bterkuileandClaude Sonnet 5
90ab7c74b1
Finishes the two gaps that mattered most for real use: Invoices#create
(POST invoices) + Invoices#quote (POST invoices/{id}/quote, returning
the new Quote model with the actual payable bolt11 — an invoice alone
has nothing payable until quoted) and Webhook.valid_signature?
(HMAC-SHA256 over the raw body via X-Webhook-Signature, per Strike's own
documented reference implementation, timing-safe compare). Also finishes
Invoices#find (was a stub with a leftover binding.pry) and adds
WebhookEvent to parse the {id, eventType, data: {entityId, changes}}
payload shape — deliberately doesn't expose changed values, since
Strike's webhooks never carry them; a real value only ever comes from
re-fetching the resource.
Client gains #post/#patch (only #get existed before), needed for both
of the above.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa
32 lines
1.6 KiB
Ruby
32 lines
1.6 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe StrikeMe::API::Webhook do
|
|
let(:secret) { 'a-webhook-subscription-secret' }
|
|
let(:raw_body) { '{"id":"245e40d8-f197-411c-8f20-a326d08da402","eventType":"invoice.updated","webhookVersion":"v1","data":{"entityId":"602cc206-6b4a-42dd-bc89-9a534bb04034","changes":["state"]},"created":"2026-09-15T12:00:00+00:00","deliverySuccess":true}' }
|
|
let(:real_signature) { OpenSSL::HMAC.hexdigest('SHA256', secret, raw_body) }
|
|
|
|
describe '.valid_signature?' do
|
|
it 'is true for a signature computed with the same secret over the same raw body' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: secret)).to eq true
|
|
end
|
|
|
|
it 'is false for the wrong secret' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: 'wrong')).to eq false
|
|
end
|
|
|
|
it 'is false if the body was tampered with after signing' do
|
|
tampered = raw_body.sub('"state"', '"amount"')
|
|
expect(described_class.valid_signature?(raw_body: tampered, signature: real_signature, secret: secret)).to eq false
|
|
end
|
|
|
|
it 'is false for a blank signature, rather than raising' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: '', secret: secret)).to eq false
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: nil, secret: secret)).to eq false
|
|
end
|
|
|
|
it 'is false (not a raised length-mismatch error) for a garbled/truncated signature' do
|
|
expect(described_class.valid_signature?(raw_body: raw_body, signature: 'not-a-real-length', secret: secret)).to eq false
|
|
end
|
|
end
|
|
end
|