@hed-hog/core 0.0.386 → 0.0.387

package/dist/webhook-integration/webhook-protocol.registry.d.ts

@@ -0,0 +1,63 @@
+import { Request } from 'express';
+/**
+ * Resposta que um adaptador devolve ao controller público.
+ *
+ * `contentType` existe porque nem todo provedor aceita JSON: o handshake da Meta,
+ * por exemplo, compara o corpo com o challenge literalmente — um envelope JSON
+ * reprova a verificação.
+ */
+export type WebhookProtocolResponse = {
+    status: number;
+    contentType?: string;
+    body: string | object;
+};
+export type WebhookProtocolRequest = {
+    /** O registro de webhook_integration que casou com o uuid da URL. */
+    integration: {
+        id: number;
+        slug: string;
+        integration_profile_id: number | null;
+    };
+    /** Body já parseado (POST) ou query params (GET). */
+    body: unknown;
+    query: Record<string, string>;
+    headers: Record<string, string | string[] | undefined>;
+    /**
+     * Bytes originais da requisição. Obrigatório para validar assinaturas HMAC:
+     * reserializar o JSON reordena chaves e invalida a assinatura.
+     */
+    rawBody?: Buffer;
+    remoteIp: string;
+    req: Request;
+};
+/**
+ * Adaptador de um protocolo de webhook de entrada.
+ *
+ * O framework de webhooks do core é um disparador de ações genérico, autenticado
+ * por token estático. Provedores como a Meta falam um protocolo próprio (handshake
+ * de verificação + assinatura HMAC) que não cabe nesse modelo.
+ *
+ * Em vez de espalhar `if (provider === 'meta')` pelo core, um módulo registra aqui
+ * um adaptador e passa a responder pela mesma URL pública (`/webhook/:uuid`). O core
+ * continua sem conhecer nenhum provedor específico.
+ */
+export interface IWebhookProtocolAdapter {
+    /** GET na URL pública (tipicamente o handshake de verificação). */
+    verify(request: WebhookProtocolRequest): Promise<WebhookProtocolResponse>;
+    /** POST na URL pública (o evento em si). */
+    handle(request: WebhookProtocolRequest): Promise<WebhookProtocolResponse>;
+}
+/**
+ * Registro dos adaptadores de protocolo, no mesmo padrão do QueueHandlerRegistry
+ * e do FiscalProviderRegistry: o módulo dono do protocolo se registra no boot.
+ */
+export declare class WebhookProtocolRegistry {
+    private readonly logger;
+    private readonly adapters;
+    register(protocol: string, adapter: IWebhookProtocolAdapter): void;
+    get(protocol: string | null | undefined): IWebhookProtocolAdapter | null;
+    has(protocol: string | null | undefined): boolean;
+    /** Protocolos registrados (para a UI listar o que existe). */
+    list(): string[];
+}
+//# sourceMappingURL=webhook-protocol.registry.d.ts.map

package/dist/webhook-integration/webhook-protocol.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-protocol.registry.d.ts","sourceRoot":"","sources":["../../src/webhook-integration/webhook-protocol.registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,qEAAqE;IACrE,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;KACvC,CAAC;IACF,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,mEAAmE;IACnE,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1E,4CAA4C;IAC5C,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC3E;AAED;;;GAGG;AACH,qBACa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8C;IAEvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAYlE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,uBAAuB,GAAG,IAAI;IAKxE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAIjD,8DAA8D;IAC9D,IAAI,IAAI,MAAM,EAAE;CAGjB"}

package/dist/webhook-integration/webhook-protocol.registry.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var WebhookProtocolRegistry_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookProtocolRegistry = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Registro dos adaptadores de protocolo, no mesmo padrão do QueueHandlerRegistry
+ * e do FiscalProviderRegistry: o módulo dono do protocolo se registra no boot.
+ */
+let WebhookProtocolRegistry = WebhookProtocolRegistry_1 = class WebhookProtocolRegistry {
+    constructor() {
+        this.logger = new common_1.Logger(WebhookProtocolRegistry_1.name);
+        this.adapters = new Map();
+    }
+    register(protocol, adapter) {
+        const key = normalizeProtocol(protocol);
+        if (!key)
+            throw new Error('Webhook protocol key is required.');
+        if (this.adapters.has(key)) {
+            this.logger.warn(`Webhook protocol "${key}" was overwritten.`);
+        }
+        this.adapters.set(key, adapter);
+        this.logger.log(`Registered webhook protocol "${key}"`);
+    }
+    get(protocol) {
+        var _a;
+        const key = normalizeProtocol(protocol);
+        return key ? ((_a = this.adapters.get(key)) !== null && _a !== void 0 ? _a : null) : null;
+    }
+    has(protocol) {
+        return this.get(protocol) !== null;
+    }
+    /** Protocolos registrados (para a UI listar o que existe). */
+    list() {
+        return [...this.adapters.keys()].sort();
+    }
+};
+exports.WebhookProtocolRegistry = WebhookProtocolRegistry;
+exports.WebhookProtocolRegistry = WebhookProtocolRegistry = WebhookProtocolRegistry_1 = __decorate([
+    (0, common_1.Injectable)()
+], WebhookProtocolRegistry);
+function normalizeProtocol(protocol) {
+    return String(protocol !== null && protocol !== void 0 ? protocol : '').trim().toLowerCase();
+}
+//# sourceMappingURL=webhook-protocol.registry.js.map

package/dist/webhook-integration/webhook-protocol.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-protocol.registry.js","sourceRoot":"","sources":["../../src/webhook-integration/webhook-protocol.registry.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAoD;AAsDpD;;;GAGG;AAEI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAA7B;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAClD,aAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IA2BzE,CAAC;IAzBC,QAAQ,CAAC,QAAgB,EAAE,OAAgC;QACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAE/D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,oBAAoB,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,GAAG,CAAC,QAAmC;;QACrC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,GAAG,CAAC,QAAmC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IACrC,CAAC;IAED,8DAA8D;IAC9D,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AA7BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CA6BnC;AAED,SAAS,iBAAiB,CAAC,QAAmC;IAC5D,OAAO,MAAM,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC"}

package/hedhog/frontend/app/integration/profiles/page.tsx.ejs

@@ -48,7 +48,8 @@ import {
   TableRow,
 } from '@/components/ui/table';
 import { TableBodySkeleton } from '@/components/ui/skeletons';
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
+import { Tabs, TabsContent } from '@/components/ui/tabs';
+import { TabsOverflowList } from '@/components/ui/tabs-overflow-list';
 import { usePagination } from '@/hooks/use-pagination';
 import { formatDate } from '@/lib/format-date';
 import { useApp } from '@hed-hog/next-app-provider';
@@ -696,13 +697,20 @@ export default function IntegrationProfilesPage() {
       />
 
       <Tabs value={activeTab} onValueChange={setActiveTab}>
-        <TabsList>
-          {types.map((ty) => (
-            <TabsTrigger key={ty.slug} value={ty.slug}>
-              {getLocaleName(ty.integration_type_locale, currentLocaleCode)}
-            </TabsTrigger>
-          ))}
-        </TabsList>
+        {/* Colapsa as abas que não cabem num dropdown "Mais": há muitos tipos de
+            integração e em telas estreitas os TabsTrigger crus encolhiam e se
+            sobrepunham. triggerClassName replica o padding do TabsTrigger nos
+            spans de medição invisíveis do TabsOverflowList. */}
+        <TabsOverflowList
+          items={types.map((ty) => ({
+            value: ty.slug,
+            label: getLocaleName(ty.integration_type_locale, currentLocaleCode),
+          }))}
+          activeValue={activeTab}
+          onValueChange={setActiveTab}
+          moreLabel={t('tabsMore')}
+          triggerClassName="min-h-8 px-3 text-sm font-medium"
+        />
 
         {types.map((ty) => (
           <TabsContent key={ty.slug} value={ty.slug} className="mt-4">

package/hedhog/frontend/messages/en.json

@@ -2339,6 +2339,7 @@
     "title": "Integration Profiles",
     "description": "Manage credentials and connection settings for email, messaging, storage, AI, OAuth, and payment providers.",
     "searchPlaceholder": "Search profiles by name or slug...",
+    "tabsMore": "More",
     "selectProfile": "Select profile",
     "selectAllVisible": "Select all visible profiles",
     "newProfile": "New Profile",
@@ -2432,6 +2433,27 @@
     "fieldPhoneNumberId": "Phone Number ID",
     "fieldAccessToken": "Access Token",
     "fieldBusinessId": "Business ID",
+    "fieldAppId": "Meta App ID",
+    "fieldAppSecret": "Meta App Secret",
+    "fieldWabaId": "WhatsApp Business Account ID (WABA)",
+    "fieldVerifyToken": "Webhook Verify Token",
+    "fieldGraphApiVersion": "Graph API Version",
+    "fieldEnvironmentTest": "Test",
+    "fieldEnvironmentProduction": "Production",
+    "copiedToClipboard": "Copied to clipboard",
+    "whatsappWebhookSectionTitle": "Meta Webhook",
+    "whatsappWebhookDescription": "Register this webhook in your Meta app to receive WhatsApp messages.",
+    "whatsappWebhookCallbackUrlLabel": "Callback URL",
+    "whatsappWebhookVerifyTokenLabel": "Verify Token",
+    "whatsappWebhookVerifyTokenHint": "Use the same value you set in the Verify Token field above.",
+    "whatsappWebhookLoading": "Generating URL…",
+    "whatsappWebhookUnavailable": "URL unavailable — check the API base URL setting.",
+    "whatsappWebhookSaveFirst": "Save the profile to generate the webhook URL.",
+    "whatsappWebhookStepsTitle": "In the Meta dashboard (WhatsApp → Configuration):",
+    "whatsappWebhookStep1": "Paste the Callback URL and the Verify Token above.",
+    "whatsappWebhookStep2": "Click \"Verify and save\".",
+    "whatsappWebhookStep3": "Subscribe to the \"messages\" field.",
+    "whatsappWebhookStep4": "Send a test message and confirm it arrives.",
     "fieldBasePath": "Base Path",
     "fieldBucket": "Bucket",
     "fieldProjectId": "Project ID",

package/hedhog/frontend/messages/pt.json

@@ -2394,6 +2394,7 @@
     "title": "Perfis de Integração",
     "description": "Gerencie credenciais para provedores de e-mail, mensagens, armazenamento, IA, OAuth e pagamentos.",
     "searchPlaceholder": "Buscar perfis por nome ou slug...",
+    "tabsMore": "Mais",
     "selectProfile": "Selecionar perfil",
     "selectAllVisible": "Selecionar todos os perfis visíveis",
     "newProfile": "Novo Perfil",
@@ -2487,6 +2488,27 @@
     "fieldPhoneNumberId": "ID do Número de Telefone",
     "fieldAccessToken": "Access Token",
     "fieldBusinessId": "Business ID",
+    "fieldAppId": "Meta App ID",
+    "fieldAppSecret": "Meta App Secret",
+    "fieldWabaId": "ID da Conta do WhatsApp Business (WABA)",
+    "fieldVerifyToken": "Verify Token do Webhook",
+    "fieldGraphApiVersion": "Versão da Graph API",
+    "fieldEnvironmentTest": "Teste",
+    "fieldEnvironmentProduction": "Produção",
+    "copiedToClipboard": "Copiado para a área de transferência",
+    "whatsappWebhookSectionTitle": "Webhook da Meta",
+    "whatsappWebhookDescription": "Registre este webhook no seu app da Meta para receber mensagens do WhatsApp.",
+    "whatsappWebhookCallbackUrlLabel": "URL de Callback",
+    "whatsappWebhookVerifyTokenLabel": "Verify Token",
+    "whatsappWebhookVerifyTokenHint": "Use o mesmo valor que você definiu no campo Verify Token acima.",
+    "whatsappWebhookLoading": "Gerando URL…",
+    "whatsappWebhookUnavailable": "URL indisponível — verifique a configuração de URL base da API.",
+    "whatsappWebhookSaveFirst": "Salve o perfil para gerar a URL do webhook.",
+    "whatsappWebhookStepsTitle": "No painel da Meta (WhatsApp → Configuração):",
+    "whatsappWebhookStep1": "Cole a URL de Callback e o Verify Token acima.",
+    "whatsappWebhookStep2": "Clique em \"Verificar e salvar\".",
+    "whatsappWebhookStep3": "Assine o campo \"messages\".",
+    "whatsappWebhookStep4": "Envie uma mensagem de teste e confirme que ela chega.",
     "fieldBasePath": "Caminho Base",
     "fieldBucket": "Bucket",
     "fieldProjectId": "Project ID",

package/hedhog/table/webhook_integration.yaml

@@ -1,43 +1,64 @@
-columns:
-  - type: pk
-  - type: slug
-  - name: name
-    type: varchar
-    length: 127
-  - name: description
-    type: text
-    isNullable: true
-  - name: public_uuid
-    type: varchar
-    length: 36
-  - name: status
-    type: enum
-    enum:
-      - active
-      - inactive
-    default: active
-  - name: require_token
-    type: boolean
-    default: false
-  - name: token_hash
-    type: varchar
-    length: 128
-    isNullable: true
-  - name: allowed_ips
-    type: json
-    isNullable: true
-  - name: body_schema
-    type: json
-    isNullable: true
-  - type: created_at
-  - type: updated_at
-indices:
-  - columns:
-      - slug
-    isUnique: true
-  - columns:
-      - public_uuid
-    isUnique: true
-  - columns:
-      - status
-
+columns:
+  - type: pk
+  - type: slug
+  - name: name
+    type: varchar
+    length: 127
+  - name: description
+    type: text
+    isNullable: true
+  - name: public_uuid
+    type: varchar
+    length: 36
+  - name: status
+    type: enum
+    enum:
+      - active
+      - inactive
+    default: active
+  - name: require_token
+    type: boolean
+    default: false
+  - name: token_hash
+    type: varchar
+    length: 128
+    isNullable: true
+  - name: allowed_ips
+    type: json
+    isNullable: true
+  - name: body_schema
+    type: json
+    isNullable: true
+  # Protocolo de entrada. Nulo = webhook clássico (token + actions). Preenchido,
+  # a chamada é delegada ao adaptador registrado por outro módulo no
+  # WebhookProtocolRegistry (ex.: 'meta-whatsapp'), que faz a própria autenticação.
+  - name: protocol
+    type: varchar
+    length: 63
+    isNullable: true
+  # Perfil que guarda as credenciais do protocolo (ex.: o app_secret que assina o
+  # HMAC). Nulo nos webhooks clássicos, que não têm provedor por trás.
+  - name: integration_profile_id
+    type: fk
+    isNullable: true
+    references:
+      table: integration_profile
+      column: id
+      onDelete: CASCADE
+      onUpdate: CASCADE
+  - type: created_at
+  - type: updated_at
+indices:
+  - columns:
+      - slug
+    isUnique: true
+  - columns:
+      - public_uuid
+    isUnique: true
+  - columns:
+      - status
+  - columns:
+      - protocol
+  - columns:
+      - integration_profile_id
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.386",
+  "version": "0.0.387",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,12 +41,12 @@
     "speakeasy": "^2.0.0",
     "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
-    "@hed-hog/api-mail": "0.0.9",
-    "@hed-hog/api-types": "0.0.1",
     "@hed-hog/api-prisma": "0.0.6",
-    "@hed-hog/api": "0.0.8",
+    "@hed-hog/api-types": "0.0.1",
+    "@hed-hog/api-mail": "0.0.9",
+    "@hed-hog/api-pagination": "0.0.7",
     "@hed-hog/api-locale": "0.0.14",
-    "@hed-hog/api-pagination": "0.0.7"
+    "@hed-hog/api": "0.0.8"
   },
   "exports": {
     ".": {

package/src/auth/auth.controller.ts

@@ -16,6 +16,7 @@ import {
   UseGuards
 } from '@nestjs/common';
 import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
+import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import { TokenService } from '../token/token.service';
 import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
 import { UserService } from '../user/user.service';
@@ -206,7 +207,7 @@ export class AuthController {
     @Locale() locale: string,
     @Body() { mfaToken }: { mfaToken: string },
     @Headers('origin') origin: string
-  ) {
+  ): Promise<PublicKeyCredentialRequestOptionsJSON> {
     return this.service.generateWebAuthnAuthenticationOptions(locale, mfaToken, origin);
   }
 

package/src/auth/auth.service.ts

@@ -1,6 +1,7 @@
 import { getLocaleText } from '@hed-hog/api-locale';
 import { PrismaService } from '@hed-hog/api-prisma';
 import { User } from '@hed-hog/api-types';
+import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import {
   BadRequestException,
   forwardRef,
@@ -890,7 +891,7 @@ export class AuthService {
     };
   }
 
-  async generateWebAuthnAuthenticationOptions(locale: string, mfaToken: string, requestOrigin?: string) {
+  async generateWebAuthnAuthenticationOptions(locale: string, mfaToken: string, requestOrigin?: string): Promise<PublicKeyCredentialRequestOptionsJSON> {
     const { generateAuthenticationOptions } = await import('@simplewebauthn/server');
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
 

package/src/index.ts

@@ -45,6 +45,7 @@ export * from './webhook-integration/event-webhook.service';
 export * from './webhook-integration/integration-event-catalog.service';
 export * from './webhook-integration/webhook-integration.module';
 export * from './webhook-integration/webhook-integration.service';
+export * from './webhook-integration/webhook-protocol.registry';
 
 // Integration Module
 export * from './integration/integration.module';

package/src/integration-profile/integration-profile.secrets.ts

@@ -22,7 +22,9 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   resend: ['api_token', 'webhook_secret'],
   // Mensageria
   'evolution-api': ['token'],
-  'whatsapp-official': ['access_token'],
+  // app_secret assina o HMAC do webhook (X-Hub-Signature-256) e verify_token é
+  // comparado no handshake da Meta: quem tem qualquer um dos dois forja eventos.
+  'whatsapp-official': ['access_token', 'app_secret', 'verify_token'],
   // Storage
   s3: ['secret_access_key'],
   gcs: ['key_file_json'],

package/src/integration-profile/integration-profile.service.ts

@@ -9,7 +9,10 @@ import {
   forwardRef,
 } from '@nestjs/common';
 import * as pako from 'pako';
-import { buildMailConfigFromIntegration } from './integration-profile.utils';
+import {
+  buildMailConfigFromIntegration,
+  buildWhatsappOfficialConfigFromIntegration,
+} from './integration-profile.utils';
 import { CreateDTO } from './dto/create.dto';
 import {
   ConflictResolutionDTO,
@@ -451,9 +454,10 @@ export class IntegrationProfileService {
       );
     }
 
-    if (provider.integration_type.slug !== 'email') {
+    const typeSlug = provider.integration_type.slug;
+    if (typeSlug !== 'email' && typeSlug !== 'whatsapp') {
       throw new BadRequestException(
-        'Integration profile test is only available for email type.',
+        'Integration profile test is only available for email and whatsapp types.',
       );
     }
 
@@ -472,6 +476,14 @@ export class IntegrationProfileService {
       ) as Record<string, unknown>;
     }
 
+    if (typeSlug === 'whatsapp') {
+      return this.testWhatsappProfile(
+        provider.slug,
+        data.slug.trim(),
+        effectiveConfig,
+      );
+    }
+
     // Resend não usa SMTP/from_email: valida credenciais/domínio próprios.
     if (provider.slug === 'resend') {
       const resendCfg = (effectiveConfig as Record<string, unknown> | null) ?? {};
@@ -508,6 +520,101 @@ export class IntegrationProfileService {
     };
   }
 
+  /**
+   * Valida um perfil whatsapp-official contra a Graph API (lê o WABA com o token)
+   * e registra o resultado no config. Nunca devolve o token/secret na resposta.
+   */
+  private async testWhatsappProfile(
+    providerSlug: string,
+    slug: string,
+    effectiveConfig: Record<string, unknown> | null,
+  ) {
+    if (providerSlug !== 'whatsapp-official') {
+      throw new BadRequestException(
+        `Integration profile test is not available for provider "${providerSlug}".`,
+      );
+    }
+
+    const cfg = buildWhatsappOfficialConfigFromIntegration(effectiveConfig);
+
+    if (!cfg.accessToken) {
+      throw new BadRequestException('WhatsApp access token is required.');
+    }
+    if (!cfg.wabaId) {
+      throw new BadRequestException('WhatsApp Business Account ID is required.');
+    }
+    if (!cfg.appSecret) {
+      throw new BadRequestException(
+        'Meta App Secret is required to validate webhook signatures.',
+      );
+    }
+    if (!cfg.verifyToken) {
+      throw new BadRequestException('Webhook verify token is required.');
+    }
+
+    const url = `https://graph.facebook.com/${cfg.graphApiVersion}/${encodeURIComponent(
+      cfg.wabaId,
+    )}?fields=id,name`;
+
+    let name = '';
+    let failure: string | null = null;
+    try {
+      const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${cfg.accessToken}` },
+      });
+      const body = (await response.json().catch(() => ({}))) as {
+        name?: string;
+        error?: { message?: string };
+      };
+      if (!response.ok) {
+        // A mensagem da Meta não contém o token; ainda assim só propagamos o texto dela.
+        failure =
+          body?.error?.message ?? `Graph API returned HTTP ${response.status}.`;
+      } else {
+        name = String(body?.name ?? '');
+      }
+    } catch (error) {
+      failure = error instanceof Error ? error.message : 'Graph API is unreachable.';
+    }
+
+    await this.recordWhatsappValidation(providerSlug, slug, failure);
+
+    if (failure) {
+      throw new BadRequestException(`WhatsApp validation failed: ${failure}`);
+    }
+
+    return { success: true, destination: name || cfg.wabaId };
+  }
+
+  /** Grava metadados (não-secretos) da última validação no config do perfil. */
+  private async recordWhatsappValidation(
+    providerSlug: string,
+    slug: string,
+    failure: string | null,
+  ) {
+    const stored = await this.prismaService.integration_profile.findUnique({
+      where: { slug },
+      select: { id: true, config: true },
+    });
+    // Perfil ainda não salvo (teste no fluxo de criação): nada a registrar.
+    if (!stored) return;
+
+    // `stored.config` vem decifrado pelo middleware; recifra-mos ao gravar.
+    const plain = {
+      ...((stored.config as Record<string, unknown>) ?? {}),
+      last_validated_at: new Date().toISOString(),
+      last_validation_status: failure ? 'error' : 'ok',
+      last_error: failure ?? null,
+    };
+
+    await this.prismaService.integration_profile.update({
+      where: { id: stored.id },
+      data: {
+        config: this.credentialCrypto.encryptConfig(providerSlug, plain) as object,
+      },
+    });
+  }
+
   async exportProfiles({
     ids,
     includeSecrets = false,

package/src/integration-profile/integration-profile.utils.spec.ts

@@ -12,6 +12,8 @@ import {
   buildDigitalOceanConfigFromIntegration,
   buildKubernetesConfigFromIntegration,
   buildAiConfigFromIntegration,
+  buildWhatsappOfficialConfigFromIntegration,
+  DEFAULT_GRAPH_API_VERSION,
 } from './integration-profile.utils';
 
 describe('integration-profile.utils', () => {
@@ -329,4 +331,77 @@ describe('integration-profile.utils', () => {
       );
     });
   });
+
+  describe('buildWhatsappOfficialConfigFromIntegration', () => {
+    const fullConfig = {
+      app_id: '123456',
+      app_secret: 'secret',
+      business_id: 'BIZ',
+      waba_id: 'WABA',
+      access_token: 'token',
+      graph_api_version: 'v22.0',
+      verify_token: 'verify',
+      environment: 'test',
+    };
+
+    it('mapeia todos os campos do perfil', () => {
+      expect(buildWhatsappOfficialConfigFromIntegration(fullConfig)).toEqual({
+        appId: '123456',
+        appSecret: 'secret',
+        businessId: 'BIZ',
+        wabaId: 'WABA',
+        accessToken: 'token',
+        graphApiVersion: 'v22.0',
+        verifyToken: 'verify',
+        environment: 'test',
+      });
+    });
+
+    it('assume a versão default da Graph API quando ausente ou vazia', () => {
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({ ...fullConfig, graph_api_version: '' })
+          .graphApiVersion,
+      ).toBe(DEFAULT_GRAPH_API_VERSION);
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({}).graphApiVersion,
+      ).toBe(DEFAULT_GRAPH_API_VERSION);
+    });
+
+    it('assume production quando o ambiente não é "test"', () => {
+      // Default seguro: um ambiente inválido não deve virar sandbox silenciosamente.
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({ environment: 'qualquer' })
+          .environment,
+      ).toBe('production');
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({}).environment,
+      ).toBe('production');
+    });
+
+    it('omite business_id quando não informado (é opcional)', () => {
+      const result = buildWhatsappOfficialConfigFromIntegration({});
+      expect(result.businessId).toBeUndefined();
+    });
+
+    it('não quebra com config nulo e devolve campos vazios', () => {
+      expect(buildWhatsappOfficialConfigFromIntegration(null)).toMatchObject({
+        appId: '',
+        appSecret: '',
+        wabaId: '',
+        accessToken: '',
+        verifyToken: '',
+      });
+    });
+
+    it('remove espaços em volta dos segredos (copiar/colar do painel da Meta)', () => {
+      const result = buildWhatsappOfficialConfigFromIntegration({
+        access_token: '  token  ',
+        app_secret: ' secret ',
+        verify_token: ' verify ',
+      });
+      expect(result.accessToken).toBe('token');
+      expect(result.appSecret).toBe('secret');
+      expect(result.verifyToken).toBe('verify');
+    });
+  });
 });