bterkuileandClaude Sonnet 5
ac2558f5ce
Strike sends X-Webhook-Signature in UPPERCASE hex. OpenSSL::HMAC. hexdigest always returns lowercase, and valid_signature? compared them case-sensitively via secure_compare — every genuine Strike webhook was being silently rejected as an invalid signature. Confirmed live: executed a real Lightning payment (payment-quotes/lightning + PATCH .../execute), received a real payment.updated webhook, and recomputing the HMAC over the captured payload/secret matched case-insensitively but not case-sensitively — proving the algorithm/secret/body were already correct and this was purely a case-comparison bug. Their own reference docs (docs.strike.me/webhooks/signature-verification) don't mention the case difference. Regression test added using the real captured signature, upcased. Also, both found via that same live test: - Invoices::Invoice didn't declare correlationId, raising ActiveModel::UnknownAttributeError the moment a real one (which CreateInvoice always sends) round-tripped through a live response — no existing spec fixture's stubbed body had included it. - BtcAttributeType was only registered with ActiveModel::Type, not ActiveRecord::Type (a separate registry) — an `attribute :x, :strike_btc` declaration on an ActiveRecord model raised "Unknown type" without this. Guarded behind defined?(ActiveRecord::Type) since this gem only depends on active_model. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
49 lines
1.4 KiB
Ruby
49 lines
1.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module StrikeMe
|
|
module API
|
|
class Invoices
|
|
class Invoice < BaseModel
|
|
attribute :invoiceId
|
|
attribute :amount
|
|
attribute :state
|
|
attribute :created, :datetime
|
|
attribute :description
|
|
attribute :issuerId
|
|
attribute :receiverId
|
|
attribute :payerId
|
|
# Only present on the #create response, echoing back whatever
|
|
# Invoices#create sent as correlationId (Strike's own docs list
|
|
# it as request-optional/response-present) — missing here meant
|
|
# ActiveModel::UnknownAttributeError the first time a real
|
|
# correlation_id round-tripped through a live Strike account (no
|
|
# existing spec fixture's stubbed response body included it, so
|
|
# this went uncaught until now). end_with?('Id') below already
|
|
# picks this up automatically, same as every other *Id field.
|
|
attribute :correlationId
|
|
|
|
alias_attribute :id, :invoiceId
|
|
attribute_names.select { _1.end_with? 'Id' }.each do |snake_name|
|
|
alias_attribute snake_name.underscore, snake_name
|
|
end
|
|
|
|
def paid?
|
|
state == 'PAID'
|
|
end
|
|
|
|
def unpaid?
|
|
state == 'UNPAID'
|
|
end
|
|
|
|
def pending?
|
|
state == 'PENDING'
|
|
end
|
|
|
|
def cancelled?
|
|
state == 'CANCELLED'
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|