test: cover webhook signature failures and provider resolution

README.md

@@ -36,6 +36,7 @@ To install the `MoneyMan` package, follow these steps:
     MONEYMAN_CHAPA_SECRET_KEY=
     MONEYMAN_CHAPA_BASE_URL=
     MONEYMAN_CHAPA_CALLBACK_URL=
+    MONEYMAN_CHAPA_WEBHOOK_SECRET=
 
     MONEYMAN_SANTIMPAY_BASE_URL=
     MONEYMAN_SANTIMPAY_PUBLIC_KEY=

database/migrations/2026_01_01_000000_create_webhook_events_table.php

@@ -13,15 +13,15 @@ public function up()
         Schema::create('webhook_events', function (Blueprint $table) {
             $table->uuid('id')->primary();
             $table->string('provider');
-            $table->string('is_success')->default(false);
+            $table->boolean('is_success')->default(false);
             $table->string('tx_ref')->nullable();
             $table->string('provider_ref')->nullable();
             $table->string('status');
             $table->decimal('amount');
             $table->decimal('charge')->nullable();
             $table->string('currency', 10)->default('ETB');
             $table->json('data')->nullable();
-            $table->unique(['event_type', 'tx_ref']);
+            $table->unique(['provider', 'tx_ref']);
             $table->timestamps();
         });
     }

src/Actions/WebhookHandler.php

@@ -21,7 +21,7 @@ public function handle(Request $request, string $provider): WebhookEvent
 
         $event = $driver->parse($request);
 
-        return WebhookEvent::firstOrCreate([
+        return WebhookEvent::updateOrCreate([
             'provider' => $event->provider(),
             'is_success' => $event->isSuccess(),
             'tx_ref' => $event->getReference(),

src/Models/WebhookEvent.php

@@ -14,6 +14,8 @@ class WebhookEvent extends Model
 
     protected $table = 'webhook_events';
 
+    protected $guarded = [];
+
     protected $casts = [
         'provider' => Provider::class,
         'data' => 'array',

src/MoneyManServiceProvider.php

@@ -4,7 +4,6 @@
 
 namespace Vptrading\MoneyMan;
 
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Console\AboutCommand;
 use Illuminate\Support\ServiceProvider;
 use Vptrading\MoneyMan\Contracts\WebhookRegistry;
@@ -17,7 +16,6 @@ class MoneyManServiceProvider extends ServiceProvider
 {
     public function boot(): void
     {
-        Model::unguard();
         AboutCommand::add('MoneyMan', fn () => [
             'Version' => '1.1.0',
         ]);

src/Providers/Chapa/WebhookDriver.php

@@ -12,7 +12,7 @@ class WebhookDriver implements WebhookDriverInterface
 {
     public function verify(Request $request): bool
     {
-        $secret = config('chapa.webhook_secret');
+        $secret = config('moneyman.providers.chapa.webhook_secret');
 
         $hash = hash_hmac('sha256', $request->getContent(), $secret);
 

src/Providers/Telebirr/Telebirr.php

@@ -63,7 +63,7 @@ public function verify(string $transactionId): PaymentVerifyResponse
             'biz_content' => [
                 'appid' => config('moneyman.providers.telebirr.merchant_app_id'),
                 'merch_code' => config('moneyman.providers.telebirr.short_code'),
-                'merch_order_id' => 'glRDRSe9U6',
+                'merch_order_id' => $transactionId,
             ],
         ];
 

src/Providers/Telebirr/WebhookEvent.php

@@ -21,7 +21,7 @@ public function provider(): string
 
     public function isSuccess(): bool
     {
-        if ($this->payload['trans_currency'] !== 'Completed') {
+        if ($this->payload['trade_status'] !== 'Completed') {
             return false;
         }
 

tests/Feature/Http/Controllers/WebhookControllerTest.php

@@ -3,10 +3,11 @@
 declare(strict_types=1);
 
 use Firebase\JWT\JWT;
+use Vptrading\MoneyMan\Exceptions\InvalidSignatureException;
 
 it('stores chapa webhook events', function (): void {
     $this->withoutExceptionHandling();
-    config()->set('chapa.webhook_secret', 'test_secret');
+    config()->set('moneyman.providers.chapa.webhook_secret', 'test_secret');
     $payload = [
         'event' => 'charge.success',
         'first_name' => 'John',
@@ -129,3 +130,44 @@
         'currency' => 'ETB',
     ]);
 });
+
+it('rejects chapa webhook events with invalid signature', function (): void {
+    $this->withoutExceptionHandling();
+    config()->set('chapa.webhook_secret', 'test_secret');
+
+    $payload = [
+        'event' => 'charge.success',
+        'tx_ref' => 'TX-INVALID',
+        'reference' => 'REF-INVALID',
+        'amount' => '100.00',
+        'charge' => '3.00',
+        'currency' => 'ETB',
+        'status' => 'success',
+    ];
+
+    expect(fn () => $this->postJson(route('moneyman.webhook', [
+        'provider' => 'chapa',
+    ]), $payload, ['x-chapa-signature' => 'bad-signature']))
+        ->toThrow(InvalidSignatureException::class);
+
+    $this->assertDatabaseCount('webhook_events', 0);
+});
+
+it('rejects santimpay webhook events with invalid signature', function (): void {
+    $this->withoutExceptionHandling();
+
+    $payload = [
+        'txnId' => 'txn-invalid',
+        'refId' => 'ref-invalid',
+        'amount' => '1',
+        'currency' => 'ETB',
+        'status' => 'COMPLETED',
+    ];
+
+    expect(fn () => $this->postJson(route('moneyman.webhook', [
+        'provider' => 'santimpay',
+    ]), $payload, ['signed-token' => 'bad-signature']))
+        ->toThrow(InvalidSignatureException::class);
+
+    $this->assertDatabaseCount('webhook_events', 0);
+});

tests/Unit/MoneyManManagerTest.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+use Vptrading\MoneyMan\Enums\Provider as ProviderEnum;
+use Vptrading\MoneyMan\MoneyMan;
+use Vptrading\MoneyMan\Providers\Chapa\Chapa;
+use Vptrading\MoneyMan\Providers\SantimPay\SantimPay;
+use Vptrading\MoneyMan\Providers\Telebirr\Telebirr;
+
+it('resolves providers from enum', function (): void {
+    expect(MoneyMan::provider(ProviderEnum::Chapa))->toBeInstanceOf(Chapa::class);
+    expect(MoneyMan::provider(ProviderEnum::SantimPay))->toBeInstanceOf(SantimPay::class);
+    expect(MoneyMan::provider(ProviderEnum::Telebirr))->toBeInstanceOf(Telebirr::class);
+});
+
+it('throws for unsupported provider', function (): void {
+    expect(fn () => MoneyMan::provider('unsupported'))
+        ->toThrow(InvalidArgumentException::class);
+});