Feat/test valid webhook (#44)

* Test for succesful webhook * Test for failing webhook * Update dependencies * Update README * Mark INVALID_HMAC_SIGNATURE * Minor edit * Move calculateHmacSignature to utilities.js
adyen-examples · Sep 4, 2023 · 14a31e5 · 14a31e5
1 parent 5aec2d2
commit 14a31e5
Show file tree

Hide file tree

Showing 5 changed files with 106 additions and 27 deletions.
diff --git a/README.md b/README.md
@@ -12,7 +12,7 @@ It can be executed in 2 ways:
 
 * Node 17+
 * Start sample application on `localhost:8080`
-* Make sure the sample application uses English language 
+* Make sure the sample application uses English language
 
 ### Install Playwright
 
@@ -25,6 +25,19 @@ Add Playwright dependency and install the browsers.
 
 More info on Playwright [Installation](https://playwright.dev/docs/intro) page.
 
+### Env variables
+
+The webhook tests require the HMAC Key used by the application to sign the webhook payloads
+
+Create `.env` file 
+
+```properties
+# set the same key used by the application being tested
+ADYEN_HMAC_KEY = enter your HMAC key here
+
+```
+
+
 ### Run test suite
 
 Execute all tests headless (default)

diff --git a/package.json b/package.json
@@ -8,6 +8,8 @@
   "author": "",
   "license": "ISC",
   "devDependencies": {
-    "@playwright/test": "^1.37.1"
+    "@playwright/test": "^1.37.1",
+    "@adyen/api-library": "^14.0.0",
+    "dotenv": "^16.3.1"
   }
 }
diff --git a/tests/checkout/webhook-failure.spec.js b/tests/checkout/webhook-failure.spec.js
@@ -0,0 +1,42 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+
+// test webhook is rejected (invalid HMAC signature)
+test('Webhook Notification', async ({ request }) => {
+    const notifications = await request.post(`/api/webhooks/notifications`, {
+        data: {
+            "live": "false",
+            "notificationItems":[
+                {
+                    "NotificationRequestItem":{
+                        "additionalData":{
+                            "hmacSignature":"INVALID_HMAC_SIGNATURE"
+                        },
+                        "eventCode":"AUTHORISATION",
+                        "success":"true",
+                        "eventDate":"2019-06-28T18:03:50+01:00",
+                        "merchantAccountCode":"YOUR_MERCHANT_ACCOUNT",
+                        "pspReference": "7914073381342284",
+                        "merchantReference": "YOUR_REFERENCE",
+                        "amount": {
+                            "value":24999,
+                            "currency":"EUR"
+                        }
+                    }
+                }
+            ]
+        }
+    });
+
+    /// Verify notification is not accepted (invalid HMAC)
+
+    // Status code not 404 (verify webhook is found)
+    expect(notifications.status()).not.toEqual(404);
+
+    // Status code not 200 (verify webhook does not accept the notification ie HMAC invalid)
+    expect(notifications.status()).not.toEqual(200);
+
+    // Body response does not contain [accepted]
+    notifications.text()
+        .then(value => {expect(value).not.toEqual("[accepted]");} );
+});
diff --git a/tests/checkout/webhook.spec.js b/tests/checkout/webhook.spec.js
@@ -1,41 +1,45 @@
 // @ts-check
 const { test, expect } = require('@playwright/test');
+const utilities = require('../utilities');
 
+// test webhook is successfully delivered
 test('Webhook Notification', async ({ request }) => {
+
+    var notificationRequestItem = {
+        "eventCode":"AUTHORISATION",
+        "success":"true",
+        "eventDate":"2019-06-28T18:03:50+01:00",
+        "merchantAccountCode":"YOUR_MERCHANT_ACCOUNT",
+        "pspReference": "7914073381342284",
+        "merchantReference": "YOUR_REFERENCE",
+        "amount": {
+            "value":1130,
+            "currency":"EUR"
+        }
+    };
+
+    // calculate signature from payload
+    const hmacSignature = await utilities.calculateHmacSignature(notificationRequestItem);
+    // add hmacSignature to 'additionalData'
+    notificationRequestItem["additionalData"] = {"hmacSignature" : ""+hmacSignature+""}
+
+    // POST webhook
     const notifications = await request.post(`/api/webhooks/notifications`, {
         data: {
             "live": "false",
             "notificationItems":[
                 {
-                    "NotificationRequestItem":{
-                        "additionalData":{
-                            "hmacSignature":"+JWKfq4ynALK+FFzGgHnp1jSMQJMBJeb87dlph24sXw="
-                        },
-                        "eventCode":"AUTHORISATION",
-                        "success":"true",
-                        "eventDate":"2019-06-28T18:03:50+01:00",
-                        "merchantAccountCode":"YOUR_MERCHANT_ACCOUNT",
-                        "pspReference": "7914073381342284",
-                        "merchantReference": "YOUR_REFERENCE",
-                        "amount": {
-                            "value":1130,
-                            "currency":"EUR"
-                        }
-                    }
-                }
+                    "NotificationRequestItem": notificationRequestItem    
+                }           
             ]
         }
     });
 
-    /// Verify notification is not accepted (invalid HMAC)
+    // Verify status code 
+    expect(notifications.status()).toEqual(200);
 
-    // Status code not 404 (verify webhook is found)
-    expect(notifications.status()).not.toEqual(404);
-
-    // Status code not 200 (verify webhook does not accept the notification ie HMAC invalid)
-    expect(notifications.status()).not.toEqual(200);
-
-    // Body response does not contain [accepted]
+    // Verify body response 
     notifications.text()
-        .then(value => {expect(value).not.toEqual("[accepted]");} );
+        .then(value => {expect(value).toEqual("[accepted]");} );
 });
+
diff --git a/tests/utilities.js b/tests/utilities.js
@@ -1,3 +1,8 @@
+const dotenv = require('dotenv');
+const { default: HmacValidator } = require('@adyen/api-library/lib/src/utils/hmacValidator');
+
+dotenv.config();
+
 module.exports = {
     /** Card number. */
     CARD_NUMBER: '4111 1111 1111 1111',
@@ -61,5 +66,18 @@ module.exports = {
 
         // Find and fill "Name on card" field - Note: this field is not contained within an iframe
         await page.getByPlaceholder('J. Smith').fill(nameOnCard);
+    },
+
+    /** Utility function to calculate HMAC signature (using Adyen NodeJS library)
+    */
+    async calculateHmacSignature(notificationRequestItem) {
+
+        const hmacKey = process.env.ADYEN_HMAC_KEY;
+        if(!hmacKey) {
+            throw Error("HMAC_KEY is undefined")
+        }
+
+        return new HmacValidator().calculateHmac(notificationRequestItem, hmacKey);
     }
+
 };