support provider-accurate X webhook signatures

test/signature.test.js

@@ -2,7 +2,7 @@
 
 const test = require("node:test");
 const assert = require("node:assert/strict");
-const { hmacSHA256Hex, verifySignature } = require("../src/lib/signature");
+const { hmacSHA256Hex, hmacSHA256Base64, verifySignature } = require("../src/lib/signature");
 
 test("verifies valid signature", () => {
   const payload = JSON.stringify({ hello: "world" });
@@ -31,3 +31,19 @@ test("rejects missing signature", () => {
 
   assert.equal(verifySignature({ payload, secret, signature: "" }), false);
 });
+
+test("verifies valid base64 signature", () => {
+  const payload = JSON.stringify({ hello: "world" });
+  const secret = "topsecret";
+  const sig = hmacSHA256Base64(payload, secret);
+
+  assert.equal(
+    verifySignature({
+      payload,
+      secret,
+      signature: `sha256=${sig}`,
+      encoding: "base64",
+    }),
+    true,
+  );
+});