LaLeV/wacrm
1
0
Fork 0
mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
Self-hostable CRM template for WhatsApp — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.
126 Commits 1 Branch 0 Tags 4.6 MiB
TypeScript 93.9%
PLpgSQL 5.6%
CSS 0.3%
be7edfd180
Go to file
Arnas Donauskas be7edfd180
fix(webhook): require META_APP_SECRET, fail closed 
The webhook signature verifier used to fall open with a warning log
when META_APP_SECRET was unset — a deliberate soft-rollout choice that
is unsafe for a public template. A forker who forgets the env var
would be running a fully spoofable webhook: anyone knowing the URL
could POST fabricated status updates and drift broadcast counts.

Now:
- `verifyMetaWebhookSignature` returns false when the secret is missing
  and logs at error level, so the route responds 401 to every POST
  until the operator configures it.
- Docs mark META_APP_SECRET as **required**:
  - docs/environment-variables.md lists it under Required, not
    Recommended.
  - docs/whatsapp-setup.md §6 is now "Signature verification (required)".
  - docs/troubleshooting.md updated accordingly.
- .env.local.example lists the var with guidance on where to find it.

Also fixes a pre-existing gitignore bug: `.env*` was swallowing
`.env.local.example`, which meant forkers running
`cp .env.local.example .env.local` from the getting-started guide
hit "no such file". Added a negation for `*.example`.

Upgrade note for existing deploys: set META_APP_SECRET (Meta → App
Settings → Basic → App Secret) before updating, or inbound webhooks
will 401 until it's configured.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 18:54:52 +03:00
.github chore: require Arnas as reviewer on every PR (CODEOWNERS) 2026-04-19 22:09:10 +03:00
docs fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
public Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
src fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
supabase/migrations feat(settings): user profile management 2026-04-20 17:40:39 +03:00
.env.local.example fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
.gitignore fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
AGENTS.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
CLAUDE.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
components.json feat: initial commit 2026-04-16 17:53:27 +03:00
eslint.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
next.config.ts fix(deploy): Cache-Control headers so CDN stops serving stale HTML 2026-04-17 14:34:46 +03:00
package-lock.json feat(docs): in-app docs viewer at /docs 2026-04-19 21:28:36 +03:00
package.json feat(docs): in-app docs viewer at /docs 2026-04-19 21:28:36 +03:00
postcss.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
README.md docs: end-to-end self-host setup guide 2026-04-19 20:52:08 +03:00
tsconfig.json Initial commit from Create Next App 2026-04-16 17:52:39 +03:00

README.md

WaCRM

Self-hostable WhatsApp CRM — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations — built on Next.js 16 and Supabase.

Quick start

git clone https://github.com/<your-username>/wacrm.git
cd wacrm
npm install
cp .env.local.example .env.local
# Fill in Supabase keys + ENCRYPTION_KEY, then:
npm run dev

Open http://localhost:3000.

For the full setup — Supabase migrations, WhatsApp Business API config, production deploy on Hostinger — see docs/.

Documentation

Stack

  • App — Next.js 16 (App Router), React 19, TypeScript, Tailwind v4.
  • Data — Supabase (Postgres + Auth + RLS).
  • WhatsApp — Meta Cloud API (official WhatsApp Business API).

License

MIT — fork it, brand it, host it. Pull requests welcome.