release: 6.10.2

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "6.10.1"
+  ".": "6.10.2"
 }

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 6.10.2 (2024-11-20)
+
+Full Changelog: [v6.10.1...v6.10.2](https://github.com/Finch-API/finch-api-node/compare/v6.10.1...v6.10.2)
+
+### Bug Fixes
+
+* **webhooks:** use @noble/hashes instead of crypto for signing ([#495](https://github.com/Finch-API/finch-api-node/issues/495)) ([6289374](https://github.com/Finch-API/finch-api-node/commit/6289374934db3bbca920eed1aa869950640830f7))
+
 ## 6.10.1 (2024-11-20)
 
 Full Changelog: [v6.10.0...v6.10.1](https://github.com/Finch-API/finch-api-node/compare/v6.10.0...v6.10.1)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryfinch/finch-api",
-  "version": "6.10.1",
+  "version": "6.10.2",
   "description": "The official TypeScript library for the Finch API",
   "author": "Finch <[email protected]>",
   "types": "dist/index.d.ts",
@@ -24,6 +24,7 @@
     "fix": "./scripts/format"
   },
   "dependencies": {
+    "@noble/hashes": "^1.5.0",
     "@types/node": "^18.11.18",
     "@types/node-fetch": "^2.6.4",
     "abort-controller": "^3.0.0",

src/core.ts

@@ -1178,19 +1178,40 @@ export const getHeader = (headers: HeadersLike | Headers, header: string): strin
 /**
  * Encodes a string to Base64 format.
  */
-export const toBase64 = (str: string | null | undefined): string => {
-  if (!str) return '';
+export const toBase64 = (data: string | Uint8Array | null | undefined): string => {
+  if (!data) return '';
+
+  if (typeof data === 'string') {
+    data = new TextEncoder().encode(data);
+  }
+
   if (typeof Buffer !== 'undefined') {
-    return Buffer.from(str).toString('base64');
+    return Buffer.from(data).toString('base64');
   }
 
   if (typeof btoa !== 'undefined') {
-    return btoa(str);
+    return btoa(String.fromCharCode.apply(null, data as any));
   }
 
   throw new FinchError('Cannot generate b64 string; Expected `Buffer` or `btoa` to be defined');
 };
 
+export const fromBase64 = (str: string): Uint8Array => {
+  if (typeof Buffer !== 'undefined') {
+    return new Uint8Array(Buffer.from(str, 'base64'));
+  }
+
+  if (typeof atob !== 'undefined') {
+    return new Uint8Array(
+      atob(str)
+        .split('')
+        .map((c) => c.charCodeAt(0)),
+    );
+  }
+
+  throw new FinchError('Cannot decode b64 string; Expected `Buffer` or `atob` to be defined');
+};
+
 export function isObj(obj: unknown): obj is Record<string, unknown> {
   return obj != null && typeof obj === 'object' && !Array.isArray(obj);
 }

src/resources/webhooks.ts

@@ -3,8 +3,9 @@
 import { APIResource } from '../resource';
 import * as Shared from './shared';
 import * as BenefitsAPI from './hris/benefits/benefits';
-import { createHmac } from 'crypto';
-import { getRequiredHeader, HeadersLike } from '../core';
+import { fromBase64, getRequiredHeader, HeadersLike, toBase64 } from '../core';
+import { hmac } from '@noble/hashes/hmac';
+import { sha256 } from '@noble/hashes/sha2';
 
 export class Webhooks extends APIResource {
   /**
@@ -26,12 +27,15 @@ export class Webhooks extends APIResource {
       );
     }
 
-    const buf = Buffer.from(secret, 'base64');
-    if (buf.toString('base64') !== secret) {
+    try {
+      const buf = fromBase64(secret);
+      if (toBase64(buf) !== secret) {
+        throw new Error(`Given secret is not valid`);
+      }
+      return buf;
+    } catch (e) {
       throw new Error(`Given secret is not valid`);
     }
-
-    return new Uint8Array(buf);
   }
 
   private signPayload(
@@ -40,11 +44,8 @@ export class Webhooks extends APIResource {
   ) {
     const encoder = new TextEncoder();
     const toSign = encoder.encode(`${eventId}.${timestamp.getTime() / 1000}.${payload}`);
-
-    const hmac = createHmac('sha256', secret);
-    hmac.update(toSign);
-
-    return `v1,${hmac.digest('base64')}`;
+    const signed = toBase64(hmac(sha256, secret, toSign));
+    return `v1,${signed}`;
   }
 
   /** Make an assertion, if not `true`, then throw. */

src/version.ts

@@ -1 +1 @@
-export const VERSION = '6.10.1'; // x-release-please-version
+export const VERSION = '6.10.2'; // x-release-please-version