Webhook signature verification and event construction.

Stripe signs webhook payloads with HMAC-SHA256. Always verify signatures before processing events.

Phoenix integration

# In your endpoint.ex, add a raw body parser for the webhook route:
plug Plug.Parsers,
  parsers: [:urlencoded, :multipart, :json],
  pass: ["*/*"],
  body_reader: {CacheBodyReader, :read_body, []},
  json_decoder: Jason

# In your controller:
def webhook(conn, _params) do
  payload = conn.assigns.raw_body
  signature = get_req_header(conn, "stripe-signature") |> List.first()

  case StripeManaged.Webhook.construct_event(payload, signature) do
    {:ok, event} -> handle_event(event)
    {:error, msg} -> send_resp(conn, 400, msg)
  end
end