flow_chat 0.4.2 → 0.5.1

data/lib/flow_chat/simulator/controller.rb

@@ -2,6 +2,9 @@ module FlowChat
   module Simulator
     module Controller
       def flowchat_simulator
+        # Set simulator cookie for authentication
+        set_simulator_cookie
+        
         respond_to do |format|
           format.html do
             render inline: simulator_view_template, layout: false, locals: simulator_locals
@@ -27,7 +30,7 @@ module FlowChat
         {
           "ussd" => {
             name: "USSD (Nalo)",
-            description: "Local development USSD testing",
+            description: "USSD integration using Nalo",
             processor_type: "ussd",
             provider: "nalo",
             endpoint: "/ussd",
@@ -39,8 +42,8 @@ module FlowChat
             }
           },
           "whatsapp" => {
-            name: "WhatsApp",
-            description: "Local development WhatsApp testing",
+            name: "WhatsApp (Cloud API)",
+            description: "WhatsApp integration using Cloud API",
             processor_type: "whatsapp",
             provider: "cloud_api",
             endpoint: "/whatsapp/webhook",
@@ -49,8 +52,6 @@ module FlowChat
             settings: {
               phone_number: default_phone_number,
               contact_name: default_contact_name,
-              verify_token: "local_verify_token",
-              webhook_url: "http://localhost:3000/whatsapp/webhook"
             }
           }
         }
@@ -73,6 +74,34 @@ module FlowChat
           configurations: simulator_configurations
         }
       end
+
+      def set_simulator_cookie
+        # Get global simulator secret
+        simulator_secret = FlowChat::Config.simulator_secret
+        
+        unless simulator_secret && !simulator_secret.empty?
+          raise StandardError, "Simulator secret not configured. Please set FlowChat::Config.simulator_secret to enable simulator mode."
+        end
+        
+        # Generate timestamp-based signed cookie
+        timestamp = Time.now.to_i
+        message = "simulator:#{timestamp}"
+        signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), simulator_secret, message)
+        
+        cookie_value = "#{timestamp}:#{signature}"
+        
+        # Set secure cookie (valid for 24 hours)
+        cookies[:flowchat_simulator] = {
+          value: cookie_value,
+          expires: 24.hours.from_now,
+          secure: request.ssl?, # Only send over HTTPS in production
+          httponly: true,       # Prevent XSS access
+          same_site: :lax      # CSRF protection while allowing normal navigation
+        }
+      rescue => e
+        Rails.logger.warn "Failed to set simulator cookie: #{e.message}"
+        raise e # Re-raise the exception so it's not silently ignored
+      end
     end
   end
 end

data/lib/flow_chat/version.rb

@@ -1,3 +1,3 @@
 module FlowChat
-  VERSION = "0.4.2"
+  VERSION = "0.5.1"
 end

data/lib/flow_chat/whatsapp/client.rb

@@ -7,8 +7,6 @@ require "securerandom"
 module FlowChat
   module Whatsapp
     class Client
-      WHATSAPP_API_URL = "https://graph.facebook.com/v18.0"
-
       def initialize(config)
         @config = config
       end
@@ -134,7 +132,7 @@ module FlowChat
         end
 
         # Upload directly via HTTP
-        uri = URI("#{WHATSAPP_API_URL}/#{@config.phone_number_id}/media")
+        uri = URI("#{FlowChat::Config.whatsapp.api_base_url}/#{@config.phone_number_id}/media")
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true
 
@@ -289,7 +287,7 @@ module FlowChat
       # @param media_id [String] Media ID from WhatsApp
       # @return [String] Media URL or nil on error
       def get_media_url(media_id)
-        uri = URI("#{WHATSAPP_API_URL}/#{media_id}")
+        uri = URI("#{FlowChat::Config.whatsapp.api_base_url}/#{media_id}")
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true
 
@@ -389,7 +387,7 @@ module FlowChat
       # @param message_data [Hash] Message payload
       # @return [Hash] API response or nil on error
       def send_message_payload(message_data)
-        uri = URI("#{WHATSAPP_API_URL}/#{@config.phone_number_id}/messages")
+        uri = URI("#{FlowChat::Config.whatsapp.api_base_url}/#{@config.phone_number_id}/messages")
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true
 

data/lib/flow_chat/whatsapp/configuration.rb

@@ -2,7 +2,7 @@ module FlowChat
   module Whatsapp
     class Configuration
       attr_accessor :access_token, :phone_number_id, :verify_token, :app_id, :app_secret,
-        :webhook_url, :webhook_verify_token, :business_account_id, :name
+        :webhook_verify_token, :business_account_id, :name, :skip_signature_validation
 
       # Class-level storage for named configurations
       @@configurations = {}
@@ -14,9 +14,9 @@ module FlowChat
         @verify_token = nil
         @app_id = nil
         @app_secret = nil
-        @webhook_url = nil
         @webhook_verify_token = nil
         @business_account_id = nil
+        @skip_signature_validation = false
 
         register_as(name) if name.present?
       end
@@ -32,8 +32,8 @@ module FlowChat
           config.verify_token = credentials[:verify_token]
           config.app_id = credentials[:app_id]
           config.app_secret = credentials[:app_secret]
-          config.webhook_url = credentials[:webhook_url]
           config.business_account_id = credentials[:business_account_id]
+          config.skip_signature_validation = credentials[:skip_signature_validation] || false
         else
           # Fallback to environment variables
           config.access_token = ENV["WHATSAPP_ACCESS_TOKEN"]
@@ -41,8 +41,8 @@ module FlowChat
           config.verify_token = ENV["WHATSAPP_VERIFY_TOKEN"]
           config.app_id = ENV["WHATSAPP_APP_ID"]
           config.app_secret = ENV["WHATSAPP_APP_SECRET"]
-          config.webhook_url = ENV["WHATSAPP_WEBHOOK_URL"]
           config.business_account_id = ENV["WHATSAPP_BUSINESS_ACCOUNT_ID"]
+          config.skip_signature_validation = ENV["WHATSAPP_SKIP_SIGNATURE_VALIDATION"] == "true"
         end
 
         config
@@ -81,24 +81,25 @@ module FlowChat
       end
 
       def valid?
-        access_token.present? && phone_number_id.present? && verify_token.present?
-      end
-
-      def webhook_configured?
-        webhook_url.present? && verify_token.present?
+        access_token && !access_token.to_s.empty? && phone_number_id && !phone_number_id.to_s.empty? && verify_token && !verify_token.to_s.empty?
       end
 
       # API endpoints
       def messages_url
-        "https://graph.facebook.com/v18.0/#{phone_number_id}/messages"
+        "#{FlowChat::Config.whatsapp.api_base_url}/#{phone_number_id}/messages"
       end
 
       def media_url(media_id)
-        "https://graph.facebook.com/v18.0/#{media_id}"
+        "#{FlowChat::Config.whatsapp.api_base_url}/#{media_id}"
       end
 
       def phone_numbers_url
-        "https://graph.facebook.com/v18.0/#{business_account_id}/phone_numbers"
+        "#{FlowChat::Config.whatsapp.api_base_url}/#{business_account_id}/phone_numbers"
+      end
+
+      # Get API base URL from global config
+      def api_base_url
+        FlowChat::Config.whatsapp.api_base_url
       end
 
       # Headers for API requests

data/lib/flow_chat/whatsapp/gateway/cloud_api.rb

@@ -1,13 +1,15 @@
 require "net/http"
 require "json"
 require "phonelib"
+require "openssl"
 
 module FlowChat
   module Whatsapp
+    # Configuration-related errors
+    class ConfigurationError < StandardError; end
+
     module Gateway
       class CloudApi
-        WHATSAPP_API_URL = "https://graph.facebook.com/v18.0"
-
         def initialize(app, config = nil)
           @app = app
           @config = config || FlowChat::Whatsapp::Configuration.from_credentials
@@ -37,8 +39,8 @@ module FlowChat
         private
 
         def determine_message_handler(context)
-          # Check for simulator parameter in request (highest priority)
-          if context["simulator_mode"] || context.controller.request.params["simulator_mode"]
+          # Check if simulator mode was already detected and set in context
+          if context["simulator_mode"]
             return :simulator
           end
 
@@ -61,15 +63,30 @@ module FlowChat
 
         def handle_webhook(context)
           controller = context.controller
-          body = JSON.parse(controller.request.body.read)
-
-          # Check for simulator mode parameter in request
-          if body.dig("simulator_mode") || controller.request.params["simulator_mode"]
+          
+          # Parse body
+          begin
+            parse_request_body(controller.request)
+          rescue JSON::ParserError => e
+            Rails.logger.warn "Failed to parse webhook body: #{e.message}"
+            return controller.head :bad_request
+          end
+          
+          # Check for simulator mode parameter in request (before validation)
+          # But only enable if valid simulator token is provided
+          is_simulator_mode = simulate?(context)
+          if is_simulator_mode
             context["simulator_mode"] = true
           end
 
+          # Validate webhook signature for security (skip for simulator mode)
+          unless is_simulator_mode || valid_webhook_signature?(controller.request)
+            Rails.logger.warn "Invalid webhook signature received"
+            return controller.head :unauthorized
+          end
+
           # Extract message data from WhatsApp webhook
-          entry = body.dig("entry", 0)
+          entry = @body.dig("entry", 0)
           return controller.head :ok unless entry
 
           changes = entry.dig("changes", 0)
@@ -116,6 +133,57 @@ module FlowChat
           controller.head :ok
         end
 
+        # Validate webhook signature to ensure request comes from WhatsApp
+        def valid_webhook_signature?(request)
+          # Check if signature validation is explicitly disabled
+          if @config.skip_signature_validation
+            return true
+          end
+
+          # Require app_secret for signature validation
+          unless @config.app_secret && !@config.app_secret.empty?
+            raise FlowChat::Whatsapp::ConfigurationError, 
+              "WhatsApp app_secret is required for webhook signature validation. " \
+              "Either configure app_secret or set skip_signature_validation=true to explicitly disable validation."
+          end
+
+          signature_header = request.headers["X-Hub-Signature-256"]
+          return false unless signature_header
+
+          # Extract signature from header (format: "sha256=<signature>")
+          expected_signature = signature_header.sub("sha256=", "")
+
+          # Get raw request body
+          request.body.rewind
+          body = request.body.read
+          request.body.rewind
+
+          # Calculate HMAC signature
+          calculated_signature = OpenSSL::HMAC.hexdigest(
+            OpenSSL::Digest.new("sha256"),
+            @config.app_secret,
+            body
+          )
+
+          # Compare signatures using secure comparison to prevent timing attacks
+          secure_compare(expected_signature, calculated_signature)
+        rescue FlowChat::Whatsapp::ConfigurationError
+          raise
+        rescue => e
+          Rails.logger.error "Error validating webhook signature: #{e.message}"
+          false
+        end
+
+        # Secure string comparison to prevent timing attacks
+        def secure_compare(a, b)
+          return false unless a.bytesize == b.bytesize
+
+          l = a.unpack("C*")
+          res = 0
+          b.each_byte { |byte| res |= byte ^ l.shift }
+          res == 0
+        end
+
         def extract_message_content(message, context)
           case message["type"]
           when "text"
@@ -205,6 +273,50 @@ module FlowChat
             nil
           end
         end
+
+        def simulate?(context)
+          # Check if simulator mode is enabled for this processor
+          return false unless context["enable_simulator"]
+          
+          # Then check if simulator mode is requested and valid
+          @body.dig("simulator_mode") && valid_simulator_cookie?(context)
+        end
+
+        def valid_simulator_cookie?(context)
+          simulator_secret = FlowChat::Config.simulator_secret
+          return false unless simulator_secret && !simulator_secret.empty?
+          
+          # Check for simulator cookie
+          request = context.controller.request
+          simulator_cookie = request.cookies["flowchat_simulator"]
+          return false unless simulator_cookie
+          
+          # Verify the cookie is a valid HMAC signature
+          # Cookie format: "timestamp:signature" where signature = HMAC(simulator_secret, "simulator:timestamp")
+          begin
+            timestamp_str, signature = simulator_cookie.split(":", 2)
+            return false unless timestamp_str && signature
+            
+            # Check timestamp is recent (within 24 hours for reasonable session duration)
+            timestamp = timestamp_str.to_i
+            return false if timestamp <= 0
+            return false if (Time.now.to_i - timestamp).abs > 86400 # 24 hours
+            
+            # Calculate expected signature
+            message = "simulator:#{timestamp_str}"
+            expected_signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), simulator_secret, message)
+            
+            # Use secure comparison
+            secure_compare(signature, expected_signature)
+          rescue => e
+            Rails.logger.warn "Invalid simulator cookie format: #{e.message}"
+            false
+          end
+        end
+
+        def parse_request_body(request)
+          @body ||= JSON.parse(request.body.read)
+        end
       end
     end
   end

data/lib/flow_chat/whatsapp/template_manager.rb

@@ -86,7 +86,7 @@ module FlowChat
       # Create a new template (requires approval from Meta)
       def create_template(name:, category:, language: "en_US", components: [])
         business_account_id = @config.business_account_id
-        uri = URI("https://graph.facebook.com/v18.0/#{business_account_id}/message_templates")
+        uri = URI("#{FlowChat::Config.whatsapp.api_base_url}/#{business_account_id}/message_templates")
 
         template_data = {
           name: name,
@@ -110,7 +110,7 @@ module FlowChat
       # List all templates
       def list_templates
         business_account_id = @config.business_account_id
-        uri = URI("https://graph.facebook.com/v18.0/#{business_account_id}/message_templates")
+        uri = URI("#{FlowChat::Config.whatsapp.api_base_url}/#{business_account_id}/message_templates")
 
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true
@@ -124,7 +124,7 @@ module FlowChat
 
       # Get template status
       def template_status(template_id)
-        uri = URI("https://graph.facebook.com/v18.0/#{template_id}")
+        uri = URI("#{FlowChat::Config.whatsapp.api_base_url}/#{template_id}")
 
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: flow_chat
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.5.1
 platform: ruby
 authors:
 - Stefan Froelich
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-06-04 00:00:00.000000000 Z
+date: 2025-06-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: zeitwerk
@@ -95,11 +95,13 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- SECURITY.md
 - bin/console
 - bin/setup
 - examples/initializer.rb
 - examples/media_prompts_examples.rb
 - examples/multi_tenant_whatsapp_controller.rb
+- examples/simulator_controller.rb
 - examples/ussd_controller.rb
 - examples/whatsapp_controller.rb
 - examples/whatsapp_media_examples.rb