Verifies the DigitalSignature on inbound ClearBank webhooks.

ClearBank signs webhook bodies with their private key. You must verify this signature using ClearBank's public key, downloaded from the Portal under Webhook Management > Download Public Key.

Usage

# At startup, load ClearBank's public key
pub_key_pem = File.read!("clearbank_webhook_public_key.pem")

# In your webhook endpoint handler
raw_body = conn.assigns[:raw_body]  # capture before any parsing
signature = Plug.Conn.get_req_header(conn, "digitalsignature") |> List.first()

case ClearBank.Webhook.Verifier.verify(raw_body, signature, pub_key_pem) do
  :ok ->
    # Signature valid — proceed to parse and process
    {:ok, webhook} = ClearBank.Webhook.parse(Jason.decode!(raw_body))
    process(webhook)

  {:error, :invalid_signature} ->
    # Reject — do not process
    conn |> send_resp(401, "") |> halt()
end