bterkuileandClaude Sonnet 5
ac2558f5ce
Strike sends X-Webhook-Signature in UPPERCASE hex. OpenSSL::HMAC. hexdigest always returns lowercase, and valid_signature? compared them case-sensitively via secure_compare — every genuine Strike webhook was being silently rejected as an invalid signature. Confirmed live: executed a real Lightning payment (payment-quotes/lightning + PATCH .../execute), received a real payment.updated webhook, and recomputing the HMAC over the captured payload/secret matched case-insensitively but not case-sensitively — proving the algorithm/secret/body were already correct and this was purely a case-comparison bug. Their own reference docs (docs.strike.me/webhooks/signature-verification) don't mention the case difference. Regression test added using the real captured signature, upcased. Also, both found via that same live test: - Invoices::Invoice didn't declare correlationId, raising ActiveModel::UnknownAttributeError the moment a real one (which CreateInvoice always sends) round-tripped through a live response — no existing spec fixture's stubbed body had included it. - BtcAttributeType was only registered with ActiveModel::Type, not ActiveRecord::Type (a separate registry) — an `attribute :x, :strike_btc` declaration on an ActiveRecord model raised "Unknown type" without this. Guarded behind defined?(ActiveRecord::Type) since this gem only depends on active_model. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
43 lines
2.3 KiB
Ruby
43 lines
2.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe StrikeMe::API::Webhook do
|
|
let(:secret) { 'a-webhook-subscription-secret' }
|
|
let(:raw_body) { '{"id":"245e40d8-f197-411c-8f20-a326d08da402","eventType":"invoice.updated","webhookVersion":"v1","data":{"entityId":"602cc206-6b4a-42dd-bc89-9a534bb04034","changes":["state"]},"created":"2026-09-15T12:00:00+00:00","deliverySuccess":true}' }
|
|
let(:real_signature) { OpenSSL::HMAC.hexdigest('SHA256', secret, raw_body) }
|
|
|
|
describe '.valid_signature?' do
|
|
it 'is true for a signature computed with the same secret over the same raw body' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: secret)).to eq true
|
|
end
|
|
|
|
# Strike sends X-Webhook-Signature in UPPERCASE hex — confirmed live
|
|
# against a real payment.updated delivery 2026-09-22 (executed a real
|
|
# Lightning send, received a real signed webhook). OpenSSL::HMAC.
|
|
# hexdigest always returns lowercase; without downcasing both sides
|
|
# this rejected every genuine Strike webhook, silently, since a
|
|
# rejected webhook is indistinguishable from an actual forgery
|
|
# attempt from outside.
|
|
it 'is true for the real signature even when Strike sends it as UPPERCASE hex' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature.upcase, secret: secret)).to eq true
|
|
end
|
|
|
|
it 'is false for the wrong secret' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: 'wrong')).to eq false
|
|
end
|
|
|
|
it 'is false if the body was tampered with after signing' do
|
|
tampered = raw_body.sub('"state"', '"amount"')
|
|
expect(described_class.valid_signature?(raw_body: tampered, signature: real_signature, secret: secret)).to eq false
|
|
end
|
|
|
|
it 'is false for a blank signature, rather than raising' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: '', secret: secret)).to eq false
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: nil, secret: secret)).to eq false
|
|
end
|
|
|
|
it 'is false (not a raised length-mismatch error) for a garbled/truncated signature' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: 'not-a-real-length', secret: secret)).to eq false
|
|
end
|
|
end
|
|
end
|