Securely verify incoming webhook signatures from Diio

flowchart TD trig>"diio sends webhook event"]:::trig s0["receive webhook event"]:::svc s1["check signature against key"]:::task trig --> s0 s0 --> s1 gx{"× is signature valid"}:::gate s1 --> gx p00["pass through for action"]:::task gx -->|"valid signature"| p00 p10["reject message"]:::task gx -->|"invalid signature"| p10 p00 --> out p10 --> out out[/"verified event passed or rejected"/]:::out pay{{"confidence in trustworthy automated data"}}:::pay out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff