Receives inbound Amazon SNS/SES event notifications at POST <dashboard_path>/webhooks/sns/:token.

This route intentionally lives outside the dashboard's live_session pipe (see SquatchMail.Web.Router): it is a machine-to-machine API endpoint authenticated by the per-source :token path segment, not a browser session, so it skips CSRF protection and session fetching entirely.

Raw body requirement

SNS signature verification needs the exact bytes SNS sent. The pipeline that mounts this route must configure Plug.Parsers with body_reader: {SquatchMail.SNS.RawBodyReader, :read_body, []} (scoped to this path is enough) so conn.assigns[:raw_body] is populated - see SquatchMail.SNS.RawBodyReader's moduledoc for the exact plug pipeline snippet. If :raw_body isn't set (misconfigured pipeline), this falls back to re-encoding conn.params as JSON, which is not byte-identical to what SNS sent and will fail signature verification - that fallback exists only so the endpoint still responds predictably instead of crashing on a nil body.

This is a plain Plug, not a Phoenix.Controller (same pattern as SquatchMail.Web.AssetController) - Phoenix's router dispatches get/ post to either kind of module identically (post "/path", Module, :create), and a webhook endpoint doing a single JSON-in/status-code-out exchange doesn't need view/format negotiation.