chat_sdk-whatsapp 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37aa0b2742ef4e9ba92c68df7ad0650b53e427cbe41b9f4c0b387fd479f8bef1
-  data.tar.gz: 3bda0cd18ee75406ad07085e28d7ee61e92af98061a2761c0e8c8847c87a1fa3
+  metadata.gz: 56d2740433f6135cc084664554536e8aada5dadc9784f495e63b744d572bb1b1
+  data.tar.gz: 97cae7132efd2af77e10be202134f1430b0142477912745158294c7d297afc22
 SHA512:
-  metadata.gz: ddc966c4e7597d80cac325cadd8f860fc886f9e47ac8c2647ea395f665505648a2f9633bf8362580507c7e99b969c7bf8cc7736836a3ab10d56cab96cb07c767
-  data.tar.gz: d5977f541e427eb4a68939489004f35eecb407201d4a057f6bc00afb4cbf0b1a5114c313ca21611da4eafd35550aad3ca6f1249b2bf994380887d2d793c6a997
+  metadata.gz: 58f760deb91563a1cd2cec6a32725fbdecf1249ad6116509ac6646321b36d116b0630220553c2b00c6dde71f8eb9583570cc6a02ffe6d9c386c47827091120a2
+  data.tar.gz: 4475cb8cec45232adfe4a1090b08960071a8f041753b2e75d15f977791f35894285e2bd728be042aca550913e89fda9a87d9abadd0af0bc8fe1b700b9797173b

data/lib/chat_sdk/whatsapp/adapter.rb

@@ -6,7 +6,7 @@ module ChatSDK
       include ChatSDK::Adapter::MetaVerification
       include ChatSDK::Adapter::MediaTypes
 
-      capabilities :direct_messages, :file_uploads, :reactions
+      capabilities :direct_messages, :file_uploads, :reactions, :replies, :read_receipts
 
       attr_reader :client
 
@@ -92,10 +92,26 @@ module ChatSDK
         @client.send_template(to: channel_id, template_name: template_name, language_code: language_code, components: components)
       end
 
-      def mark_as_read(message_id:)
+      def mark_as_read(message_id:, channel_id: nil, thread_id: nil, message: nil) # rubocop:disable Lint/UnusedMethodArgument
         @client.mark_as_read(message_id: message_id)
       end
 
+      def reply_message(channel_id:, message_id:, message:, thread_id: nil) # rubocop:disable Lint/UnusedMethodArgument
+        payload = prepare_message_payload(message)
+        payload[:context] = {message_id: message_id}
+        result = @client.send_message(to: channel_id, **payload)
+        parse_whatsapp_message(result, channel_id)
+      end
+
+      def download_media(media_id:)
+        meta = @client.get_media_url(media_id: media_id)
+        url = meta["url"]
+        return nil unless url
+
+        response = @client.download_media(url: url)
+        response.body
+      end
+
       def upload_file(channel_id:, io:, filename:, thread_id: nil, comment: nil) # rubocop:disable Lint/UnusedMethodArgument
         content_type = detect_content_type(filename)
         media_type = media_type_for(content_type)

data/lib/chat_sdk/whatsapp/api_client.rb

@@ -1,9 +1,14 @@
 # frozen_string_literal: true
 
+require "uri"
+
 module ChatSDK
   module WhatsApp
     class ApiClient < ChatSDK::ApiClient::Base
       BASE_URL = "https://graph.facebook.com/v25.0"
+      MEDIA_HOSTS = %w[fbcdn.net fbsbx.com].freeze
+      MEDIA_DOWNLOAD_LIMIT = 25 * 1024 * 1024
+      MEDIA_DOWNLOAD_TIMEOUT = 30
 
       def initialize(access_token, phone_number_id)
         @access_token = access_token
@@ -51,6 +56,19 @@ module ChatSDK
         })
       end
 
+      def get_media_url(media_id:)
+        request(:get, media_id.to_s)
+      end
+
+      def download_media(url:)
+        validate_media_url!(url)
+        Faraday.get(url) do |req|
+          req.headers["Authorization"] = "Bearer #{@access_token}"
+          req.options.timeout = MEDIA_DOWNLOAD_TIMEOUT
+        end
+          .tap { |response| validate_media_response!(response) }
+      end
+
       def upload_media(io:, filename:, content_type:)
         response = upload_connection.post("#{@phone_number_id}/media") do |req|
           req.body = {
@@ -77,6 +95,34 @@ module ChatSDK
         faraday.headers["Authorization"] = "Bearer #{@access_token}"
       end
 
+      def validate_media_url!(url)
+        uri = URI.parse(url)
+        host = uri.host&.downcase
+        graph_origin = URI.parse(BASE_URL)
+        trusted_host = host == graph_origin.host || MEDIA_HOSTS.any? { |allowed| host == allowed || host&.end_with?(".#{allowed}") }
+        trusted = uri.is_a?(URI::HTTPS) && uri.port == 443 && trusted_host
+        return if trusted
+
+        raise ChatSDK::PlatformError.new(
+          "Refusing to send the WhatsApp access token to an untrusted media URL",
+          adapter_name: :whatsapp
+        )
+      rescue URI::InvalidURIError
+        raise ChatSDK::PlatformError.new("Invalid WhatsApp media URL", adapter_name: :whatsapp)
+      end
+
+      def validate_media_response!(response)
+        declared_size = response.headers["content-length"]&.to_i
+        actual_size = response.body.respond_to?(:bytesize) ? response.body.bytesize : 0
+        return if [declared_size, actual_size].compact.max <= MEDIA_DOWNLOAD_LIMIT
+
+        raise ChatSDK::PlatformError.new(
+          "WhatsApp media exceeds the 25 MB download limit",
+          status: response.status,
+          adapter_name: :whatsapp
+        )
+      end
+
       def extract_error_message(response)
         body = response.body
         body.is_a?(Hash) ? body.dig("error", "message") : response.status.to_s

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chat_sdk-whatsapp
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Quentin Rousseau