LaLeV/wacrm
1
0
Fork 0
mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
Self-hostable CRM template for WhatsApp — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.
134 Commits 1 Branch 0 Tags 4.6 MiB
TypeScript 93.9%
PLpgSQL 5.6%
CSS 0.3%
1f295a831a
Go to file
Arnas Donauskas 1f295a831a
security: rate-limit send and broadcast per user 
A fork running WaCRM publicly had no server-side guard on the
WhatsApp send endpoints — a compromised session or an aggressive UI
loop could call /api/whatsapp/send or /broadcast as fast as the
network allowed and blow through Meta's per-number quota (or worse,
get the number suspended).

This PR adds a minimal in-memory fixed-window rate limiter keyed by
user id.

Budgets (tuned for a template default — forkers can edit):
  - /api/whatsapp/send      60 per minute per user  (1/s sustained)
  - /api/whatsapp/broadcast  5 per minute per user  (campaign dispatch
                                                    rate, not fan-out)

Behaviour:
  - Check runs right after the Supabase auth check; unauthenticated
    calls 401 as before and never consume a bucket entry.
  - When a user exceeds the budget the route returns 429 with
    Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining,
    X-RateLimit-Reset headers.
  - Send and broadcast buckets are independent; two users are
    independent.

Design trade-off:
  The limiter lives in a process-local Map. On a single Hostinger
  Managed Node.js instance — the template's default deployment —
  that's the whole limit. On a horizontally-scaled deploy (multiple
  regions, serverless fan-out) each instance has its own Map and the
  effective rate is N * limit. Swap src/lib/rate-limit.ts for a
  Redis/Upstash/Durable-Objects backend if you scale past one
  instance; keep the checkRateLimit return shape and the call sites
  don't move.

Memory is self-cleaning: a 1-in-1000 opportunistic sweep drops
expired keys without a background timer, so the Map stays bounded
without running anything outside the request path.

Smoke test (tsx):
  - 7 broadcasts → 5 ok, 2 denied.
  - Different user → independent bucket.
  - Same user, different route → independent bucket.
  - Retry-after = 60s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 19:48:30 +03:00
.github ci: typecheck + build on every PR 2026-04-20 19:09:32 +03:00
docs fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
public Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
src security: rate-limit send and broadcast per user 2026-04-20 19:48:30 +03:00
supabase/migrations feat(settings): user profile management 2026-04-20 17:40:39 +03:00
.env.local.example fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
.gitignore fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
AGENTS.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
CLAUDE.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
components.json feat: initial commit 2026-04-16 17:53:27 +03:00
eslint.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
next.config.ts security: baseline response headers (CSP report-only + OWASP set) 2026-04-20 19:24:41 +03:00
package-lock.json feat(docs): in-app docs viewer at /docs 2026-04-19 21:28:36 +03:00
package.json ci: typecheck + build on every PR 2026-04-20 19:09:32 +03:00
postcss.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
README.md docs: end-to-end self-host setup guide 2026-04-19 20:52:08 +03:00
tsconfig.json Initial commit from Create Next App 2026-04-16 17:52:39 +03:00

README.md

WaCRM

Self-hostable WhatsApp CRM — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations — built on Next.js 16 and Supabase.

Quick start

git clone https://github.com/<your-username>/wacrm.git
cd wacrm
npm install
cp .env.local.example .env.local
# Fill in Supabase keys + ENCRYPTION_KEY, then:
npm run dev

Open http://localhost:3000.

For the full setup — Supabase migrations, WhatsApp Business API config, production deploy on Hostinger — see docs/.

Documentation

Stack

  • App — Next.js 16 (App Router), React 19, TypeScript, Tailwind v4.
  • Data — Supabase (Postgres + Auth + RLS).
  • WhatsApp — Meta Cloud API (official WhatsApp Business API).

License

MIT — fork it, brand it, host it. Pull requests welcome.