chat_sdk-whatsapp 1.0.1 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 597bcaeccc068737954a05d9a71894f5b5dcdc5398ef51634658c90461f9aa75
-  data.tar.gz: 23942bc33cb539a45e9e3519dba9a88eb788c17e886ecb8cdf406d712c887c24
+  metadata.gz: d3aae7e3166ec158db8bb11d3a5fbd88e6df312846caf3208ba154ffbd65c200
+  data.tar.gz: 99c40c41b5cb2677c56add71a5717c18b8d91fcc3725b579e81e58f537d55186
 SHA512:
-  metadata.gz: 8f0c5680bbb226b46b3921e75d581ad613cf170085abd8edc5d0819cf03ca6fd67d1ef613eb9fec96e8620b61e90ee1c9b3dfb6bffc4c1df4e50c5c1ced67d42
-  data.tar.gz: 2254a8b5bcfc1ce79545e489a6289c82a50ae1b475e6cb5e765b5a24f2535ed3914edf4a55c9dbcd036fa5d9e857ba925ab0c03cc1670114fef9fcd6e449c03f
+  metadata.gz: 9848398b73448697e4432c5a669607a151823c479021e825558d73b1be6e48cae051be2572c9501d3f9060b95e9b38223082cc942e76cd9464261dd4432b7bb6
+  data.tar.gz: 0b5d5837929611cd82558baffdcace85decc3ed2dac403f5a32c1bc10c0c465d3002644a29be7e8a5b105c8e7c3a422010c74ddbf10208a5636d9c595e79cd9a

data/lib/chat_sdk/whatsapp/adapter.rb

@@ -6,7 +6,7 @@ module ChatSDK
       include ChatSDK::Adapter::MetaVerification
       include ChatSDK::Adapter::MediaTypes
 
-      capabilities :direct_messages, :file_uploads, :reactions
+      capabilities :direct_messages, :file_uploads, :reactions, :replies, :read_receipts
 
       attr_reader :client
 
@@ -44,19 +44,20 @@ module ChatSDK
       end
 
       # Outbound
-      def post_message(channel_id:, message:, thread_id: nil) # rubocop:disable Lint/UnusedMethodArgument
+      def post_message(channel_id:, message:, thread_id: nil)
+        phone_number_id = outbound_phone_number_id(channel_id, thread_id)
         payload = prepare_message_payload(message)
 
         result = if payload[:type] == "text" && payload.dig(:text, :body)
           chunks = split_message(payload[:text][:body])
           chunks.reduce(nil) do |_, chunk|
-            @client.send_message(to: channel_id, type: "text", text: {body: chunk})
+            @client.send_message(to: channel_id, type: "text", phone_number_id: phone_number_id, text: {body: chunk})
           end
         else
-          @client.send_message(to: channel_id, **payload)
+          @client.send_message(to: channel_id, phone_number_id: phone_number_id, **payload)
         end
 
-        parse_whatsapp_message(result, channel_id)
+        parse_whatsapp_message(result, channel_id, phone_number_id: phone_number_id)
       end
 
       def self.template_components(header: nil, body_params: [], button_payloads: [])
@@ -88,12 +89,30 @@ module ChatSDK
         components
       end
 
-      def post_template(channel_id:, template_name:, language_code: "en", components: nil)
-        @client.send_template(to: channel_id, template_name: template_name, language_code: language_code, components: components)
+      def post_template(channel_id:, template_name:, language_code: "en", components: nil, thread_id: nil)
+        phone_number_id = outbound_phone_number_id(channel_id, thread_id)
+        @client.send_template(
+          to: channel_id,
+          template_name: template_name,
+          language_code: language_code,
+          components: components,
+          phone_number_id: phone_number_id
+        )
+      end
+
+      def mark_as_read(message_id:, channel_id: nil, thread_id: nil, message: nil) # rubocop:disable Lint/UnusedMethodArgument
+        @client.mark_as_read(
+          message_id: message_id,
+          phone_number_id: outbound_phone_number_id(channel_id, thread_id)
+        )
       end
 
-      def mark_as_read(message_id:)
-        @client.mark_as_read(message_id: message_id)
+      def reply_message(channel_id:, message_id:, message:, thread_id: nil)
+        phone_number_id = outbound_phone_number_id(channel_id, thread_id)
+        payload = prepare_message_payload(message)
+        payload[:context] = {message_id: message_id}
+        result = @client.send_message(to: channel_id, phone_number_id: phone_number_id, **payload)
+        parse_whatsapp_message(result, channel_id, phone_number_id: phone_number_id)
       end
 
       def download_media(media_id:)
@@ -105,27 +124,48 @@ module ChatSDK
         response.body
       end
 
-      def upload_file(channel_id:, io:, filename:, thread_id: nil, comment: nil) # rubocop:disable Lint/UnusedMethodArgument
+      def upload_file(channel_id:, io:, filename:, thread_id: nil, comment: nil)
+        phone_number_id = outbound_phone_number_id(channel_id, thread_id)
         content_type = detect_content_type(filename)
         media_type = media_type_for(content_type)
 
         # Upload media first
-        media_result = @client.upload_media(io: io, filename: filename, content_type: content_type)
+        media_result = @client.upload_media(
+          io: io,
+          filename: filename,
+          content_type: content_type,
+          phone_number_id: phone_number_id
+        )
         media_id = media_result["id"]
 
         # Send media message
         media_payload = {caption: comment}.compact
-        result = @client.send_message(to: channel_id, type: media_type, **{media_type => media_payload.merge(id: media_id)})
+        result = @client.send_message(
+          to: channel_id,
+          type: media_type,
+          phone_number_id: phone_number_id,
+          **{media_type => media_payload.merge(id: media_id)}
+        )
 
-        parse_whatsapp_message(result, channel_id)
+        parse_whatsapp_message(result, channel_id, phone_number_id: phone_number_id)
       end
 
-      def add_reaction(channel_id:, message_id:, emoji:)
-        @client.send_reaction(to: channel_id, message_id: message_id, emoji: emoji)
+      def add_reaction(channel_id:, message_id:, emoji:, thread_id: nil)
+        @client.send_reaction(
+          to: channel_id,
+          message_id: message_id,
+          emoji: emoji,
+          phone_number_id: outbound_phone_number_id(channel_id, thread_id)
+        )
       end
 
-      def remove_reaction(channel_id:, message_id:, emoji: "") # rubocop:disable Lint/UnusedMethodArgument
-        @client.send_reaction(to: channel_id, message_id: message_id, emoji: "")
+      def remove_reaction(channel_id:, message_id:, emoji: "", thread_id: nil) # rubocop:disable Lint/UnusedMethodArgument
+        @client.send_reaction(
+          to: channel_id,
+          message_id: message_id,
+          emoji: "",
+          phone_number_id: outbound_phone_number_id(channel_id, thread_id)
+        )
       end
 
       def open_dm(user_id)
@@ -179,7 +219,7 @@ module ChatSDK
         end
       end
 
-      def parse_whatsapp_message(data, channel_id)
+      def parse_whatsapp_message(data, channel_id, phone_number_id: @phone_number_id)
         message_id = data.dig("messages", 0, "id")
 
         ChatSDK::Message.new(
@@ -191,12 +231,28 @@ module ChatSDK
             platform: :whatsapp,
             bot: true
           ),
-          thread_id: "whatsapp:#{@phone_number_id}:#{channel_id}",
+          thread_id: "whatsapp:#{phone_number_id}:#{channel_id}",
           channel_id: channel_id,
           platform: :whatsapp,
           raw: data
         )
       end
+
+      def outbound_phone_number_id(channel_id, thread_id)
+        return @phone_number_id unless thread_id
+
+        match = thread_id.match(/\Awhatsapp:([^:]+):(.+)\z/) if thread_id.is_a?(String)
+        phone_number_id = match && match[1]
+        unless phone_number_id&.match?(/\A\d+\z/)
+          raise ChatSDK::Error, "Invalid WhatsApp phone number ID in thread ID: #{thread_id.inspect}"
+        end
+
+        unless channel_id.nil? || match[2] == channel_id.to_s
+          raise ChatSDK::Error, "WhatsApp thread recipient does not match channel ID: #{thread_id.inspect}"
+        end
+
+        phone_number_id
+      end
     end
   end
 end

data/lib/chat_sdk/whatsapp/api_client.rb

@@ -1,16 +1,21 @@
 # frozen_string_literal: true
 
+require "uri"
+
 module ChatSDK
   module WhatsApp
     class ApiClient < ChatSDK::ApiClient::Base
       BASE_URL = "https://graph.facebook.com/v25.0"
+      MEDIA_HOSTS = %w[fbcdn.net fbsbx.com].freeze
+      MEDIA_DOWNLOAD_LIMIT = 25 * 1024 * 1024
+      MEDIA_DOWNLOAD_TIMEOUT = 30
 
       def initialize(access_token, phone_number_id)
         @access_token = access_token
         @phone_number_id = phone_number_id
       end
 
-      def send_message(to:, type:, **payload)
+      def send_message(to:, type:, phone_number_id: @phone_number_id, **payload)
         body = {
           "messaging_product" => "whatsapp",
           "recipient_type" => "individual",
@@ -18,18 +23,19 @@ module ChatSDK
           "type" => type
         }.merge(payload)
 
-        request(:post, "#{@phone_number_id}/messages", body)
+        request(:post, "#{phone_number_id}/messages", body)
       end
 
-      def send_reaction(to:, message_id:, emoji:)
+      def send_reaction(to:, message_id:, emoji:, phone_number_id: @phone_number_id)
         send_message(
           to: to,
           type: "reaction",
+          phone_number_id: phone_number_id,
           reaction: {message_id: message_id, emoji: emoji}
         )
       end
 
-      def send_template(to:, template_name:, language_code: "en", components: nil)
+      def send_template(to:, template_name:, language_code: "en", components: nil, phone_number_id: @phone_number_id)
         body = {
           "messaging_product" => "whatsapp",
           "to" => to,
@@ -40,11 +46,11 @@ module ChatSDK
           }
         }
         body["template"]["components"] = components if components
-        request(:post, "#{@phone_number_id}/messages", body)
+        request(:post, "#{phone_number_id}/messages", body)
       end
 
-      def mark_as_read(message_id:)
-        request(:post, "#{@phone_number_id}/messages", {
+      def mark_as_read(message_id:, phone_number_id: @phone_number_id)
+        request(:post, "#{phone_number_id}/messages", {
           "messaging_product" => "whatsapp",
           "status" => "read",
           "message_id" => message_id
@@ -56,13 +62,16 @@ module ChatSDK
       end
 
       def download_media(url:)
+        validate_media_url!(url)
         Faraday.get(url) do |req|
           req.headers["Authorization"] = "Bearer #{@access_token}"
+          req.options.timeout = MEDIA_DOWNLOAD_TIMEOUT
         end
+          .tap { |response| validate_media_response!(response) }
       end
 
-      def upload_media(io:, filename:, content_type:)
-        response = upload_connection.post("#{@phone_number_id}/media") do |req|
+      def upload_media(io:, filename:, content_type:, phone_number_id: @phone_number_id)
+        response = upload_connection.post("#{phone_number_id}/media") do |req|
           req.body = {
             "messaging_product" => "whatsapp",
             "file" => Faraday::Multipart::FilePart.new(io, content_type, filename),
@@ -87,6 +96,34 @@ module ChatSDK
         faraday.headers["Authorization"] = "Bearer #{@access_token}"
       end
 
+      def validate_media_url!(url)
+        uri = URI.parse(url)
+        host = uri.host&.downcase
+        graph_origin = URI.parse(BASE_URL)
+        trusted_host = host == graph_origin.host || MEDIA_HOSTS.any? { |allowed| host == allowed || host&.end_with?(".#{allowed}") }
+        trusted = uri.is_a?(URI::HTTPS) && uri.port == 443 && trusted_host
+        return if trusted
+
+        raise ChatSDK::PlatformError.new(
+          "Refusing to send the WhatsApp access token to an untrusted media URL",
+          adapter_name: :whatsapp
+        )
+      rescue URI::InvalidURIError
+        raise ChatSDK::PlatformError.new("Invalid WhatsApp media URL", adapter_name: :whatsapp)
+      end
+
+      def validate_media_response!(response)
+        declared_size = response.headers["content-length"]&.to_i
+        actual_size = response.body.respond_to?(:bytesize) ? response.body.bytesize : 0
+        return if [declared_size, actual_size].compact.max <= MEDIA_DOWNLOAD_LIMIT
+
+        raise ChatSDK::PlatformError.new(
+          "WhatsApp media exceeds the 25 MB download limit",
+          status: response.status,
+          adapter_name: :whatsapp
+        )
+      end
+
       def extract_error_message(response)
         body = response.body
         body.is_a?(Hash) ? body.dig("error", "message") : response.status.to_s

data/lib/chat_sdk/whatsapp/event_parser.rb

@@ -11,14 +11,21 @@ module ChatSDK
           (payload["entry"] || [])
             .flat_map { |entry| entry["changes"] || [] }
             .select { |change| change["field"] == "messages" }
-            .flat_map { |change| change.dig("value", "messages") || [] }
-            .filter_map { |msg| parse_message(msg, phone_number_id) }
+            .flat_map do |change|
+              value = change["value"] || {}
+              contacts = value["contacts"] || []
+              (value["messages"] || []).filter_map do |msg|
+                contact = contact_for(msg, contacts)
+                parse_message(msg, phone_number_id, contact)
+              end
+            end
         end
 
         private
 
-        def parse_message(msg, phone_number_id)
-          from = msg["from"]&.to_s
+        def parse_message(msg, phone_number_id, contact)
+          from = first_present(msg["from"], msg["wa_id"], contact&.dig("wa_id"),
+            msg["from_user_id"], contact&.dig("user_id"))
           return nil unless from
 
           author = ChatSDK::Author.new(id: from, name: from, platform: :whatsapp, bot: false)
@@ -36,6 +43,16 @@ module ChatSDK
           end
         end
 
+        def contact_for(message, contacts)
+          from = message["from"].to_s
+          contacts.find { |contact| contact["wa_id"].to_s == from } ||
+            (contacts.first if contacts.length == 1)
+        end
+
+        def first_present(*values)
+          values.map { |value| value&.to_s }.find { |value| value && !value.empty? }
+        end
+
         def parse_reaction_message(msg, from, thread_id)
           reaction = msg["reaction"] || {}
           emoji = reaction["emoji"] || ""

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chat_sdk-whatsapp
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.2.0
 platform: ruby
 authors:
 - Quentin Rousseau
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement