[u7k4rs6]

Problem

verify_payment_link_signature builds the signed payload using attributes.values.join('|'), which makes verification depend on the insertion order of the caller's Hash.

It also includes unrelated attributes in the payload and removes :razorpay_signature from the caller's Hash while verifying.

As a result, the same valid Payment Link parameters can fail verification when supplied in a different order or alongside an unrelated field.

Fix

• Build the Payment Link signature payload from the four protocol-defined fields in the documented order.
• Ignore unrelated attributes when constructing the payload.
• Read :razorpay_signature without mutating the caller's Hash.
• Preserve the existing signature verification mechanism and behavior.

Tests

Added regression coverage for:

• Verification with permuted Hash insertion order
• Verification with an unrelated extra attribute
• Preservation of the caller's Hash during verification
• Existing invalid/tampered signature behavior

Verification

• Focused utility tests run directly with MiniTest
• Full test execution was attempted
• An existing unrelated test_generate_onboarding_signature failure remains from the current repository state
• RuboCop could not be run because the repository's pinned legacy RuboCop dependency requires native Ruby development headers
• No new dependencies or public API changes

Fixes #276

[u7k4rs6]

closing this since it hasn't been picked up, happy to reopen if it's useful