Add invoice creation, quoting, and webhook signature verification

Finishes the two gaps that mattered most for real use: Invoices#create
(POST invoices) + Invoices#quote (POST invoices/{id}/quote, returning
the new Quote model with the actual payable bolt11 — an invoice alone
has nothing payable until quoted) and Webhook.valid_signature?
(HMAC-SHA256 over the raw body via X-Webhook-Signature, per Strike's own
documented reference implementation, timing-safe compare). Also finishes
Invoices#find (was a stub with a leftover binding.pry) and adds
WebhookEvent to parse the {id, eventType, data: {entityId, changes}}
payload shape — deliberately doesn't expose changed values, since
Strike's webhooks never carry them; a real value only ever comes from
re-fetching the resource.

Client gains #post/#patch (only #get existed before), needed for both
of the above.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa

spec/strike_me/api/invoices_spec.rb

@@ -22,6 +22,7 @@ RSpec.describe StrikeMe::API::Invoices do
           'receiverId'  => '41952e07-483c-4cd7-afa4-b6a8ec729809',
           'payerId'     => 'f75c22bf-625f-4c47-acdf-acb9c596bb8c'
         )
+        expect(list.first.id     ).to eq '97dca64c-6dde-4a87-b970-279f1a8e0ac5'
         expect(list.first.created).to be_a Time
 
         expect(list.last.attributes).to eq(
@@ -37,4 +38,62 @@ RSpec.describe StrikeMe::API::Invoices do
       end
     end
   end
+
+  describe '#find' do
+    before do
+      stub_request(:get, 'https://api.strike.me/v1/invoices/97dca64c-6dde-4a87-b970-279f1a8e0ac5')
+        .to_return(status: 200, body: '{"invoiceId":"97dca64c-6dde-4a87-b970-279f1a8e0ac5","amount":{"amount":"0.00014","currency":"BTC"},"state":"PAID","created":"2025-08-08T22:28:44.195825+00:00","description":"Hi there","issuerId":"41952e07-483c-4cd7-afa4-b6a8ec729809","receiverId":"41952e07-483c-4cd7-afa4-b6a8ec729809","payerId":"f75c22bf-625f-4c47-acdf-acb9c596bb8c"}', headers: {'Content-Type' => 'application/json'})
+    end
+
+    it 'finds and returns the proper object' do
+      invoice = subject.find('97dca64c-6dde-4a87-b970-279f1a8e0ac5')
+
+      expect(invoice).to be_a StrikeMe::API::Invoices::Invoice
+      expect(invoice.id).to eq '97dca64c-6dde-4a87-b970-279f1a8e0ac5'
+      expect(invoice).to be_paid
+    end
+  end
+
+  describe '#create' do
+    before do
+      stub_request(:post, 'https://api.strike.me/v1/invoices')
+        .with(body: {amount: {amount: '10.00', currency: 'USD'}, description: 'Table 3'})
+        .to_return(status: 201, body: '{"invoiceId":"602cc206-6b4a-42dd-bc89-9a534bb04034","amount":{"amount":"10.00","currency":"USD"},"state":"UNPAID","created":"2026-09-15T12:00:00+00:00","description":"Table 3","issuerId":"41952e07-483c-4cd7-afa4-b6a8ec729809","receiverId":"41952e07-483c-4cd7-afa4-b6a8ec729809"}', headers: {'Content-Type' => 'application/json'})
+    end
+
+    it 'issues a new invoice, unpaid, with no bolt11 yet — that only exists once quoted' do
+      invoice = subject.create(amount: '10.00', currency: 'USD', description: 'Table 3')
+
+      expect(invoice).to be_a StrikeMe::API::Invoices::Invoice
+      expect(invoice.id).to eq '602cc206-6b4a-42dd-bc89-9a534bb04034'
+      expect(invoice).to be_unpaid
+    end
+
+    it 'omits correlationId/description entirely when not given, rather than sending them null' do
+      stub = stub_request(:post, 'https://api.strike.me/v1/invoices')
+        .with(body: {amount: {amount: '10.00', currency: 'USD'}})
+        .to_return(status: 201, body: '{"invoiceId":"x","amount":{"amount":"10.00","currency":"USD"},"state":"UNPAID","created":"2026-09-15T12:00:00+00:00","issuerId":"a","receiverId":"a"}', headers: {'Content-Type' => 'application/json'})
+
+      subject.create(amount: '10.00', currency: 'USD')
+      expect(stub).to have_been_requested
+    end
+  end
+
+  describe '#quote' do
+    before do
+      stub_request(:post, 'https://api.strike.me/v1/invoices/602cc206-6b4a-42dd-bc89-9a534bb04034/quote')
+        .with(body: {})
+        .to_return(status: 201, body: '{"quoteId":"a1b2c3","lnInvoice":"lnbc100n1p...","expiration":"2099-01-01T00:00:00+00:00","expirationInSec":300,"targetAmount":{"amount":"10.00","currency":"USD"},"sourceAmount":{"amount":"0.00014","currency":"BTC"},"conversionRate":{"amount":"71428.57","sourceCurrency":"BTC","targetCurrency":"USD"}}', headers: {'Content-Type' => 'application/json'})
+    end
+
+    it 'returns a Quote carrying the actual payable bolt11' do
+      quote = subject.quote('602cc206-6b4a-42dd-bc89-9a534bb04034')
+
+      expect(quote).to be_a StrikeMe::API::Invoices::Quote
+      expect(quote.bolt11).to eq 'lnbc100n1p...'
+      expect(quote.id).to eq 'a1b2c3'
+      expect(quote.expiration).to be_a Time
+      expect(quote).not_to be_expired
+    end
+  end
 end

spec/strike_me/api/webhook_event_spec.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+RSpec.describe StrikeMe::API::WebhookEvent do
+  subject(:event) do
+    described_class.new(
+      'id' => '245e40d8-f197-411c-8f20-a326d08da402',
+      'eventType' => 'invoice.updated',
+      'webhookVersion' => 'v1',
+      'data' => { 'entityId' => '602cc206-6b4a-42dd-bc89-9a534bb04034', 'changes' => ['state'] },
+      'created' => '2026-09-15T12:00:00+00:00',
+      'deliverySuccess' => true
+    )
+  end
+
+  it 'exposes entity_id and changes from the nested data object' do
+    expect(event.entity_id).to eq '602cc206-6b4a-42dd-bc89-9a534bb04034'
+    expect(event.changes).to eq ['state']
+  end
+
+  it 'aliases the camelCase attributes to snake_case' do
+    expect(event.event_type).to eq 'invoice.updated'
+    expect(event.webhook_version).to eq 'v1'
+    expect(event.delivery_success).to eq true
+  end
+
+  it 'parses created as a real Time' do
+    expect(event.created).to be_a Time
+  end
+
+  it 'identifies invoice events' do
+    expect(event).to be_invoice_event
+  end
+
+  it 'does not carry the actual changed values — only that state changed, not to what' do
+    expect(event.attributes.keys).not_to include('amount', 'state')
+  end
+end

spec/strike_me/api/webhook_spec.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+RSpec.describe StrikeMe::API::Webhook do
+  let(:secret) { 'a-webhook-subscription-secret' }
+  let(:raw_body) { '{"id":"245e40d8-f197-411c-8f20-a326d08da402","eventType":"invoice.updated","webhookVersion":"v1","data":{"entityId":"602cc206-6b4a-42dd-bc89-9a534bb04034","changes":["state"]},"created":"2026-09-15T12:00:00+00:00","deliverySuccess":true}' }
+  let(:real_signature) { OpenSSL::HMAC.hexdigest('SHA256', secret, raw_body) }
+
+  describe '.valid_signature?' do
+    it 'is true for a signature computed with the same secret over the same raw body' do
+      expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: secret)).to eq true
+    end
+
+    it 'is false for the wrong secret' do
+      expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: 'wrong')).to eq false
+    end
+
+    it 'is false if the body was tampered with after signing' do
+      tampered = raw_body.sub('"state"', '"amount"')
+      expect(described_class.valid_signature?(raw_body: tampered, signature: real_signature, secret: secret)).to eq false
+    end
+
+    it 'is false for a blank signature, rather than raising' do
+      expect(described_class.valid_signature?(raw_body: raw_body, signature: '', secret: secret)).to eq false
+      expect(described_class.valid_signature?(raw_body: raw_body, signature: nil, secret: secret)).to eq false
+    end
+
+    it 'is false (not a raised length-mismatch error) for a garbled/truncated signature' do
+      expect(described_class.valid_signature?(raw_body: raw_body, signature: 'not-a-real-length', secret: secret)).to eq false
+    end
+  end
+end