fix(webhooks): replace c compiled ed25519 package with native one (#8)

* replace c compiled ed25519 package with native one
tweetnacl translates the original TweetNaCl implementation to JS
including ed25519 implementation

* update shrinkwrap

* add node v12 to travis

.travis.yml

@@ -5,6 +5,7 @@ node_js:
   - "8"
   - "9"
   - "10"
+  - "12"
 sudo: false
 
 cache:

lib/Webhooks.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var Buffer = require('safe-buffer').Buffer;
-var ed25519 = require('ed25519');
+var nacl = require('tweetnacl');
 
 var Error = require('./Error');
 
@@ -23,13 +23,11 @@ var signature = {
 
     var payloadBuffer = Buffer.from(`${timestampHeader}|${payload}`, 'utf8');
 
-    // eslint-disable-next-line new-cap
-    var keyPair = ed25519.MakeKeypair(Buffer.from(publicKey, 'base64'));
+    var keyPair = nacl.sign.keyPair.fromSeed(Buffer.from(publicKey, 'base64'));
     var verification;
 
     try {
-      // eslint-disable-next-line new-cap
-      verification = ed25519.Verify(payloadBuffer, signatureHeader, keyPair.publicKey);
+      verification = nacl.sign.detached.verify(payloadBuffer, signatureHeader, keyPair.publicKey);
     } catch (err) {
       throwSignatureVerificationError(payload, signatureHeader, timestampHeader);
     }

package.json

@@ -37,10 +37,10 @@
     "nyc": "^14.1.1"
   },
   "dependencies": {
-    "ed25519": "0.0.4",
     "lodash.isplainobject": "^4.0.6",
     "qs": "^6.6.0",
     "safe-buffer": "^5.1.1",
+    "tweetnacl": "^1.0.1",
     "uuid": "^3.3.2"
   },
   "license": "MIT",

test/Webhook.spec.js

@@ -4,7 +4,7 @@ var telnyx = require('../testUtils').getSpyableTelnyx();
 var expect = require('chai').expect;
 var Buffer = require('safe-buffer').Buffer;
 var crypto = require('crypto');
-var ed25519 = require('ed25519');
+var nacl = require('tweetnacl');
 
 var EVENT_PAYLOAD = {
   data: {
@@ -144,6 +144,5 @@ function generateSignature(opts) {
 
   var payload = Buffer.from(`${opts.timestamp}|${opts.payload}`, 'utf8');
 
-  // eslint-disable-next-line new-cap
-  return ed25519.Sign(payload, ed25519.MakeKeypair(Buffer.from(PUBLIC_KEY, 'base64')));
+  return nacl.sign.detached(payload, nacl.sign.keyPair.fromSeed(Buffer.from(PUBLIC_KEY, 'base64')).secretKey);
 }