Self-hostable CRM template for WhatsApp — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.
Go to file
Arnas Donauskas dc245d5914
feat(flows): foundation for interactive WhatsApp messages (PR 1/4)
Foundation for the upcoming WhatsApp chatbot flow builder. No runner,
no UI yet — just the plumbing that lets the codebase SEND interactive
messages (button replies + lists) and RECEIVE the taps as structured
message rows. Plan: ~/.claude/plans/understood-research-such-functionality-binary-lake.md

## What's in this PR

### Migration 010_flows.sql
- New tables: flows, flow_nodes, flow_runs, flow_run_events
- Linchpin partial unique index on flow_runs(user_id, contact_id) WHERE status='active' — at most one active run per contact, makes concurrent webhook deliveries idempotent at the DB layer
- Widens messages.content_type CHECK to allow 'interactive'
- New messages.interactive_reply_id column for the tapped button/row id
- RLS on every table; flow_runs added to supabase_realtime publication
- Idempotent throughout — matches the 009_message_actions.sql template

### Interactive Meta senders (src/lib/whatsapp/meta-api.ts)
- sendInteractiveButtons: type='interactive', interactive.type='button', up to 3 reply buttons
- sendInteractiveList: type='interactive', interactive.type='list', up to 10 rows across sections
- Limits exported as INTERACTIVE_LIMITS so flow validation can share the constants
- All Meta caps validated BEFORE the network call (button title ≤20 chars, list row title ≤24 chars, ≤10 total rows, no duplicate row ids, body ≤1024 chars, etc.) — misconfigured flows fail at save time instead of as a customer-facing 400 mid-conversation

### Webhook (src/app/api/whatsapp/webhook/route.ts)
- Extends WhatsAppMessage interface with `interactive?: { type, button_reply?, list_reply? }`
- parseMessageContent returns a new `interactiveReplyId` field; refactored to use a shared `empty` base so every return site picks up the new field without 9 explicit copies
- New `case 'interactive'`: uses the tapped option's TITLE as content_text (so the inbox bubble reads "Existing customer", not a UUID) and stashes the id separately
- 'interactive' added to ALLOWED_CONTENT_TYPES so the messages insert no longer coerces it to 'text'

### Inbox bubble (src/components/inbox/message-bubble.tsx)
- New `case "interactive"` in MessageContent renders the tap with a small "↩ Button reply" affordance so agents reading the inbox can tell at a glance that this was a tap rather than the customer typing the same words

### Types (src/types/index.ts)
- ContentType union extended with 'interactive'
- Message.interactive_reply_id field

### Engine helpers (src/lib/flows/)
- admin-client.ts: thin service-role client wrapper, mirrors automations/admin-client.ts
- meta-send.ts: engineSendInteractiveButtons / engineSendInteractiveList — adapts the Meta senders for service-role use, persists messages with sender_type='bot' content_type='interactive', uses the same phone-variant retry as automations/meta-send.ts. Unused in PR #1; ready for the runner in PR #2

### Tests
- 13 new vitest cases in meta-api.test.ts covering Meta's limit validation + payload-shape assertions for both interactive senders

## Validation
- npm test → 102/102 (was 89; 13 new)
- npm run lint → 0 errors
- npm run typecheck → clean
- npm run build → clean

## What's NOT in this PR
- The runner (dispatchInboundToFlows) — PR #2
- Builder UI / API surface — PR #3
- collect_input / condition / set_tag nodes + templates — PR #4
- react-flow canvas + http_fetch — v2 (PR #5)

## Risks tracked from the plan
- messages.content_type CHECK widening: grep'd every consumer; message-bubble.tsx, reply-quote.tsx, send/route.ts, automations/meta-send.ts all handle the new variant correctly (or accept it as a defaulted fallthrough)
- engineSendText / engineSendInteractive share ~80% of code; deliberately not pre-factored yet — let both stabilize, extract a shared base in PR #2 once the shape settles

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-22 13:12:27 +03:00
.github test: foundational Vitest suite for security + critical pure logic 2026-05-18 16:06:02 +03:00
public feat(inbox): WhatsApp-style doodle background in the chat area 2026-05-22 10:06:34 +03:00
src feat(flows): foundation for interactive WhatsApp messages (PR 1/4) 2026-05-22 13:12:27 +03:00
supabase/migrations feat(flows): foundation for interactive WhatsApp messages (PR 1/4) 2026-05-22 13:12:27 +03:00
.editorconfig chore: contributor experience — CoC, templates, Dependabot, editor configs 2026-04-20 21:16:21 +03:00
.env.local.example chore: OSS metadata + LICENSE + SECURITY + complete env example 2026-04-20 20:41:14 +03:00
.gitignore fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
.prettierignore chore: contributor experience — CoC, templates, Dependabot, editor configs 2026-04-20 21:16:21 +03:00
.prettierrc chore: contributor experience — CoC, templates, Dependabot, editor configs 2026-04-20 21:16:21 +03:00
AGENTS.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
CHANGELOG.md docs: add CHANGELOG with migration-required note 2026-05-19 16:39:16 +03:00
CLAUDE.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
components.json feat: initial commit 2026-04-16 17:53:27 +03:00
CONTRIBUTING.md chore: rename product to "CRM Template for WhatsApp" 2026-05-06 11:52:11 +03:00
eslint.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
LICENSE chore: OSS metadata + LICENSE + SECURITY + complete env example 2026-04-20 20:41:14 +03:00
next.config.ts security: baseline response headers (CSP report-only + OWASP set) 2026-04-20 19:24:41 +03:00
package-lock.json Merge pull request #96 from ArnasDon/dependabot/npm_and_yarn/types-68ebe471cf 2026-05-18 23:10:31 +03:00
package.json Merge pull request #97 from ArnasDon/dependabot/npm_and_yarn/dev-dependencies-4f40fd48be 2026-05-18 23:09:08 +03:00
postcss.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
README.md docs: add Deploy on Hostinger button to README 2026-05-19 17:04:25 +03:00
tsconfig.json Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
vitest.config.ts test: foundational Vitest suite for security + critical pure logic 2026-05-18 16:06:02 +03:00

wacrm — CRM Template for WhatsApp

Self-hostable CRM template for WhatsApp® — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.

Deploy on Hostinger

License: MIT CI Next.js 16 Supabase Stars

The marketing site and self-host docs live in a separate repo: ArnasDon/wacrm-site (wacrm.tech). This repo is the product — clone or fork it to run your own CRM.

What you get out of the box

  • Shared inbox on the official WhatsApp Business API — multiple agents working one number, per-conversation assignment, status, and notes.
  • Contacts + tags + custom fields, CSV import, deduplication.
  • Sales pipelines (Kanban) with deals linked to conversations.
  • Broadcasts with Meta-approved templates, delivery + read tracking, per-recipient variable substitution.
  • No-code automations — triggers on inbound messages, new contacts, keywords, or schedule; conditional branches, waits, tags, webhooks. Visual builder.
  • Real-time dashboard — response times, daily volume, pipeline value, cross-module activity feed.
  • Account management — email, password, avatar, global sign-out.

Why fork this?

This is a template, not a product. Forking means you get:

  • Full ownership — your code, your Supabase project, your domain, your data. No SaaS lock-in, no seat pricing, no trust dance.
  • Full customisation — add the fields your team needs, remove the modules you don't, redesign anything. The stack is boring on purpose (Next.js + Supabase + Tailwind) so the learning curve is short.
  • Zero ops to start — Hostinger Managed Node.js deploys a fork in a few clicks. No Docker, no Kubernetes, no infra team needed.
  • Real security primitives — token encryption (AES-256-GCM), RLS on every table, HMAC-verified webhooks, CSP, rate limiting, CI typecheck/build on every PR.

Not a framework. Not an SDK. A concrete, working CRM you can stand up in an afternoon and make yours.

Quick start

# Fork on GitHub first: https://github.com/ArnasDon/wacrm → Fork
git clone https://github.com/<your-username>/wacrm.git
cd wacrm
npm install
cp .env.local.example .env.local   # fill in Supabase + Meta creds
npm run dev

Open http://localhost:3000. You'll be redirected to /login (or /dashboard if already signed in).

Documentation

Full self-host documentation — Supabase migrations, WhatsApp Business API config, and production deploy — lives at wacrm.tech/docs (source: ArnasDon/wacrm-site).

Key pages:

Stack

  • App — Next.js 16 (App Router), React 19, TypeScript, Tailwind v4.
  • Data — Supabase (Postgres + Auth + Storage + RLS).
  • WhatsApp — Meta Cloud API (official WhatsApp Business API).

Contributing

This is a template, not a collaborative product — the expected flow is fork → customise → deploy, not upstream contribution. Bug reports and security issues are welcome; feature PRs often belong in your fork rather than here. Details in CONTRIBUTING.md and .github/SECURITY.md.

License

MIT. Fork it, brand it, host it.