diff --git a/src/Http/Middleware/VerifyWebhookSignature.php b/src/Http/Middleware/VerifyWebhookSignature.php index 99190e28b..0cf3662f1 100644 --- a/src/Http/Middleware/VerifyWebhookSignature.php +++ b/src/Http/Middleware/VerifyWebhookSignature.php @@ -4,19 +4,12 @@ use Closure; use Illuminate\Contracts\Config\Repository as Config; -use Illuminate\Contracts\Foundation\Application; use Stripe\Exception\SignatureVerificationException; use Stripe\WebhookSignature; +use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; class VerifyWebhookSignature { - /** - * The application instance. - * - * @var \Illuminate\Contracts\Foundation\Application - */ - protected $app; - /** * The configuration repository instance. * @@ -27,13 +20,11 @@ class VerifyWebhookSignature /** * Create a new middleware instance. * - * @param \Illuminate\Contracts\Foundation\Application $app * @param \Illuminate\Contracts\Config\Repository $config * @return void */ - public function __construct(Application $app, Config $config) + public function __construct(Config $config) { - $this->app = $app; $this->config = $config; } @@ -43,6 +34,8 @@ public function __construct(Application $app, Config $config) * @param \Illuminate\Http\Request $request * @param \Closure $next * @return \Illuminate\Http\Response + * + * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException */ public function handle($request, Closure $next) { @@ -54,7 +47,7 @@ public function handle($request, Closure $next) $this->config->get('cashier.webhook.tolerance') ); } catch (SignatureVerificationException $exception) { - $this->app->abort(403); + throw new AccessDeniedHttpException($exception->getMessage(), $exception); } return $next($request); diff --git a/tests/Unit/VerifyWebhookSignatureTest.php b/tests/Unit/VerifyWebhookSignatureTest.php index 4344c86b2..ae2a685ff 100644 --- a/tests/Unit/VerifyWebhookSignatureTest.php +++ b/tests/Unit/VerifyWebhookSignatureTest.php @@ -9,7 +9,7 @@ use Laravel\Cashier\Http\Middleware\VerifyWebhookSignature; use Mockery as m; use PHPUnit\Framework\TestCase; -use Symfony\Component\HttpKernel\Exception\HttpException; +use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; class VerifyWebhookSignatureTest extends TestCase { @@ -23,7 +23,7 @@ public function test_response_is_received_when_secret_matches() $mock = VerifierMock::withWebhookSecret('secret') ->setSignedSignature('secret'); - $response = (new VerifyWebhookSignature($mock->app, $mock->config)) + $response = (new VerifyWebhookSignature($mock->config)) ->handle($mock->request, function ($request) { return new Response('OK'); }); @@ -34,12 +34,12 @@ public function test_response_is_received_when_secret_matches() public function test_app_aborts_when_secret_does_not_match() { $mock = VerifierMock::withWebhookSecret('secret') - ->setSignature('fail') - ->expectAbort(); + ->setSignature('fail'); - $this->expectException(HttpException::class); + $this->expectException(AccessDeniedHttpException::class); + $this->expectExceptionMessage('No signatures found matching the expected signature for payload'); - (new VerifyWebhookSignature($mock->app, $mock->config)) + (new VerifyWebhookSignature($mock->config)) ->handle($mock->request, function ($request) { }); } @@ -47,12 +47,12 @@ public function test_app_aborts_when_secret_does_not_match() public function test_app_aborts_when_no_secret_was_provided() { $mock = VerifierMock::withWebhookSecret('secret') - ->setSignedSignature('') - ->expectAbort(); + ->setSignedSignature(''); - $this->expectException(HttpException::class); + $this->expectException(AccessDeniedHttpException::class); + $this->expectExceptionMessage('No signatures found matching the expected signature for payload'); - (new VerifyWebhookSignature($mock->app, $mock->config)) + (new VerifyWebhookSignature($mock->config)) ->handle($mock->request, function ($request) { }); } @@ -60,11 +60,6 @@ public function test_app_aborts_when_no_secret_was_provided() class VerifierMock { - /** - * @var \Illuminate\Contracts\Foundation\Application - */ - public $app; - /** * @var \Illuminate\Contracts\Config\Repository */ @@ -77,7 +72,6 @@ class VerifierMock public function __construct($webhookSecret) { - $this->app = m::mock(Application::class); $this->config = m::mock(Config::class); $this->config->shouldReceive('get')->with('cashier.webhook.secret')->andReturn($webhookSecret); $this->config->shouldReceive('get')->with('cashier.webhook.tolerance')->andReturn(300); @@ -89,13 +83,6 @@ public static function withWebhookSecret($webhookSecret) return new self($webhookSecret); } - public function expectAbort() - { - $this->app->shouldReceive('abort')->andThrow(HttpException::class, 403); - - return $this; - } - public function setSignedSignature($secret) { $signature = $this->sign($this->request->getContent(), $secret);