<?php
namespace Tests\Feature;
use App\Application\Services\ApiCredentialService;
use App\Models\Merchant;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Cache;
use Tests\TestCase;
final class ApiSignatureTest extends TestCase { use RefreshDatabase; public function test_rejects_replayed_nonce():void { config(['gateway.environment'=>'sandbox']);$m=Merchant::factory()->create();$issued=app(ApiCredentialService::class)->issue($m,'sandbox',['payments:read']);$timestamp=(string)now()->timestamp;$nonce='nonce-1';$path='/api/v1/payments';$canonical="GET\n{$path}\n{$timestamp}\n{$nonce}\n".hash('sha256','');$sig=hash_hmac('sha256',$canonical,$issued['secret']);$headers=['x-api-key'=>$issued['public_key'],'x-api-timestamp'=>$timestamp,'x-api-nonce'=>$nonce,'x-api-signature'=>$sig];$this->getJson($path,$headers);$this->getJson($path,$headers)->assertStatus(401)->assertJsonPath('error.code','REPLAY_DETECTED'); } }
