TEST REPORT: Webhooks Done Right (for Stripe) v1.0.0

Run from a clean unzipped copy of the dist zip (fresh npm install / pip install). Started 2026-10-17 06:14:54 BST (UTC+01:00), finished 2026-10-17 06:15:02 BST (UTC+01:00) (times from date at run time). Box: Linux, Node v24.22.0, Python 3.13.5.

Result: 22/22 passed (Node 11/11 + Python 11/11). The TypeScript typecheck is clean.

Scope: the tests cover rules 1 to 5 in SKILL.md (raw body, correct secret, replay window, idempotency, status codes). Rules 6 to 9 (respond quickly, ordering, fulfilment events, API version) are guidance and are not covered by tests. Method: fixtures are signed locally. Node uses stripe-node's generateTestHeaderString; Python uses tests/signing.py, which follows Stripe's documented HMAC scheme. The real Stripe libraries (stripe-node 19.x, stripe-python 16.x) then check the signatures. No live Stripe deliveries were used.

Node: cd node && npm test

✔ valid signature -> 200 and handler runs once (29.376597ms)
✔ wrong secret -> 400, handler not called (5.751572ms)
✔ tampered body -> 400 (3.099571ms)
✔ re-serialised JSON (key order/whitespace changed) -> 400: raw body matters (2.71328ms)
✔ stale timestamp (older than 300s tolerance) -> 400 replay protection (2.944077ms)
✔ missing header -> 400 (2.419776ms)
✔ duplicate delivery of same event id is processed once (6.168041ms)
✔ concurrent duplicate deliveries are processed once (24.468871ms)
✔ handler failure -> 500, claim released, retry succeeds (3.845335ms)
✔ unhandled event type -> 200 handled:false (do not make Stripe retry) (1.949752ms)
✔ misconfigured app (express.json before router) is detected -> 500 (9.829871ms)
ℹ tests 11
ℹ pass 11
ℹ fail 0
typecheck: OK

Python: pytest -v tests

tests/test_webhook.py::test_valid_signature PASSED                       [  9%]
tests/test_webhook.py::test_wrong_secret PASSED                          [ 18%]
tests/test_webhook.py::test_tampered_body PASSED                         [ 27%]
tests/test_webhook.py::test_reserialised_json_fails PASSED               [ 36%]
tests/test_webhook.py::test_stale_timestamp PASSED                       [ 45%]
tests/test_webhook.py::test_missing_header PASSED                        [ 54%]
tests/test_webhook.py::test_duplicates_processed_once PASSED             [ 63%]
tests/test_webhook.py::test_concurrent_duplicates_processed_once PASSED  [ 72%]
tests/test_webhook.py::test_handler_failure_then_retry PASSED            [ 81%]
tests/test_webhook.py::test_unhandled_type_acknowledged PASSED           [ 90%]
tests/test_webhook.py::test_zero_tolerance_rejected PASSED               [100%]
============================== 11 passed in 0.22s ==============================

Not tested

• Live deliveries from Stripe and the Stripe CLI (both need a Stripe account).
• templates/schema.sql was not run (the tests use SQLite).
• The Dashboard steps (Workbench > Webhooks, Snapshot payload) were written from Stripe's docs, not clicked through.

Agent dry-run

This was a self-review by the builder, not an independent agent run. The description names concrete triggers, and every file the steps refer to exists.