feat: 支持 HMAC-SHA256 签名校验并优化测试用例

tests/WebhookTest.php

@@ -15,6 +15,8 @@ class WebhookTest
         $this->testInvalidTokenRejection();
         $this->testUrlTokenAllowed();
         $this->testHeaderTokenAllowed();
+        $this->testHmacSha256SignatureAllowed();
+        $this->testHubSignature256Allowed();
         $this->testNonPostMethodRejection();
         $this->testPingEventSuccess();
         $this->testIgnoredBranchSkipped();
@@ -75,6 +77,34 @@ class WebhookTest
         $this->assert($res['code'] === 200, "合法 Header Token 应返回 HTTP 200");
     }
 
+    /**
+     * 测试通过 Gitea HMAC-SHA256 签名校验
+     */
+    public function testHmacSha256SignatureAllowed()
+    {
+        $handler = new \app\common\library\WebhookHandler('test_secret_123');
+        $body = json_encode(['ref' => 'refs/heads/master']);
+        $sig = hash_hmac('sha256', $body, 'test_secret_123');
+        $server = ['REQUEST_METHOD' => 'POST', 'HTTP_X_GITEA_SIGNATURE' => $sig];
+        $res = $handler->handle($server, [], $body);
+
+        $this->assert($res['code'] === 200, "合法 HMAC-SHA256 签名应返回 HTTP 200");
+    }
+
+    /**
+     * 测试通过 GitHub/Gitea sha256= 前缀签名校验
+     */
+    public function testHubSignature256Allowed()
+    {
+        $handler = new \app\common\library\WebhookHandler('test_secret_123');
+        $body = json_encode(['ref' => 'refs/heads/master']);
+        $sig = 'sha256=' . hash_hmac('sha256', $body, 'test_secret_123');
+        $server = ['REQUEST_METHOD' => 'POST', 'HTTP_X_HUB_SIGNATURE_256' => $sig];
+        $res = $handler->handle($server, [], $body);
+
+        $this->assert($res['code'] === 200, "合法 X-Hub-Signature-256 签名应返回 HTTP 200");
+    }
+
     /**
      * 测试非 POST 请求被拒绝
      */