LemonChannels.Adapters.Email.Webhook (lemon_channels v0.1.0)

Receives inbound email webhooks on LemonChannels.InboundHttp.

Thin by design: authenticate, normalize, hand off. Provider-specific payload shapes are LemonChannels.Adapters.Email's business and routing is the router's, so this only decides whether to accept a request and what status the provider sees.

Authentication

A shared token in the x-webhook-token header, compared in constant time:

config :lemon_channels, LemonChannels.Adapters.Email, webhook_token: "..."

With no token configured the endpoint rejects everything with 401 rather than running open. An inbound mail endpoint that accepts unauthenticated POSTs is a spam relay into someone's agent.

The token is in a header rather than the body on purpose: that lets the check run as LemonChannels.InboundHttp.Handler.authorized?/1, which LemonChannels.InboundHttp.Router calls before parsing, so an unauthenticated caller cannot make the server decode a body — with attachments, the most expensive thing this endpoint does.

LemonChannels.Adapters.Email.Config resolves the token, so the TOML [gateway] config's email.webhook_token (or email.inbound.token) is honoured too — an existing deployment does not have to re-issue its token to cut over. A malformed config yields no token, and therefore a 401: unreadable configuration must not fail open.