mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 17:29:45 +00:00
c0f390c401
Completes the public API roadmap (#245): register HTTPS endpoints to be POSTed to when things happen in an account, so automations can react to inbound activity instead of polling. - Migration 028: account-scoped webhook_endpoints (secret stored AES-GCM-encrypted) + an atomic record_webhook_failure() function. - Scope webhooks:manage; management API GET/POST /api/v1/webhooks and GET/PATCH/DELETE /api/v1/webhooks/{id} (secret returned once). - Events message.received / conversation.created / message.status_updated dispatched from the inbound webhook handler's after() block. - Signed delivery (X-Wacrm-Signature = HMAC-SHA256 over t.body), single best-effort attempt, auto-disable after consecutive failures. - Versioned 0.4.0; docs/public-api.md Webhooks section; CHANGELOG. Fixes from the adversarial code review of this diff: - SSRF: block private/loopback/link-local (incl. cloud metadata) targets at delivery time + redirect:'manual' so a public URL can't bounce internal (src/lib/webhooks/ssrf.ts). - Status mirror UPDATE no longer uses .select().maybeSingle() (message_id is non-unique); account resolved via a bounded limit(1) read. - Atomic failure counter via SQL RPC (was a racy read-modify-write). - conversation.created emitted before the reaction short-circuit. - Per-delivery id added for receiver dedupe; docs state at-least-once / unordered delivery. - Signature verify tolerates hex case / header whitespace. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 001_initial_schema.sql | ||
| 002_pipelines_enhancements.sql | ||
| 003_broadcast_recipient_wamid.sql | ||
| 004_contact_delete_set_null.sql | ||
| 005_broadcast_counts_incremental.sql | ||
| 006_automations.sql | ||
| 007_automations_increment_counter.sql | ||
| 008_profile_avatars_storage.sql | ||
| 009_message_actions.sql | ||
| 010_flows.sql | ||
| 011_profile_beta_features.sql | ||
| 012_flows_increment_counter.sql | ||
| 013_whatsapp_config_phone_number_id_unique.sql | ||
| 014_message_templates_meta_integration.sql | ||
| 015_whatsapp_config_registration.sql | ||
| 016_flow_media.sql | ||
| 017_account_sharing.sql | ||
| 018_account_member_rpcs.sql | ||
| 019_invitation_rpcs.sql | ||
| 020_account_sharing_followups.sql | ||
| 021_account_default_currency.sql | ||
| 022_contact_phone_dedup.sql | ||
| 023_chat_media.sql | ||
| 024_member_presence.sql | ||
| 025_filter_contacts_by_tags.sql | ||
| 026_api_keys.sql | ||
| 027_notifications.sql | ||
| 028_webhook_endpoints.sql | ||