digital-avatar-app/backend/tests/test_virtual_payment_flow.py

@@ -55,7 +55,6 @@ def test_huihui_virtual_callback_requires_signature_and_exact_order_details(auth
             "status": "SUCCESS",
             "amountCents": 1000,
             "productId": "Basic",
-            "openId": "openid-huihui-callback",
             "env": 1,
         }
         path = "/api/token/payment/huihui/virtual/notify"
@@ -64,6 +63,8 @@ def test_huihui_virtual_callback_requires_signature_and_exact_order_details(auth
         assert client.post(path, content=body, headers={"X-Huihui-Timestamp": str(int(time.time())), "X-Huihui-Signature": "bad"}).status_code == 401
         wrong = json.dumps({**payload, "amountCents": 999}, separators=(",", ":")).encode()
         assert client.post(path, content=wrong, headers=_huihui_virtual_headers(secret, wrong)).status_code == 422
+        wrong_openid = json.dumps({**payload, "openId": "different-user"}, separators=(",", ":")).encode()
+        assert client.post(path, content=wrong_openid, headers=_huihui_virtual_headers(secret, wrong_openid)).status_code == 422
         first = client.post(path, content=body, headers=_huihui_virtual_headers(secret, body))
         second = client.post(path, content=body, headers=_huihui_virtual_headers(secret, body))