Webhooks module has minimal tests: delivery, signing, and challenge flows are uncovered

[nanaf6203-bit]

Webhooks module has minimal tests: delivery, signing, and challenge flows are uncovered

Labels / Complexity: testing · Medium Complexity — Medium

Problem

src/webhooks/ (4 files) registers webhooks, signs outbound payloads (webhooks.service.ts:144 uses this.sign(body, webhook.secret)), and verifies challenges, yet the only spec is webhooks.service.spec.ts — delivery failure handling and signature verification are unpinned. A regression that breaks signature verification or drops deliveries ships silently, and consumers relying on verified webhooks get neither an error nor a working payload.

Why this is architecturally hard

1. Signature logic is the test design. Tests must pin that payloads are signed deterministically and that tampered payloads fail verification — the security contract of the module.
2. Delivery is side-effectful. Delivery/retry behavior needs mocked HTTP targets; the existing spec's mocking style is the pattern to extend.

Acceptance criteria

• Tests cover signature generation and tamper detection, challenge verification, and delivery (success and failure).
• Tests run in CI via npm test.
• The PR reports the module's coverage change (npm run test:cov).

Out of scope

Changing webhook behavior or delivery policy.

Getting started

• src/webhooks/webhooks.service.ts — signing and delivery
• src/webhooks/webhooks.service.spec.ts — the existing spec to extend

Commands: npm test, npm run test:cov.

Good first files to read: src/webhooks/webhooks.service.ts, src/webhooks/webhooks.service.spec.ts.