Utils::validateHmac() throws an Array to string conversion error

[maxrice]

Issue summary

When using Utils::validateHmac() to validate the HMAC provided by Shopify for an embedded app, any URLs that contain an associative array trigger an "array to string conversion" error on line 91. This method was refactored in #269 and associative array handling wasn't implemented.

Expected behavior

While it would be nice if this library handled associative arrays properly, I'd be fine implementing them in our project if it was documented anywhere how Shopify handles them. I've tried many, many different variations of encoding an associative array into a URL, but have not been able to get the HMAC to match. It's somewhat common to have URLs like ?filter[status]=live and it would be nice to use them with an embedded app and still be able to verify the HMAC.

Steps to reproduce the problem

1. Pass an associative array to Utils::validateHmac() to reproduce the issue.

[maxrice]

@paulomarg tagging you since it looks like you reviewed the #269 -- any way you can see how Shopify is internally encoding arrays like ?filter[status]=live before calculating the HMAC? I'm happy to work up a PR to address this issue then.

[petrisorciprian-vitals]

"Shopify parses the nested query param into a Ruby Hash, then interpolates it straight into the HMAC message via to_s/inspect. And it's the Ruby 3.4 format specifically — {"0" => "cartUpdated"} with spaces around => (pre-3.4 was {"0"=>"cartUpdated"})."

Thank me later, I was pulling my hair out at this.

Pointed Claude at it, and after telling it to specifically try out various Ruby formatting quirks, I found this.

[maxrice]

@petrisorciprian-vitals thanks! good idea to point Claude at the ruby code. We ended up rolling our own since this library seems more or less abandoned, but it'll be great to have this one last piece working.