<?php
// ponytail: check suelto, corre con `php tests/whatsapp_signature_check.php` sin phpunit ni vendor.
// Verifica el contrato de firma que aplica WhatsappWebhookController::signatureValid().

$secret  = 'secreto-de-prueba';
$payload = '{"entry":[{"changes":[{"field":"messages"}]}]}';

$firmar = fn(string $body, string $sec) => 'sha256=' . hash_hmac('sha256', $body, $sec);

$valida = function (string $header, string $body, string $sec): bool {
    if ($sec === '' || ! str_starts_with($header, 'sha256=')) return false;
    return hash_equals(hash_hmac('sha256', $body, $sec), substr($header, 7));
};

assert($valida($firmar($payload, $secret), $payload, $secret) === true,          'firma correcta debe pasar');
assert($valida($firmar($payload, $secret), $payload . ' ', $secret) === false,   'cuerpo alterado debe fallar');
assert($valida($firmar($payload, 'otro'), $payload, $secret) === false,          'secreto distinto debe fallar');
assert($valida($firmar($payload, $secret), $payload, '') === false,              'sin secreto debe fallar cerrado');
assert($valida('', $payload, $secret) === false,                                 'sin cabecera debe fallar');
assert($valida(hash_hmac('sha256', $payload, $secret), $payload, $secret) === false, 'sin prefijo sha256= debe fallar');

echo "OK: 6 casos de firma\n";