Add invoice creation, quoting, and webhook signature verification

Finishes the two gaps that mattered most for real use: Invoices#create
(POST invoices) + Invoices#quote (POST invoices/{id}/quote, returning
the new Quote model with the actual payable bolt11 — an invoice alone
has nothing payable until quoted) and Webhook.valid_signature?
(HMAC-SHA256 over the raw body via X-Webhook-Signature, per Strike's own
documented reference implementation, timing-safe compare). Also finishes
Invoices#find (was a stub with a leftover binding.pry) and adds
WebhookEvent to parse the {id, eventType, data: {entityId, changes}}
payload shape — deliberately doesn't expose changed values, since
Strike's webhooks never carry them; a real value only ever comes from
re-fetching the resource.

Client gains #post/#patch (only #get existed before), needed for both
of the above.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa

lib/strike_me/api/client.rb

@@ -26,6 +26,14 @@ module StrikeMe
       def get(...)
         @last_response = connection.get(...)
       end
+
+      def post(...)
+        @last_response = connection.post(...)
+      end
+
+      def patch(...)
+        @last_response = connection.patch(...)
+      end
     end
   end
 end

lib/strike_me/api/invoices.rb

@@ -8,6 +8,7 @@ module StrikeMe
       include Enumerable
 
       autoload_default :Invoice
+      autoload_default :Quote
 
       delegate :first, :last, :size, :any?, to: :list
 
@@ -25,6 +26,51 @@ module StrikeMe
 
         @list = response.body['items'].map { |item| Invoice.new item }
       end
+
+      def paid
+        select(&:paid?)
+      end
+
+      def find(id)
+        url = "invoices/#{id}"
+        response = client.get url
+
+        raise ResponseError.new(url, response.body) unless response.success?
+
+        Invoice.new response.body
+      end
+
+      # POST invoices — amount is a decimal string per Strike's own API
+      # (not a float/BTC value), matching what #list/#find already hand
+      # back untouched in Invoice#amount.
+      def create(amount:, currency:, description: nil, correlation_id: nil)
+        url = 'invoices'
+        body = {
+          amount: { amount: amount, currency: currency },
+          description: description,
+          correlationId: correlation_id
+        }.compact
+        response = client.post(url, body)
+
+        raise ResponseError.new(url, response.body) unless response.success?
+
+        Invoice.new response.body
+      end
+
+      # POST invoices/{id}/quote — the second step of actually getting a
+      # payable BOLT 11 (Invoice#create alone only reserves the invoice
+      # shell; nothing is payable until a quote exists). Quotes expire
+      # (Quote#expiration) — callers request a fresh one per payment
+      # attempt rather than caching.
+      def quote(id, description_hash: nil)
+        url = "invoices/#{id}/quote"
+        body = { descriptionHash: description_hash }.compact
+        response = client.post(url, body)
+
+        raise ResponseError.new(url, response.body) unless response.success?
+
+        Quote.new response.body
+      end
     end
   end
 end

lib/strike_me/api/invoices/invoice.rb

@@ -13,6 +13,7 @@ module StrikeMe
         attribute :receiverId
         attribute :payerId
 
+        alias_attribute :id, :invoiceId
         attribute_names.select { _1.end_with? 'Id' }.each do |snake_name|
           alias_attribute snake_name.underscore, snake_name
         end
@@ -20,6 +21,18 @@ module StrikeMe
         def paid?
           state == 'PAID'
         end
+
+        def unpaid?
+          state == 'UNPAID'
+        end
+
+        def pending?
+          state == 'PENDING'
+        end
+
+        def cancelled?
+          state == 'CANCELLED'
+        end
       end
     end
   end

lib/strike_me/api/invoices/quote.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module StrikeMe
+  module API
+    class Invoices
+      # Response of POST invoices/{id}/quote — the actual payable BOLT 11
+      # only exists once a quote is issued; Invoice#create alone reserves
+      # the invoice shell but has nothing a wallet can pay yet.
+      class Quote < BaseModel
+        attribute :quoteId
+        attribute :description
+        attribute :lnInvoice
+        attribute :onchainAddress
+        attribute :expiration, :datetime
+        attribute :expirationInSec, :integer
+        attribute :targetAmount
+        attribute :sourceAmount
+        attribute :conversionRate
+
+        alias_attribute :id, :quoteId
+        alias_attribute :bolt11, :lnInvoice
+        attribute_names.select { _1.end_with? 'Id' }.each do |snake_name|
+          alias_attribute snake_name.underscore, snake_name
+        end
+
+        def expired?
+          expiration.present? && expiration.past?
+        end
+      end
+    end
+  end
+end

lib/strike_me/api/webhook.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'active_support/security_utils'
+
+module StrikeMe
+  module API
+    # Verifies the X-Webhook-Signature header Strike attaches to every
+    # webhook POST — HMAC-SHA256 of the raw request body, keyed by the
+    # secret set at webhook-subscription creation time. See
+    # https://docs.strike.me/webhooks/signature-verification — this
+    # mirrors Strike's own documented reference implementation exactly
+    # (hex digest, timing-safe compare), just in Ruby.
+    #
+    # `raw_body` must be the exact bytes Strike sent, before any
+    # JSON-parsing round-trip — re-serializing a parsed body can reorder
+    # keys or change whitespace and silently break verification.
+    module Webhook
+      SIGNATURE_HEADER = 'X-Webhook-Signature'
+
+      def self.valid_signature?(raw_body:, signature:, secret:)
+        return false if signature.blank? || raw_body.blank?
+
+        expected = OpenSSL::HMAC.hexdigest('SHA256', secret, raw_body)
+        secure_compare(expected, signature)
+      end
+
+      # ActiveSupport::SecurityUtils.secure_compare raises on a length
+      # mismatch rather than returning false — a garbled/truncated header
+      # from a malformed request should fail closed, not raise.
+      def self.secure_compare(expected, actual)
+        return false unless expected.bytesize == actual.bytesize
+
+        ActiveSupport::SecurityUtils.secure_compare(expected, actual)
+      end
+    end
+  end
+end

lib/strike_me/api/webhook_event.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module StrikeMe
+  module API
+    # Parses the WebhookEvent payload every Strike webhook POST carries —
+    # {id, eventType, webhookVersion, data: {entityId, changes}, created,
+    # deliverySuccess}. Deliberately does NOT carry the changed values
+    # themselves — Strike's own docs are explicit that the event never
+    # contains the actual data changes, only that something changed on
+    # `entity_id`. A real value only comes from calling the matching
+    # fetch endpoint (e.g. Invoices#find for an invoice.* event) —
+    # trusting anything else here would mean trusting an unauthenticated
+    # claim about money having moved.
+    class WebhookEvent < BaseModel
+      attribute :id
+      attribute :eventType
+      attribute :webhookVersion
+      attribute :data
+      attribute :created, :datetime
+      attribute :deliverySuccess, :boolean
+
+      alias_attribute :event_type, :eventType
+      alias_attribute :webhook_version, :webhookVersion
+      alias_attribute :delivery_success, :deliverySuccess
+
+      def entity_id
+        data['entityId'] || data[:entityId]
+      end
+
+      def changes
+        data['changes'] || data[:changes] || []
+      end
+
+      def invoice_event?
+        event_type.to_s.start_with?('invoice.')
+      end
+    end
+  end
+end