nowpayments 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97ac8b5b89917ed020bf1fc5c887cc02ab236a65778433696826adbcf55298ab
-  data.tar.gz: 1faa8a8ef8abdb85c17e33c6f5ddfe7eb17f434a062784095c32627b924eac94
+  metadata.gz: 406588aa056545818f16a435a4883e7f3fc6d164f7e3c43a52755ceecf758cbc
+  data.tar.gz: 58e76a282095442a96829a653417eb30aa2d7b192cff6139e4cd24bcd8b96784
 SHA512:
-  metadata.gz: 41100692b84c8888da5c11292d1759c0b17c48027ab72fa15b4b755675402ad39fb36c441cd13cb12a526eb969126700e3c636e3df01de54f3d8e8e5bbe8e85b
-  data.tar.gz: 3e66866c39e02084cbfa8156d6b79160eeb962955cbafa1900d298321cb99759da60c43728dc1336b359c32bfbd69ef5f8827e40bbe67d96038268b6373eb2f7
+  metadata.gz: 8e60843f1683f90a08c82a010830384b6d2ab58a1292645e4aa4610276e30fd958bd665fbe11edeaad9f4f7b86363806d4b66ed1dc86995c427229acd3c94884
+  data.tar.gz: d9945be67e85976fe4b1108209c659ef82126e942655c299836700cf65a667c7789578d2841aa4aa86bcc56f79cb96a8d8024fb78b959b4898c2f96699a1f7f6

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2025-12-09
+
+### Fixed
+- **Critical Webhook Signature Verification Bug**: Fixed signature verification failing when NOWPayments sends numbers in scientific notation (e.g., `1e-7`)
+  - The previous implementation parsed the JSON body, sorted keys, and re-serialized it before computing the HMAC
+  - Ruby's `JSON.generate` would change number formatting (e.g., `1e-7` → `0.0000001`), breaking the signature
+  - Now computes HMAC directly on the raw body string, which is correct since NOWPayments already sends keys in sorted order
+  - Removed unused `sort_keys_recursive` and `generate_signature` private methods
+
+### Changed
+- Simplified `Webhook.verify!` implementation - now a single HMAC computation on raw body
+- Added comprehensive regression tests including scientific notation edge case
+
 ## [0.2.0] - 2025-11-01
 
 ### Added - 100% API Coverage Achievement! 🎉

data/lib/nowpayments/api/authentication.rb

@@ -10,6 +10,7 @@ module NOWPayments
       # @param email [String] Your NOWPayments dashboard email (case-sensitive)
       # @param password [String] Your NOWPayments dashboard password (case-sensitive)
       # @return [Hash] Authentication response with JWT token
+      # @raise [AuthenticationError] if credentials are invalid or access is denied
       # @note Email and password are case-sensitive. test@gmail.com != Test@gmail.com
       def authenticate(email:, password:)
         response = post("auth", body: {
@@ -17,6 +18,46 @@ module NOWPayments
                           password: password
                         })
 
+        # Check for authentication errors
+        if response.body.is_a?(Hash)
+          # Handle 403 ACCESS_DENIED error
+          if response.body["statusCode"] == 403 || response.body["code"] == "ACCESS_DENIED"
+            error_msg = "Authentication failed: #{response.body["message"] || "Access denied"}. "
+            
+            if sandbox
+              error_msg += "You are using SANDBOX mode. "
+              error_msg += "Please verify:\n"
+              error_msg += "   1. You have a sandbox account at https://sandbox.nowpayments.io/\n"
+              error_msg += "   2. Your email and password are correct (case-sensitive)\n"
+              error_msg += "   3. Your sandbox account has API access enabled"
+            else
+              error_msg += "You are using PRODUCTION mode. "
+              error_msg += "Please verify:\n"
+              error_msg += "   1. Your NOWPayments account at https://nowpayments.io/ has API access enabled\n"
+              error_msg += "   2. Go to Settings → API → Enable API access if not already enabled\n"
+              error_msg += "   3. Your email and password are correct (case-sensitive)\n"
+              error_msg += "   4. If testing, you may need to use sandbox: true and sandbox credentials"
+            end
+            
+            raise AuthenticationError.new(
+              status: response.body["statusCode"],
+              body: { "message" => error_msg },
+              response_headers: response.headers
+            )
+          end
+          
+          # Handle other error responses
+          status_code = response.body["statusCode"]&.to_i || 0
+          if response.body["status"] == false || (status_code > 0 && status_code >= 400)
+            error_msg = response.body["message"] || "Authentication failed"
+            raise AuthenticationError.new(
+              status: status_code,
+              body: { "message" => error_msg },
+              response_headers: response.headers
+            )
+          end
+        end
+
         # Store token and expiry time (5 minutes from now)
         if response.body["token"]
           @jwt_token = response.body["token"]
@@ -24,6 +65,9 @@ module NOWPayments
 
           # Reset connection to include new Bearer token
           reset_connection! if respond_to?(:reset_connection!, true)
+        else
+          # No token in response - authentication failed
+          raise AuthenticationError, "Authentication failed: No token received. Check your email and password."
         end
 
         response.body

data/lib/nowpayments/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NOWPayments
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/lib/nowpayments/webhook.rb

@@ -18,36 +18,19 @@ module NOWPayments
         raise ArgumentError, "signature required" if signature.nil? || signature.empty?
         raise ArgumentError, "secret required" if secret.nil? || secret.empty?
 
-        parsed = JSON.parse(raw_body)
-        sorted_json = sort_keys_recursive(parsed)
-        expected_sig = generate_signature(sorted_json, secret)
+        # Compute HMAC directly on raw body - NOWPayments already sends keys in sorted order.
+        # DO NOT parse and re-serialize! Ruby's JSON.generate may change number formatting
+        # (e.g., scientific notation "1e-7" becomes "0.0000001"), breaking the signature.
+        expected_sig = OpenSSL::HMAC.hexdigest("SHA512", secret, raw_body)
 
         raise SecurityError, "Invalid IPN signature - webhook verification failed" unless secure_compare(expected_sig, signature)
 
-        parsed
+        # Only parse after verification succeeds
+        JSON.parse(raw_body)
       end
 
       private
 
-      # Recursively sort Hash keys (including nested hashes and arrays)
-      # This is critical for proper HMAC signature verification
-      def sort_keys_recursive(obj)
-        case obj
-        when Hash
-          obj.sort.to_h.transform_values { |v| sort_keys_recursive(v) }
-        when Array
-          obj.map { |v| sort_keys_recursive(v) }
-        else
-          obj
-        end
-      end
-
-      # Generate HMAC-SHA512 signature
-      def generate_signature(sorted_json, secret)
-        json_string = JSON.generate(sorted_json, space: "", indent: "")
-        OpenSSL::HMAC.hexdigest("SHA512", secret, json_string)
-      end
-
       # Constant-time comparison to prevent timing attacks
       def secure_compare(a, b)
         return false unless a.bytesize == b.bytesize

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: nowpayments
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Chayut Orapinpatipat
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-11-01 00:00:00.000000000 Z
+date: 2025-12-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday