* fix(whatsapp): make every silent disposition observable, stop pure silence for linked senders (#1552)
Silence was a legitimate outcome in seven places and none left a trace a
support question could be answered from. Now:
- Unknown-sender declines (over quota, quota RPC failure, greeting
throttle) persist content-free trace rows: wamid, phone hash, type,
disposition. No body, media, raw payload, or profile name; capped at
20 rows per hash and day; deleted by the existing 30-day retention.
The wamid dedupe also stops redelivered bad-code/greeting messages
from earning a second reply.
- Linked-sender deliberate silences (muted, stale tap, ignorable type)
record their reason on the skipped row.
- Non-policy silences reply: a row missing its media reference sends
M18 through the link's reply address, a link revoked between arrival
and processing sends the M1 unlinked copy (greeting-throttled).
- Outbound rows keep WHY a send failed (Graph error detail), and Meta
'failed' delivery statuses store their error code and title.
- The WhatsApp settings panel shows the last inbound event (closed
enum, server-derived) and warns when the latest reply never left.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(whatsapp): include errorDetail in typed sendText mock results
SendTextResult gained errorDetail; vi.mocked call sites must match the
widened type or they raise fresh tsc errors over the repo baseline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(whatsapp): review fixes: fail-closed greeting throttle, cap only declined traces
From CodeRabbit's pass on #1563:
- greetingThrottled fails closed when the throttle window cannot be
read, matching the unknown-sender quota's stance.
- The decline-trace day cap applies only to 'skipped' rows (the one
unbounded path); 'done' traces always insert so the wamid dedupe
keeps preventing duplicate M1/M2 replies even past the cap. Their
volume is already bounded upstream by the greeting throttle and the
pre-binding quota.
- company-question test mocks match the widened SendTextResult.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The page had no visual signal that it configures a third-party channel,
so it read like any other Accounted setting. Adds an inline-SVG WhatsApp
mark next to the section title and on the button that opens WhatsApp
(replacing the generic lucide chat bubble, which was standing in for a
logo it is not).
Inline SVG rather than a bundled asset: no network request, scales, and
survives the CSP. SettingsSectionHeader gains an optional `mark` slot;
every other settings tab is untouched and stays mark-less on purpose, so
the rail does not turn into a sticker album. The green is the one place
brand colour appears in settings, which matches the design rule that
colour belongs to actors rather than chrome.
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Webhook lifecycle: GET hub.challenge handshake (constant-time verify-token
compare); POST verifies X-Hub-Signature-256 over the RAW body before any
parse, Zod-parses the envelope, persists inbound rows (partial-unique wamid
= dedupe against Meta's up-to-7-day redelivery), acks 200 fast and defers
media processing via the after() idiom. Rejected and rate-limited content
always acks 200 and lands as skipped/error rows, never a retryable status.
Linking: the settings panel (Installningar -> WhatsApp) mints AC- one-time
codes (sha256 stored, 10 min TTL, single use, ambiguity-free alphabet); the
webhook consumes the code, binds phone to user (HMAC-peppered hash + AES-256-
GCM at rest) and confirms with M3. Keyword commands stopp/start/hjalp;
unknown senders get one throttled M1 greeting (1/h, 3/day) behind the
sender-quota RPC, with no media download and no content persistence.
Intake worker: atomic claim on the message row (the durable job record),
company resolution (default -> sole membership -> M6 fallback, no item),
per-company inbox quota (ack-and-drop, M17 once per 10 min per sender),
MIME allowlist, 10 MB stream-checked media download, exact sha256 duplicate
check, then the shared uploadAndExtract funnel (source 'whatsapp',
channel_context caption, whatsapp_message_id) and the M4 ack with extracted
merchant/total/date. Failures wrap to 'error' + error_message + one M18.
uploadAndExtract widened: source 'whatsapp', optional channelMeta + actorId;
email/upload paths behaviorally unchanged.
Deferred to PR4: burst debounce + combined ack (M5), in-chat company choice
(M6 buttons + 8h pin), clarifying questions M7-M10, interpret-answer LLM
call, sweep cron, retention cron.
Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
