feat(payment): verify Razorpay checkout callbacks

packages/payment/test/adapter-contract.test.ts

@@ -3,6 +3,7 @@ import {
   exerciseGatewayContract,
   paypalGateway,
   razorpayGateway,
+  verifyRazorpayCheckoutSignature,
   sandboxGateway,
   signSandboxWebhook,
   stripeGateway,
@@ -180,6 +181,22 @@ test("shared executable contract drives Razorpay through its HTTP adapter", asyn
   expect(report).toEqual({ ok: true, issues: [] });
 });
 
+test("Razorpay checkout signatures are verified without trusting browser data", async () => {
+  const secret = "checkout-secret";
+  const orderId = "order_1";
+  const paymentId = "pay_1";
+  const signed = await signature(`${orderId}|${paymentId}`, secret);
+  expect(
+    await verifyRazorpayCheckoutSignature({ orderId, paymentId, signature: signed }, secret),
+  ).toBe(true);
+  expect(
+    await verifyRazorpayCheckoutSignature(
+      { orderId, paymentId: "pay_tampered", signature: signed },
+      secret,
+    ),
+  ).toBe(false);
+});
+
 test("shared executable contract drives PayPal through its HTTP adapter", async () => {
   globalThis.fetch = (async (value, init) => {
     const url = String(value),