chat_sdk-whatsapp 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 597bcaeccc068737954a05d9a71894f5b5dcdc5398ef51634658c90461f9aa75
-  data.tar.gz: 23942bc33cb539a45e9e3519dba9a88eb788c17e886ecb8cdf406d712c887c24
+  metadata.gz: 56d2740433f6135cc084664554536e8aada5dadc9784f495e63b744d572bb1b1
+  data.tar.gz: 97cae7132efd2af77e10be202134f1430b0142477912745158294c7d297afc22
 SHA512:
-  metadata.gz: 8f0c5680bbb226b46b3921e75d581ad613cf170085abd8edc5d0819cf03ca6fd67d1ef613eb9fec96e8620b61e90ee1c9b3dfb6bffc4c1df4e50c5c1ced67d42
-  data.tar.gz: 2254a8b5bcfc1ce79545e489a6289c82a50ae1b475e6cb5e765b5a24f2535ed3914edf4a55c9dbcd036fa5d9e857ba925ab0c03cc1670114fef9fcd6e449c03f
+  metadata.gz: 58f760deb91563a1cd2cec6a32725fbdecf1249ad6116509ac6646321b36d116b0630220553c2b00c6dde71f8eb9583570cc6a02ffe6d9c386c47827091120a2
+  data.tar.gz: 4475cb8cec45232adfe4a1090b08960071a8f041753b2e75d15f977791f35894285e2bd728be042aca550913e89fda9a87d9abadd0af0bc8fe1b700b9797173b

data/lib/chat_sdk/whatsapp/adapter.rb

@@ -6,7 +6,7 @@ module ChatSDK
       include ChatSDK::Adapter::MetaVerification
       include ChatSDK::Adapter::MediaTypes
 
-      capabilities :direct_messages, :file_uploads, :reactions
+      capabilities :direct_messages, :file_uploads, :reactions, :replies, :read_receipts
 
       attr_reader :client
 
@@ -92,10 +92,17 @@ module ChatSDK
         @client.send_template(to: channel_id, template_name: template_name, language_code: language_code, components: components)
       end
 
-      def mark_as_read(message_id:)
+      def mark_as_read(message_id:, channel_id: nil, thread_id: nil, message: nil) # rubocop:disable Lint/UnusedMethodArgument
         @client.mark_as_read(message_id: message_id)
       end
 
+      def reply_message(channel_id:, message_id:, message:, thread_id: nil) # rubocop:disable Lint/UnusedMethodArgument
+        payload = prepare_message_payload(message)
+        payload[:context] = {message_id: message_id}
+        result = @client.send_message(to: channel_id, **payload)
+        parse_whatsapp_message(result, channel_id)
+      end
+
       def download_media(media_id:)
         meta = @client.get_media_url(media_id: media_id)
         url = meta["url"]

data/lib/chat_sdk/whatsapp/api_client.rb

@@ -1,9 +1,14 @@
 # frozen_string_literal: true
 
+require "uri"
+
 module ChatSDK
   module WhatsApp
     class ApiClient < ChatSDK::ApiClient::Base
       BASE_URL = "https://graph.facebook.com/v25.0"
+      MEDIA_HOSTS = %w[fbcdn.net fbsbx.com].freeze
+      MEDIA_DOWNLOAD_LIMIT = 25 * 1024 * 1024
+      MEDIA_DOWNLOAD_TIMEOUT = 30
 
       def initialize(access_token, phone_number_id)
         @access_token = access_token
@@ -56,9 +61,12 @@ module ChatSDK
       end
 
       def download_media(url:)
+        validate_media_url!(url)
         Faraday.get(url) do |req|
           req.headers["Authorization"] = "Bearer #{@access_token}"
+          req.options.timeout = MEDIA_DOWNLOAD_TIMEOUT
         end
+          .tap { |response| validate_media_response!(response) }
       end
 
       def upload_media(io:, filename:, content_type:)
@@ -87,6 +95,34 @@ module ChatSDK
         faraday.headers["Authorization"] = "Bearer #{@access_token}"
       end
 
+      def validate_media_url!(url)
+        uri = URI.parse(url)
+        host = uri.host&.downcase
+        graph_origin = URI.parse(BASE_URL)
+        trusted_host = host == graph_origin.host || MEDIA_HOSTS.any? { |allowed| host == allowed || host&.end_with?(".#{allowed}") }
+        trusted = uri.is_a?(URI::HTTPS) && uri.port == 443 && trusted_host
+        return if trusted
+
+        raise ChatSDK::PlatformError.new(
+          "Refusing to send the WhatsApp access token to an untrusted media URL",
+          adapter_name: :whatsapp
+        )
+      rescue URI::InvalidURIError
+        raise ChatSDK::PlatformError.new("Invalid WhatsApp media URL", adapter_name: :whatsapp)
+      end
+
+      def validate_media_response!(response)
+        declared_size = response.headers["content-length"]&.to_i
+        actual_size = response.body.respond_to?(:bytesize) ? response.body.bytesize : 0
+        return if [declared_size, actual_size].compact.max <= MEDIA_DOWNLOAD_LIMIT
+
+        raise ChatSDK::PlatformError.new(
+          "WhatsApp media exceeds the 25 MB download limit",
+          status: response.status,
+          adapter_name: :whatsapp
+        )
+      end
+
       def extract_error_message(response)
         body = response.body
         body.is_a?(Hash) ? body.dig("error", "message") : response.status.to_s

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chat_sdk-whatsapp
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Quentin Rousseau