Clarify the implementation of generating webhook signature when there are special characters in the payload

[yqrashawn]

Question description

When there are special characters in the payload
For example
ä, ü, ö, 任务

I got the “wrong” signature following the X-Todoist-Hmac-SHA256 doc in the Request Header section of the sync doc.

example code

const c = require("node:crypto");
const hash = c.createHmac("sha256", secret).update(buf).digest("base64");

(def payload (slurp body :encoding "UTF-8"))
;; body is jetty HttpInputStream http://www.servlets.com/javadoc/org/mortbay/http/HttpInputStream.html
(defn hmac-sha256-b64 [secret payload]
  (-> payload
      buddy.codecs/str->bytes
      (buddy.mac/hash {:key secret :alg :hmac+sha256})
      buddy.codecs/bytes->b64-str))

• the two implementations have the same result
• signature matches with the one in X-Todoist-Hmac-SHA256 when there's no special character