feat(webhooks): webhook signature verification tests — Issue #807

[Prozaks]

Summary

Adds a comprehensive test suite for the webhook signature verification service (Issue #807).

The core service at src/services/webhooks/verification.ts was already implemented. This PR adds thorough test coverage across 8 categories.

Test coverage (44 tests)

1. HMAC-SHA256 signature generation — consistency, format ([a-f0-9]{64}), message format {timestamp}.{payload}, different inputs produce different signatures
2. Verification success paths — valid sig, key rotation (multiple active secrets), expired secrets excluded, keyId filtering
3. Verification failure paths — invalid sig, no active secrets, old timestamps, far-future timestamps, near-future within tolerance, empty/malformed signatures
4. Replay protection boundaries — timestamp well inside tolerance passes, 1s beyond tolerance fails, custom toleranceSeconds respected
5. Secret lifecycle management — create, getActiveSecretForProvider (newest), getActiveSecretsForProvider (sorted), rotate (grace period), deactivate, getAllWebhookSecrets
6. Event queue management — queue, limit, retry capping at 3, marking processed, verified on valid retry
7. Constant-time comparison — wrong length, all-zeros, one-bit flip all rejected
8. Multi-provider isolation — all 4 providers work independently, secrets don't cross-contaminate

Test results

Test Files  1 passed
     Tests  44 passed
  Duration  ~1.25s

Closes #807

[vercel]

@Prozaks is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Prozaks Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits