Strike sends X-Webhook-Signature in UPPERCASE hex. OpenSSL::HMAC.
hexdigest always returns lowercase, and valid_signature? compared them
case-sensitively via secure_compare — every genuine Strike webhook was
being silently rejected as an invalid signature. Confirmed live: executed
a real Lightning payment (payment-quotes/lightning + PATCH .../execute),
received a real payment.updated webhook, and recomputing the HMAC over
the captured payload/secret matched case-insensitively but not
case-sensitively — proving the algorithm/secret/body were already
correct and this was purely a case-comparison bug. Their own reference
docs (docs.strike.me/webhooks/signature-verification) don't mention the
case difference. Regression test added using the real captured signature,
upcased.
Also, both found via that same live test:
- Invoices::Invoice didn't declare correlationId, raising
ActiveModel::UnknownAttributeError the moment a real one (which
CreateInvoice always sends) round-tripped through a live response —
no existing spec fixture's stubbed body had included it.
- BtcAttributeType was only registered with ActiveModel::Type, not
ActiveRecord::Type (a separate registry) — an `attribute :x,
:strike_btc` declaration on an ActiveRecord model raised "Unknown
type" without this. Guarded behind defined?(ActiveRecord::Type) since
this gem only depends on active_model.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Process-global ActiveSupport::Inflector state, not scoped to this gem —
requiring it inside a real host app (mozo-backend) broke Zeitwerk
autoloading of anything with "Api" in its name (JsonApiRenderer
camelized to JsonAPIRenderer instead, an uninitialized-constant error
with no obvious connection to this gem). Not needed here anyway:
autoload_default only ever goes constant name -> file path via
#underscore, never the reverse, so this module's own naming never
depended on it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa
Finishes the two gaps that mattered most for real use: Invoices#create
(POST invoices) + Invoices#quote (POST invoices/{id}/quote, returning
the new Quote model with the actual payable bolt11 — an invoice alone
has nothing payable until quoted) and Webhook.valid_signature?
(HMAC-SHA256 over the raw body via X-Webhook-Signature, per Strike's own
documented reference implementation, timing-safe compare). Also finishes
Invoices#find (was a stub with a leftover binding.pry) and adds
WebhookEvent to parse the {id, eventType, data: {entityId, changes}}
payload shape — deliberately doesn't expose changed values, since
Strike's webhooks never carry them; a real value only ever comes from
re-fetching the resource.
Client gains #post/#patch (only #get existed before), needed for both
of the above.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa
bterkuileandClaude Sonnet 5