chore(v2): P3 终审收尾——GetReserved 移 export_test / BuildRegistry 表测试 / 坏签名负路径 / 注释更正

internal/provider/stripe/stripe_test.go

@@ -101,6 +101,28 @@ func TestVerifyWebhook(t *testing.T) {
 	}
 }
 
+// 用错误的签名密钥(冒充攻击者伪造 webhook)→ ConstructEventWithOptions 内部 HMAC 校验
+// 必失败,VerifyCallback 必须返回 error,绝不能返回 PaidEvent(哪怕 payload 里状态是 paid)。
+func TestVerifyWebhookWrongSecretFails(t *testing.T) {
+	ts := fakeStripeAPI(t)
+	defer ts.Close()
+	p := newStripe(t, ts)
+
+	payload := `{"id":"evt_evil","object":"event","type":"checkout.session.completed","data":{"object":{"id":"cs_test_123","object":"checkout.session","amount_total":2999,"currency":"usd","payment_status":"paid"}}}`
+	sig := signStripe(payload, "whsec_completely_different_secret", time.Now().Unix())
+
+	ev, err := p.VerifyCallback(context.Background(), provider.CallbackInput{
+		Raw:     []byte(payload),
+		Headers: map[string]string{"Stripe-Signature": sig},
+	})
+	if err == nil {
+		t.Fatalf("want 验签失败(签名密钥不匹配), got event = %+v", ev)
+	}
+	if ev != nil {
+		t.Fatalf("验签失败时不应返回 PaidEvent, got %+v", ev)
+	}
+}
+
 // signStripe 复刻 Stripe webhook 签名头: t=<ts>,v1=hex(HMAC-SHA256(secret, "<ts>.<payload>"))
 func signStripe(payload, secret string, ts int64) string {
 	mac := hmac.New(sha256.New, []byte(secret))