398c734b93
Webhook lifecycle: GET hub.challenge handshake (constant-time verify-token compare); POST verifies X-Hub-Signature-256 over the RAW body before any parse, Zod-parses the envelope, persists inbound rows (partial-unique wamid = dedupe against Meta's up-to-7-day redelivery), acks 200 fast and defers media processing via the after() idiom. Rejected and rate-limited content always acks 200 and lands as skipped/error rows, never a retryable status. Linking: the settings panel (Installningar -> WhatsApp) mints AC- one-time codes (sha256 stored, 10 min TTL, single use, ambiguity-free alphabet); the webhook consumes the code, binds phone to user (HMAC-peppered hash + AES-256- GCM at rest) and confirms with M3. Keyword commands stopp/start/hjalp; unknown senders get one throttled M1 greeting (1/h, 3/day) behind the sender-quota RPC, with no media download and no content persistence. Intake worker: atomic claim on the message row (the durable job record), company resolution (default -> sole membership -> M6 fallback, no item), per-company inbox quota (ack-and-drop, M17 once per 10 min per sender), MIME allowlist, 10 MB stream-checked media download, exact sha256 duplicate check, then the shared uploadAndExtract funnel (source 'whatsapp', channel_context caption, whatsapp_message_id) and the M4 ack with extracted merchant/total/date. Failures wrap to 'error' + error_message + one M18. uploadAndExtract widened: source 'whatsapp', optional channelMeta + actorId; email/upload paths behaviorally unchanged. Deferred to PR4: burst debounce + combined ack (M5), in-chat company choice (M6 buttons + 8h pin), clarifying questions M7-M10, interpret-answer LLM call, sweep cron, retention cron. Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
28 lines
1.1 KiB
JSON
28 lines
1.1 KiB
JSON
{
|
|
"id": "whatsapp-inbox",
|
|
"sector": "general",
|
|
"exportName": "whatsappInboxExtension",
|
|
"entryPoint": "@/extensions/general/whatsapp-inbox",
|
|
"workspace": null,
|
|
"requiredEnvVars": [
|
|
"WHATSAPP_ACCESS_TOKEN",
|
|
"WHATSAPP_PHONE_NUMBER_ID",
|
|
"WHATSAPP_APP_SECRET",
|
|
"WHATSAPP_VERIFY_TOKEN",
|
|
"WHATSAPP_PHONE_HASH_KEY",
|
|
"WHATSAPP_PHONE_ENCRYPTION_KEY"
|
|
],
|
|
"optionalEnvVars": ["WHATSAPP_PUBLIC_NUMBER"],
|
|
"npmDependencies": [],
|
|
"definition": {
|
|
"name": "WhatsApp-inkorg",
|
|
"category": "import",
|
|
"icon": "MessageCircle",
|
|
"dataPattern": "both",
|
|
"hasOwnData": true,
|
|
"readsCoreTables": ["company_members", "document_attachments", "invoice_inbox_items"],
|
|
"description": "Skicka kvitton som foto eller PDF till Accounteds WhatsApp-nummer: de landar i Underlag med avlästa fält",
|
|
"longDescription": "Koppla ditt mobilnummer med en engångskod och skicka sedan kvitton direkt i WhatsApp. Varje kvitto laddas upp till dokumentarkivet, fält som belopp och datum läses av med AI, och du får en bekräftelse i chatten. Bokföringen sker som vanligt i appen."
|
|
}
|
|
}
|