: {}, enabled_events: ['*'], secret: 'whsec_manual' }],
+      },
+    })
+    const staging = await makeFakeContext({ host: 'staging.example.com' })
+
+    const stageRow = await ensureWebhookEndpoint(stage.ctx, stage.stripe)
+    const stagingRow = await ensureWebhookEndpoint(staging.ctx, stage.stripe)
+    expect(stage.state.webhookEndpoints.map(({ id, url, metadata }) => ({ id, url, metadata }))).toEqual([
+      { id: stageRow?.externalId, url: STAGE_URL, metadata: ours },
+      { id: stagingRow?.externalId, url: STAGING_URL, metadata: ours },
+    ])
+
+    stage.state.calls.length = 0
+    expect(await ensureWebhookEndpoint(stage.ctx, stage.stripe, { force: true }))
+      .toEqual(expect.objectContaining({ externalId: stageRow?.externalId, secret: stageRow?.secret }))
+    expect(stage.state.calls).toEqual(['webhookEndpoints.retrieve', 'webhookEndpoints.update'])
+  })
+
+  test('after a URL change, drops the endpoints its own former rows name and removes those rows', async () => {
+    const fake = await makeFakeContext({ host: 'old.example.com' })
+    const former = await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    fake.stores['payment-webhook'].rows.push({
+      id: 'older-row', paygate: 'stripe', service: SERVICE, url: 'https://older.example.com/payment-gate/webhook/stripe',
+      externalId: 'we_gone', secret: 'whsec_gone', apiVersion: SDK_API_VERSION, events: [], hash: 'x', createdAt: new Date(),
+    })
+    ;(fake.ctx.cfg.services?.[SERVICE] as { host: string }).host = HOST
+    fake.state.calls.length = 0
+
+    const moved = await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    expect(moved).toEqual(expect.objectContaining({ url: URL }))
+    expect(fake.state.calls).toEqual([
+      'webhookEndpoints.list', 'webhookEndpoints.create', 'webhookEndpoints.del', 'webhookEndpoints.del',
+    ])
+    expect(fake.state.webhookEndpoints.map(endpoint => endpoint.id)).toEqual([moved?.externalId])
+    expect(moved?.externalId).not.toBe(former?.externalId)
+    expect(fake.stores['payment-webhook'].rows).toEqual([expect.objectContaining({ url: URL, externalId: moved?.externalId })])
+  })
+})
+
+describe('@owlmeans/server-payment — webhook secret', () => {
+  test('resolves the configured secret first, then the stored one, else fails setup', async () => {
+    const bare = await makeFakeContext()
+    await expect(stripeWebhookSecret(bare.ctx)).rejects.toBeInstanceOf(WebhookSetupError)
+
+    await ensureWebhookEndpoint(bare.ctx, bare.stripe)
+    expect(await stripeWebhookSecret(bare.ctx)).toBe(bare.state.webhookEndpoints[0].secret)
+
+    const configured = await makeFakeContext({ webhookSecret: 'whsec_file' })
+    await ensureWebhookEndpoint(configured.ctx, configured.stripe)
+    expect(await stripeWebhookSecret(configured.ctx)).toBe('whsec_file')
+  })
+
+  test('verifies a delivery with either secret, and refuses a signature neither verifies', async () => {
+    const fake = await makeFakeContext({ webhookSecret: 'whsec_file' })
+    await ensureWebhookEndpoint(fake.ctx, fake.stripe)
+    const stored = fake.state.webhookEndpoints[0].secret
+    const body = JSON.stringify({ id: 'evt_1', type: 'customer.created', data: { object: { id: 'cus_9', metadata: { entityId: 'e9' } } } })
+    const deliver = async (signature: string) => await handleStripeWebhook(fake.ctx, fake.stripe, {
+      rawBody: body, headers: { [STRIPE_SIGNATURE.toLowerCase()]: signature },
+    })
+
+    await deliver(`sig:${stored}`)
+    await deliver('sig:whsec_file')
+    expect(fake.stores['payment-paygate-customer'].rows).toHaveLength(1)
+    await expect(deliver('sig:whsec_forged')).rejects.toThrow('signature')
+  })
+})