Fix Woo sync: exempt webhooks from CSRF and backfill on connect.

Auto-import catalog and orders after store activation, add manual order sync, and allow WooCommerce webhooks without CSRF tokens. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-07 00:15:37 +00:00
parent ec138a903f
commit e3ef23218f
9 changed files with 222 additions and 5 deletions
@@ -230,6 +230,59 @@ class WooWebTest extends TestCase
            ->assertSee('Manage connected stores');
    }

+    public function test_store_activation_dispatches_bootstrap_sync(): void
+    {
+        \Illuminate\Support\Facades\Bus::fake();
+
+        $user = User::factory()->create();
+        $store = WooStore::create([
+            'user_id' => $user->id,
+            'site_url' => 'https://shop.example.com',
+            'status' => WooStore::STATUS_PENDING,
+        ]);
+
+        $token = app(InstallTokenService::class)->issue($store)['token'];
+
+        $this->postJson('/api/v1/stores/activate', [
+            'install_token' => $token,
+            'site_url' => 'https://shop.example.com',
+        ])->assertOk();
+
+        \Illuminate\Support\Facades\Bus::assertDispatched(\App\Jobs\StoreBootstrapSync::class, fn ($job) => $job->storeId === $store->id);
+    }
+
+    public function test_webhook_accepts_post_without_csrf_token(): void
+    {
+        $user = User::factory()->create();
+        $store = WooStore::create([
+            'user_id' => $user->id,
+            'site_url' => 'https://shop.example.com',
+            'status' => WooStore::STATUS_ACTIVE,
+            'connected_at' => now(),
+        ]);
+
+        $payload = ['id' => 99, 'number' => '1099', 'status' => 'processing', 'currency' => 'GHS', 'total' => '10.00', 'billing' => ['email' => 'a@b.com'], 'line_items' => [['name' => 'Item', 'quantity' => 1, 'total' => '10.00']], 'needs_payment' => false];
+        $body = json_encode($payload, JSON_THROW_ON_ERROR);
+        $signature = base64_encode(hash_hmac('sha256', $body, (string) $store->webhook_secret, true));
+
+        $this->withMiddleware(\Illuminate\Foundation\Http\Middleware\ValidateCsrfToken::class)
+            ->call(
+                'POST',
+                route('woo.webhooks.woocommerce', $store->public_id),
+                [],
+                [],
+                [],
+                [
+                    'CONTENT_TYPE' => 'application/json',
+                    'HTTP_X_WC_WEBHOOK_SIGNATURE' => $signature,
+                    'HTTP_X_WC_WEBHOOK_TOPIC' => 'order.updated',
+                ],
+                $body,
+            )->assertOk();
+
+        $this->assertDatabaseHas('woo_orders', ['external_order_id' => 99]);
+    }
+
    public function test_merchant_can_view_products_page(): void
    {
        $user = User::factory()->create();