Self-hostable CRM template for WhatsApp — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.
Go to file
Arnas Donauskas 14cdbf457b
feat(ui): role-aware gating sweep + account-name in sidebar
PR 9 of the multi-user accounts series — the final piece. Visual
polish so non-owners see consistent disabled states across the
app and so every user always knows which account they're acting in.

Sidebar
- New account-name strip above the user dropdown, gated behind
  the `account_sharing` beta flag (same flag the Members tab
  from PR 6 reads). For solo users (the default) the account is
  named after them, so showing it would just duplicate the user
  name below — flag-gating keeps the original layout untouched
  for single-user installs.
- When the caller's role is admin/agent/viewer (not owner), the
  role is surfaced as a small uppercase chip alongside the
  account name so they have an unambiguous signal of their
  permission level without opening Settings.
- Nav items stay always-visible per the planning doc's
  "show-but-disable" decision — hiding nav rows by role would
  make the app feel broken.

Inbox composer
- Send button + Templates button + textarea are disabled for
  viewers with a "Read-only — viewers can browse but not reply"
  placeholder and tooltip. The existing session-expired branch
  still wins when it applies (session-expired is the more
  specific condition and surfaces template-only sending).

List-page create buttons
- broadcasts/page.tsx: "New Broadcast" CTA (header + empty
  state).
- automations/page.tsx: "Create Automation" CTA.
- flows/page.tsx: "New flow" CTA (header + empty-state).
- contacts/page.tsx: "Add Contact" + "Import" CTAs.
- pipelines/page.tsx: "Add Pipeline" (gates on edit-settings —
  pipelines are settings-class under the 017 RLS) and "Add
  Deal" (gates on send-messages).

All use `useCan(...)` from PR 5. Disabled buttons get a tooltip
explaining why (`title="Read-only — your role can't ..."`).
Solo users see no visual change — single-owner accounts pass
every capability check.

Why show-but-disable, not hide
- A viewer scanning the app should still see what's possible
  in the product, both to understand what they can ask for an
  upgrade for and to avoid the UI feeling silently broken
  ("the New button just disappeared?"). The tooltip carries
  the explanation cheaply.

Verification
- `npm run lint`      → 0 errors (same 19 pre-existing warnings)
- `npm run typecheck` → clean
- `npm test`          → 366/366 pass
- `npm run build`     → succeeds

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-31 19:02:14 +03:00
.github test: foundational Vitest suite for security + critical pure logic 2026-05-18 16:06:02 +03:00
public feat(inbox): WhatsApp-style doodle background in the chat area 2026-05-22 10:06:34 +03:00
src feat(ui): role-aware gating sweep + account-name in sidebar 2026-05-31 19:02:14 +03:00
supabase/migrations feat(api): invitation create + peek + redeem endpoints 2026-05-31 17:32:46 +03:00
.editorconfig chore: contributor experience — CoC, templates, Dependabot, editor configs 2026-04-20 21:16:21 +03:00
.env.local.example feat(templates): submit-to-Meta endpoint + component-based form builder 2026-05-29 15:34:58 +02:00
.gitignore fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
.prettierignore chore: contributor experience — CoC, templates, Dependabot, editor configs 2026-04-20 21:16:21 +03:00
.prettierrc chore: contributor experience — CoC, templates, Dependabot, editor configs 2026-04-20 21:16:21 +03:00
AGENTS.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
CHANGELOG.md feat(ui): role-aware gating sweep + account-name in sidebar 2026-05-31 19:02:14 +03:00
CLAUDE.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
components.json feat: initial commit 2026-04-16 17:53:27 +03:00
CONTRIBUTING.md chore: rename product to "CRM Template for WhatsApp" 2026-05-06 11:52:11 +03:00
eslint.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
LICENSE chore: OSS metadata + LICENSE + SECURITY + complete env example 2026-04-20 20:41:14 +03:00
next.config.ts security: baseline response headers (CSP report-only + OWASP set) 2026-04-20 19:24:41 +03:00
package-lock.json feat(dashboard): adopt Tremor for charts — first integration 2026-05-31 14:42:10 +03:00
package.json feat(dashboard): adopt Tremor for charts — first integration 2026-05-31 14:42:10 +03:00
postcss.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
README.md docs: add Deploy on Hostinger button to README 2026-05-19 17:04:25 +03:00
tsconfig.json Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
vitest.config.ts test: foundational Vitest suite for security + critical pure logic 2026-05-18 16:06:02 +03:00

wacrm — CRM Template for WhatsApp

Self-hostable CRM template for WhatsApp® — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.

Deploy on Hostinger

License: MIT CI Next.js 16 Supabase Stars

The marketing site and self-host docs live in a separate repo: ArnasDon/wacrm-site (wacrm.tech). This repo is the product — clone or fork it to run your own CRM.

What you get out of the box

  • Shared inbox on the official WhatsApp Business API — multiple agents working one number, per-conversation assignment, status, and notes.
  • Contacts + tags + custom fields, CSV import, deduplication.
  • Sales pipelines (Kanban) with deals linked to conversations.
  • Broadcasts with Meta-approved templates, delivery + read tracking, per-recipient variable substitution.
  • No-code automations — triggers on inbound messages, new contacts, keywords, or schedule; conditional branches, waits, tags, webhooks. Visual builder.
  • Real-time dashboard — response times, daily volume, pipeline value, cross-module activity feed.
  • Account management — email, password, avatar, global sign-out.

Why fork this?

This is a template, not a product. Forking means you get:

  • Full ownership — your code, your Supabase project, your domain, your data. No SaaS lock-in, no seat pricing, no trust dance.
  • Full customisation — add the fields your team needs, remove the modules you don't, redesign anything. The stack is boring on purpose (Next.js + Supabase + Tailwind) so the learning curve is short.
  • Zero ops to start — Hostinger Managed Node.js deploys a fork in a few clicks. No Docker, no Kubernetes, no infra team needed.
  • Real security primitives — token encryption (AES-256-GCM), RLS on every table, HMAC-verified webhooks, CSP, rate limiting, CI typecheck/build on every PR.

Not a framework. Not an SDK. A concrete, working CRM you can stand up in an afternoon and make yours.

Quick start

# Fork on GitHub first: https://github.com/ArnasDon/wacrm → Fork
git clone https://github.com/<your-username>/wacrm.git
cd wacrm
npm install
cp .env.local.example .env.local   # fill in Supabase + Meta creds
npm run dev

Open http://localhost:3000. You'll be redirected to /login (or /dashboard if already signed in).

Documentation

Full self-host documentation — Supabase migrations, WhatsApp Business API config, and production deploy — lives at wacrm.tech/docs (source: ArnasDon/wacrm-site).

Key pages:

Stack

  • App — Next.js 16 (App Router), React 19, TypeScript, Tailwind v4.
  • Data — Supabase (Postgres + Auth + Storage + RLS).
  • WhatsApp — Meta Cloud API (official WhatsApp Business API).

Contributing

This is a template, not a collaborative product — the expected flow is fork → customise → deploy, not upstream contribution. Bug reports and security issues are welcome; feature PRs often belong in your fork rather than here. Details in CONTRIBUTING.md and .github/SECURITY.md.

License

MIT. Fork it, brand it, host it.