feat(whatsapp-inbox): intake extension with webhook, phone linking and receipt ack (#1338)

Webhook lifecycle: GET hub.challenge handshake (constant-time verify-token
compare); POST verifies X-Hub-Signature-256 over the RAW body before any
parse, Zod-parses the envelope, persists inbound rows (partial-unique wamid
= dedupe against Meta's up-to-7-day redelivery), acks 200 fast and defers
media processing via the after() idiom. Rejected and rate-limited content
always acks 200 and lands as skipped/error rows, never a retryable status.

Linking: the settings panel (Installningar -> WhatsApp) mints AC- one-time
codes (sha256 stored, 10 min TTL, single use, ambiguity-free alphabet); the
webhook consumes the code, binds phone to user (HMAC-peppered hash + AES-256-
GCM at rest) and confirms with M3. Keyword commands stopp/start/hjalp;
unknown senders get one throttled M1 greeting (1/h, 3/day) behind the
sender-quota RPC, with no media download and no content persistence.

Intake worker: atomic claim on the message row (the durable job record),
company resolution (default -> sole membership -> M6 fallback, no item),
per-company inbox quota (ack-and-drop, M17 once per 10 min per sender),
MIME allowlist, 10 MB stream-checked media download, exact sha256 duplicate
check, then the shared uploadAndExtract funnel (source 'whatsapp',
channel_context caption, whatsapp_message_id) and the M4 ack with extracted
merchant/total/date. Failures wrap to 'error' + error_message + one M18.

uploadAndExtract widened: source 'whatsapp', optional channelMeta + actorId;
email/upload paths behaviorally unchanged.

Deferred to PR4: burst debounce + combined ack (M5), in-chat company choice
(M6 buttons + 8h pin), clarifying questions M7-M10, interpret-answer LLM
call, sweep cron, retention cron.

Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

components/settings/sections/WhatsAppSettingsContent.tsx

@@ -0,0 +1,17 @@
+'use client'
+
+import { useTranslations } from 'next-intl'
+import { WhatsAppLinkPanel } from '@/components/extensions/general/WhatsAppLinkPanel'
+import { SettingsSectionHeader } from '@/components/settings/SettingsRows'
+
+export function WhatsAppSettingsContent() {
+  const tNav = useTranslations('settings_nav')
+  const tIntro = useTranslations('settings_intro')
+
+  return (
+    <div>
+      <SettingsSectionHeader title={tNav('whatsapp')} intro={tIntro('whatsapp')} />
+      <WhatsAppLinkPanel />
+    </div>
+  )
+}

components/settings/sections/index.ts

@@ -46,6 +46,10 @@ const BillingSettingsContent = dynamic(() =>
   import('./BillingSettingsContent').then((module) => ({ default: module.BillingSettingsContent })),
   { loading: SettingsLoadingSkeleton },
 )
+const WhatsAppSettingsContent = dynamic(() =>
+  import('./WhatsAppSettingsContent').then((module) => ({ default: module.WhatsAppSettingsContent })),
+  { loading: SettingsLoadingSkeleton },
+)
 
 /**
  * Single source of truth mapping a settings section id to the component that
@@ -66,6 +70,7 @@ export const SETTINGS_SECTIONS: Record<string, ComponentType> = {
   assistant: AssistantSettingsContent,
   api: ApiSettingsContent,
   billing: BillingSettingsContent,
+  whatsapp: WhatsAppSettingsContent,
 }
 
 export type SettingsSectionId = keyof typeof SETTINGS_SECTIONS

components/settings/useSettingsNavItems.ts

@@ -41,6 +41,7 @@ export function useSettingsNavItems(): { items: SettingsNavItem[]; groups: Setti
   const hasCompany = !!company
   const hasBankingExtension = ENABLED_EXTENSION_IDS.has('enable-banking')
   const hasMcpExtension = ENABLED_EXTENSION_IDS.has('mcp-server')
+  const hasWhatsAppExtension = ENABLED_EXTENSION_IDS.has('whatsapp-inbox')
 
   // Företagsprofil (TIC-snapshot) lives under Företag; Skatteverket under Skatt;
   // assistentens minne + kunskap under Assistenten; säkerhetsbackup under
@@ -58,6 +59,7 @@ export function useSettingsNavItems(): { items: SettingsNavItem[]; groups: Setti
     { id: 'invoicing', href: '/settings/invoicing', label: t('invoicing'), group: 'sales', show: hasCompany },
     { id: 'templates', href: '/settings/templates', label: t('templates'), group: 'sales', show: hasCompany },
     { id: 'banking', href: '/settings/banking', label: t('banking'), group: 'tools', show: hasCompany && !isSandbox && hasBankingExtension },
+    { id: 'whatsapp', href: '/settings/whatsapp', label: t('whatsapp'), group: 'tools', show: hasCompany && !isSandbox && hasWhatsAppExtension },
     { id: 'assistant', href: '/settings/assistant', label: t('assistant'), group: 'tools', show: hasCompany && identity.isVerified },
     { id: 'api', href: '/settings/api', label: t('api'), group: 'tools', show: hasCompany && hasMcpExtension },
   ]