From 73448806cc8126326affd8f5a9d88001b3a5eb33 Mon Sep 17 00:00:00 2001
From: Ryan Westfall <ryan@aimloperations.com>
Date: Fri, 31 Jul 2026 04:34:21 -0700
Subject: [PATCH] Update company_site/financial/tests.py for Stripe invoices
 (#23)

---
 company_site/financial/tests.py | 59 +++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/company_site/financial/tests.py b/company_site/financial/tests.py
index c78455d..50fb8ae 100644
--- a/company_site/financial/tests.py
+++ b/company_site/financial/tests.py
@@ -157,3 +157,62 @@ class FinancialAccessTests(TestCase):
         usernames = [e.user.username for e in employees]
         self.assertIn("employee", usernames)
         self.assertNotIn("extra", usernames)
+
+
+class InvoiceAccessTests(TestCase):
+    def setUp(self):
+        self.admin = User.objects.create_superuser(
+            username="billing_admin", password="pass", email="admin@example.com"
+        )
+        self.employee_user = User.objects.create_user(username="emp2", password="pass")
+        set_user_type(self.employee_user, UserProfile.UserType.EMPLOYEE)
+        self.client_http = Client()
+
+    def test_non_admin_cannot_view_invoices(self):
+        self.client_http.login(username="emp2", password="pass")
+        response = self.client_http.get(reverse("invoice_list"))
+        self.assertIn(response.status_code, (302, 403))
+
+    def test_admin_can_view_invoices(self):
+        self.client_http.login(username="billing_admin", password="pass")
+        response = self.client_http.get(reverse("invoice_list"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_webhook_rejects_bad_signature_when_secret_set(self):
+        from django.test import override_settings
+
+        with override_settings(STRIPE_WEBHOOK_SECRET="whsec_test"):
+            response = self.client_http.post(
+                reverse("stripe_webhook"),
+                data=b'{"type":"invoice.paid","data":{"object":{}}}',
+                content_type="application/json",
+                HTTP_STRIPE_SIGNATURE="t=1,v1=bad",
+            )
+        self.assertEqual(response.status_code, 400)
+
+    def test_apply_invoice_webhook_updates_status(self):
+        from financial.models import BillingCustomer, Invoice
+        from financial.stripe_billing import apply_stripe_invoice_event
+
+        customer = BillingCustomer.objects.create(
+            name="Acme", email="acme@example.com"
+        )
+        invoice = Invoice.objects.create(
+            customer=customer,
+            description="Work",
+            amount_cents=5000,
+            stripe_invoice_id="in_test_123",
+            status=Invoice.Status.OPEN,
+        )
+        apply_stripe_invoice_event(
+            {
+                "id": "in_test_123",
+                "status": "paid",
+                "metadata": {"local_invoice_id": str(invoice.pk)},
+                "hosted_invoice_url": "https://pay.stripe.com/test",
+            }
+        )
+        invoice.refresh_from_db()
+        self.assertEqual(invoice.status, Invoice.Status.PAID)
+        self.assertEqual(invoice.hosted_invoice_url, "https://pay.stripe.com/test")
+