@adatechnology/meta-whatsapp-module 0.2.0-rc.26 → 0.2.0-rc.28

package/dist/index.cjs

@@ -59,7 +59,7 @@ __export(index_exports, {
   TRANSCRIPTION_STATUS: () => TRANSCRIPTION_STATUS,
   TakeoverConversationUseCase: () => TakeoverConversationUseCase,
   TranscribeAudioUseCase: () => TranscribeAudioUseCase,
-  WEBHOOK_NONCE_TTL_SECONDS: () => WEBHOOK_NONCE_TTL_SECONDS,
+  WEBHOOK_NONCE_TTL_SECONDS: () => import_meta_graph_core2.WEBHOOK_NONCE_TTL_SECONDS,
   WhatsAppChannelAdapter: () => WhatsAppChannelAdapter,
   claimWebhookDelivery: () => claimWebhookDelivery,
   createMetaWhatsAppModule: () => createMetaWhatsAppModule,
@@ -2087,36 +2087,24 @@ var WhatsAppChannelAdapter = class {
 var import_meta_whatsapp_contracts12 = require("@adatechnology/meta-whatsapp-contracts");
 
 // src/channel/webhookSecurity.ts
-var import_node_crypto = require("crypto");
+var import_meta_graph_core2 = require("@adatechnology/meta-graph-core");
 var import_meta_whatsapp_contracts10 = require("@adatechnology/meta-whatsapp-contracts");
-var WEBHOOK_NONCE_TTL_SECONDS = 300;
-function safeEqualStrings(left, right) {
-  const leftDigest = (0, import_node_crypto.createHmac)("sha256", "constant-time-compare").update(left).digest();
-  const rightDigest = (0, import_node_crypto.createHmac)("sha256", "constant-time-compare").update(right).digest();
-  return (0, import_node_crypto.timingSafeEqual)(leftDigest, rightDigest);
-}
-__name(safeEqualStrings, "safeEqualStrings");
+var WEBHOOK_NONCE_NAMESPACE = "meta-whatsapp";
 function verifyWebhookChallenge(params) {
-  if (params.mode !== "subscribe" || !params.token || !params.challenge) {
-    throw new import_meta_whatsapp_contracts10.InvalidWebhookSignatureError();
-  }
-  if (!safeEqualStrings(params.token, params.expectedToken)) {
-    throw new import_meta_whatsapp_contracts10.InvalidWebhookSignatureError();
-  }
+  if (!(0, import_meta_graph_core2.isValidWebhookChallenge)(params)) throw new import_meta_whatsapp_contracts10.InvalidWebhookSignatureError();
   return params.challenge;
 }
 __name(verifyWebhookChallenge, "verifyWebhookChallenge");
 function verifyWebhookSignature(params) {
-  const { rawBody, signatureHeader, appSecret } = params;
-  if (!signatureHeader?.startsWith("sha256=")) throw new import_meta_whatsapp_contracts10.InvalidWebhookSignatureError();
-  const expected = (0, import_node_crypto.createHmac)("sha256", appSecret).update(rawBody).digest("hex");
-  const received = signatureHeader.slice("sha256=".length);
-  if (!safeEqualStrings(received, expected)) throw new import_meta_whatsapp_contracts10.InvalidWebhookSignatureError();
+  if (!(0, import_meta_graph_core2.isValidWebhookSignature)(params)) throw new import_meta_whatsapp_contracts10.InvalidWebhookSignatureError();
 }
 __name(verifyWebhookSignature, "verifyWebhookSignature");
 async function claimWebhookDelivery(params) {
-  const key = `meta-whatsapp:webhook:${params.signatureHeader}`;
-  return params.nonceStore.setIfAbsent(key, params.ttlSeconds ?? WEBHOOK_NONCE_TTL_SECONDS);
+  const key = (0, import_meta_graph_core2.buildWebhookDeliveryKey)({
+    namespace: WEBHOOK_NONCE_NAMESPACE,
+    signatureHeader: params.signatureHeader
+  });
+  return params.nonceStore.setIfAbsent(key, params.ttlSeconds ?? import_meta_graph_core2.WEBHOOK_NONCE_TTL_SECONDS);
 }
 __name(claimWebhookDelivery, "claimWebhookDelivery");
 
@@ -2813,7 +2801,7 @@ async function runMetaWhatsAppMigrations(params) {
 __name(runMetaWhatsAppMigrations, "runMetaWhatsAppMigrations");
 
 // src/realtime/SseHub.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto = require("crypto");
 var TICKET_TTL_SECONDS = 60;
 var SseHub = class {
   static {
@@ -2826,7 +2814,7 @@ var SseHub = class {
   relaySubscriptions = /* @__PURE__ */ new Map();
   // Identifica esta instância do processo para descartar o próprio eco (pub/sub entrega a
   // mensagem a todos os inscritos, inclusive quem publicou).
-  instanceId = (0, import_node_crypto2.randomUUID)();
+  instanceId = (0, import_node_crypto.randomUUID)();
   constructor(relay) {
     this.relay = relay;
   }
@@ -2872,7 +2860,7 @@ var SseHub = class {
   }
 };
 async function issueSseTicket(store, companyId, whatsappNumber) {
-  const ticket = (0, import_node_crypto2.randomUUID)();
+  const ticket = (0, import_node_crypto.randomUUID)();
   await store.set(`sse:ticket:${ticket}`, JSON.stringify({
     companyId,
     whatsappNumber