---
id: TST-PFM-OPS-114
title: Webhook signature
kind: unit
product_area: platform
module: operations
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts
implements: []
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
estimate_basis: Scheduling estimate only; no duration is measured during this documentation pass.
isolation: 'Process-local inputs, registries and test adapters.'
evidence:
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts at
    ad3f6a6582843008ed0f5a17b131878d15829af1: existing suite body, setup, assertions and cleanup.
binding_note: This existing engineering suite is registered without claiming a complete specification scenario.
assertion_sources:
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#is verified when the
    method, URI, body, timestamp and secret are the ones it was signed with
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#is verified when the
    signature matches any of the URIs this deployment could have been called on
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#is verified at the
    far edge of the replay window, which is a request that is late and not a replay
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#names the missing
    signature header, and nothing about the body
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#names a blank
    signature header as missing rather than as a mismatch
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#names the missing
    timestamp header
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#names a timestamp
    that is not milliseconds since the epoch
  - >-
    services-platform:modules/licensing/tests/unit/hubspot/webhook-signature.spec.ts#refuses a request
    older than the replay window however well it is signed
---

# Webhook signature

## Verification Boundary

This suite exercises application licensing through its declared function or structural boundary. Its implementation is present at the pinned source revision, and this register records no execution result.

## What This Suite Proves

The checks exercise webhook signature within the file’s declared setup and assertion boundary. The structured assertion anchors distinguish these checks from the surrounding feature flows. No complete specification scenario is attributed to this suite yet.

## What It Does Not Prove

Local execution does not establish deployed infrastructure, live commercial-provider configuration or authorization-cache completion. Registration and an implemented suite do not establish a passing result.

## Real Dependencies and Test Doubles

The production logic under assertion is real. Boundary cases control the clock.

## Must Not Be Doubled

The production function, registry or builder under assertion remains real.