AWS SES webhook verifier via Amazon SNS.

Implements Mailglass.Webhook.Provider for SES events delivered through SNS HTTP subscriptions. Handles all three SNS message types on the same endpoint:

• Notification — SES event payload; returns :ok for the ingest pipeline
• SubscriptionConfirmation — auto-confirms after verification; returns {:ok, :control_plane, :subscription_confirmed}
• UnsubscribeConfirmation — verifies and no-ops; returns {:ok, :control_plane, :unsubscribe_confirmed}

Verification algorithm

1. Parse raw body as JSON (SNS delivers text/plain but body is valid JSON)
2. Validate SigningCertURL with TrustPolicy.valid_cert_url?/1 before network I/O
3. Fetch X.509 public key from CertCache (ETS hit) or :httpc (cache miss)
4. Build canonical string from message fields (byte-sorted per AWS spec)
5. Verify RSA-SHA1 (SignatureVersion 1) or RSA-SHA256 (SignatureVersion 2) signature
6. Dispatch on MessageType:
   • Notification → return :ok
   • SubscriptionConfirmation → validate SubscribeURL, construct ConfirmSubscription URL from TopicArn + Token, :httpc GET with redirects disabled
   • UnsubscribeConfirmation → log telemetry, return control-plane no-op

Inbound-reuse seam

verify_envelope!/2 exposes steps 1-5 (the SNS X.509 verification) as a public seam so mailglass_inbound's SES ingress can reuse the byte-identical SNS envelope verification without reinventing cryptography (-01). verify!/3 calls it, then dispatches on MessageType; its public return and behavior are unchanged.

Configuration (Application env)

config :mailglass, :ses,
  cert_cache_ttl_seconds: 86_400   # default 24 hours