mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 17:29:45 +00:00
be7edfd180
The webhook signature verifier used to fall open with a warning log
when META_APP_SECRET was unset — a deliberate soft-rollout choice that
is unsafe for a public template. A forker who forgets the env var
would be running a fully spoofable webhook: anyone knowing the URL
could POST fabricated status updates and drift broadcast counts.
Now:
- `verifyMetaWebhookSignature` returns false when the secret is missing
and logs at error level, so the route responds 401 to every POST
until the operator configures it.
- Docs mark META_APP_SECRET as **required**:
- docs/environment-variables.md lists it under Required, not
Recommended.
- docs/whatsapp-setup.md §6 is now "Signature verification (required)".
- docs/troubleshooting.md updated accordingly.
- .env.local.example lists the var with guidance on where to find it.
Also fixes a pre-existing gitignore bug: `.env*` was swallowing
`.env.local.example`, which meant forkers running
`cp .env.local.example .env.local` from the getting-started guide
hit "no such file". Added a negation for `*.example`.
Upgrade note for existing deploys: set META_APP_SECRET (Meta → App
Settings → Basic → App Secret) before updating, or inbound webhooks
will 401 until it's configured.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
17 lines
732 B
Plaintext
17 lines
732 B
Plaintext
# Supabase
|
|
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
|
|
|
# Supabase Service Role (for server-side operations like webhook handling)
|
|
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
|
|
|
# WhatsApp Token Encryption (64 hex chars = 32 bytes for AES-256-CBC)
|
|
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
ENCRYPTION_KEY=your-64-char-hex-key-here
|
|
|
|
# Meta App Secret — REQUIRED. Used to verify the HMAC-SHA256 signature
|
|
# Meta attaches to inbound webhook POSTs. Without it, the webhook
|
|
# rejects every request. Find it at:
|
|
# Meta for Developers → your app → App Settings → Basic → App Secret
|
|
META_APP_SECRET=your-meta-app-secret
|