Verifies that an incoming webhook request really came from Moov, and parses its payload into a Moov.Webhook.Event.

Moov signs every webhook delivery with an HMAC-SHA512 of timestamp <> "|" <> nonce <> "|" <> webhookID, keyed with the signing secret shown in the Moov Dashboard for that webhook (https://dashboard.moov.io/developers/webhooks), and sends the result hex-encoded in the X-Signature header alongside the X-Timestamp, X-Nonce, and X-Webhook-ID headers it was computed from. See https://docs.moov.io/guides/webhooks/check-webhook-signatures/.

Usage with Plug/Phoenix

def webhook_controller(conn, _params) do
  {:ok, raw_body, conn} = Plug.Conn.read_body(conn)
  secret = Application.fetch_env!(:my_app, :moov_webhook_secret)

  case Moov.Webhook.construct_event(raw_body, conn.req_headers, secret) do
    {:ok, %Moov.Webhook.Event{type: "transfer.updated", data: data}} ->
      MyApp.Transfers.handle_update(data)
      send_resp(conn, 200, "")

    {:ok, _event} ->
      send_resp(conn, 200, "")

    {:error, :invalid_signature} ->
      send_resp(conn, 400, "invalid signature")

    {:error, reason} ->
      send_resp(conn, 400, "bad request: " <> inspect(reason))
  end
end

Note that for the signature to validate you must use the raw, unparsed request body - if you're using Phoenix, make sure no JSON parser has already consumed and re-serialized it (a custom Plug.Parsers body reader that caches the raw body is the standard fix).