elevenlabs-webhook-nodejs 1.0.0

package/nestjs/src/users/users.service.ts

@@ -0,0 +1,250 @@
+import {
+  Injectable,
+  ConflictException,
+  NotFoundException,
+  ForbiddenException,
+  Logger,
+} from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+import { PrismaService } from '../database/prisma.service';
+import { InviteUserDto, UpdateUserDto, UpdateClinicAssignmentsDto } from './dto';
+
+const BCRYPT_ROUNDS = 12;
+
+@Injectable()
+export class UsersService {
+  private readonly logger = new Logger(UsersService.name);
+
+  constructor(private readonly prisma: PrismaService) {}
+
+  /* ------------------------------------------------------------------ */
+  /*  LIST USERS                                                         */
+  /* ------------------------------------------------------------------ */
+
+  async findAll(tenantId: string, clinicIds?: string[]) {
+    // If clinicIds provided and non-empty, filter to users who share at least one clinic
+    const where: any = { user_tenant_id: tenantId };
+
+    if (clinicIds && clinicIds.length > 0) {
+      where.clinic_assignments = {
+        some: { assign_clinic_id: { in: clinicIds } },
+      };
+    }
+
+    const users = await this.prisma.user.findMany({
+      where,
+      include: {
+        clinic_assignments: {
+          include: { clinic: true },
+        },
+      },
+      orderBy: { user_created_at: 'desc' },
+    });
+
+    return users.map((u) => this.formatUser(u));
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  FIND BY ID                                                         */
+  /* ------------------------------------------------------------------ */
+
+  async findById(userId: string, tenantId: string) {
+    const user = await this.prisma.user.findFirst({
+      where: { user_id: userId, user_tenant_id: tenantId },
+      include: {
+        clinic_assignments: {
+          include: { clinic: true },
+        },
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    return this.formatUser(user);
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  INVITE                                                              */
+  /* ------------------------------------------------------------------ */
+
+  async invite(tenantId: string, dto: InviteUserDto) {
+    // Check email uniqueness
+    const existing = await this.prisma.user.findUnique({
+      where: { user_email: dto.email },
+    });
+    if (existing) {
+      throw new ConflictException('Email already in use');
+    }
+
+    const passwordHash = await bcrypt.hash(dto.password, BCRYPT_ROUNDS);
+
+    const user = await this.prisma.$transaction(async (tx) => {
+      const created = await tx.user.create({
+        data: {
+          user_tenant_id: tenantId,
+          user_email: dto.email,
+          user_password_hash: passwordHash,
+          user_role: dto.role,
+          user_first_name: dto.firstName,
+          user_last_name: dto.lastName,
+          user_phone: dto.phone ?? null,
+        },
+      });
+
+      // Create clinic assignments
+      if (dto.clinicIds?.length) {
+        await tx.userClinicAssignment.createMany({
+          data: dto.clinicIds.map((clinicId) => ({
+            assign_user_id: created.user_id,
+            assign_clinic_id: clinicId,
+          })),
+        });
+      }
+
+      return tx.user.findUnique({
+        where: { user_id: created.user_id },
+        include: {
+          clinic_assignments: {
+            include: { clinic: true },
+          },
+        },
+      });
+    });
+
+    this.logger.log(`User invited: ${dto.email} (role=${dto.role}) in tenant ${tenantId}`);
+
+    return this.formatUser(user!);
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  UPDATE                                                              */
+  /* ------------------------------------------------------------------ */
+
+  async update(userId: string, tenantId: string, dto: UpdateUserDto, currentUserId: string) {
+    // Can't change own role
+    if (dto.role && userId === currentUserId) {
+      throw new ForbiddenException('Cannot change your own role');
+    }
+
+    const user = await this.prisma.user.findFirst({
+      where: { user_id: userId, user_tenant_id: tenantId },
+    });
+
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    const data: any = {};
+    if (dto.firstName !== undefined) data.user_first_name = dto.firstName;
+    if (dto.lastName !== undefined) data.user_last_name = dto.lastName;
+    if (dto.role !== undefined) data.user_role = dto.role;
+    if (dto.phone !== undefined) data.user_phone = dto.phone;
+    if (dto.isActive !== undefined) data.user_is_active = dto.isActive;
+    if (dto.customPermissions !== undefined) data.user_custom_permissions = dto.customPermissions;
+
+    const updated = await this.prisma.user.update({
+      where: { user_id: userId },
+      data,
+      include: {
+        clinic_assignments: {
+          include: { clinic: true },
+        },
+      },
+    });
+
+    return this.formatUser(updated);
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  UPDATE CLINIC ASSIGNMENTS                                          */
+  /* ------------------------------------------------------------------ */
+
+  async updateClinicAssignments(userId: string, dto: UpdateClinicAssignmentsDto) {
+    // Verify user exists
+    const user = await this.prisma.user.findUnique({
+      where: { user_id: userId },
+    });
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    await this.prisma.$transaction(async (tx) => {
+      // Delete existing assignments
+      await tx.userClinicAssignment.deleteMany({
+        where: { assign_user_id: userId },
+      });
+
+      // Create new assignments
+      if (dto.clinicIds.length > 0) {
+        await tx.userClinicAssignment.createMany({
+          data: dto.clinicIds.map((clinicId) => ({
+            assign_user_id: userId,
+            assign_clinic_id: clinicId,
+          })),
+        });
+      }
+    });
+
+    const updated = await this.prisma.user.findUnique({
+      where: { user_id: userId },
+      include: {
+        clinic_assignments: {
+          include: { clinic: true },
+        },
+      },
+    });
+
+    return this.formatUser(updated!);
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  REMOVE (soft delete)                                                */
+  /* ------------------------------------------------------------------ */
+
+  async remove(userId: string, tenantId: string) {
+    const user = await this.prisma.user.findFirst({
+      where: { user_id: userId, user_tenant_id: tenantId },
+    });
+
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    await this.prisma.user.update({
+      where: { user_id: userId },
+      data: { user_is_active: false },
+    });
+
+    return { message: 'User deactivated' };
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  PRIVATE HELPERS                                                     */
+  /* ------------------------------------------------------------------ */
+
+  private formatUser(user: any) {
+    return {
+      id: user.user_id,
+      email: user.user_email,
+      firstName: user.user_first_name,
+      lastName: user.user_last_name,
+      role: user.user_role,
+      phone: user.user_phone,
+      isActive: user.user_is_active,
+      customPermissions: Array.isArray(user.user_custom_permissions)
+        ? user.user_custom_permissions
+        : [],
+      lastLoginAt: user.user_last_login_at,
+      createdAt: user.user_created_at,
+      updatedAt: user.user_updated_at,
+      clinics: user.clinic_assignments?.map((a: any) => ({
+        id: a.clinic.clinic_id,
+        name: a.clinic.clinic_name,
+        slug: a.clinic.clinic_slug,
+        isDefault: a.clinic.clinic_is_default,
+      })) ?? [],
+    };
+  }
+}

package/nestjs/src/webhooks/elevenlabs-tool.controller.ts

@@ -0,0 +1,66 @@
+import {
+  Controller,
+  Post,
+  Param,
+  Body,
+  Headers,
+  Logger,
+  UnauthorizedException,
+  NotFoundException,
+} from '@nestjs/common';
+import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { ConfigService } from '@nestjs/config';
+import { AgentsService } from '../agents/agents.service';
+
+@ApiTags('Webhooks')
+@Controller('webhooks/elevenlabs/tools')
+export class ElevenLabsToolController {
+  private readonly logger = new Logger(ElevenLabsToolController.name);
+
+  constructor(
+    private readonly configService: ConfigService,
+    private readonly agentsService: AgentsService,
+  ) {}
+
+  /* ------------------------------------------------------------------ */
+  /*  POST /webhooks/elevenlabs/tools/:toolName                          */
+  /* ------------------------------------------------------------------ */
+
+  @Post(':toolName')
+  @ApiOperation({ summary: 'ElevenLabs tool call during voice call' })
+  async handleToolCall(
+    @Param('toolName') toolName: string,
+    @Headers('x-api-key') apiKey: string,
+    @Body() body: Record<string, any>,
+  ) {
+    // Validate API key
+    const secret = this.configService.get<string>('ELEVENLABS_WEBHOOK_SECRET');
+    if (!apiKey || apiKey !== secret) {
+      throw new UnauthorizedException('Invalid API key');
+    }
+
+    // Resolve tenant from agent_id
+    const agentId = body.agent_id;
+    if (!agentId) {
+      throw new NotFoundException('agent_id is required in request body');
+    }
+
+    let agent: any;
+    try {
+      agent = await this.agentsService.findByElevenlabsId(agentId);
+    } catch {
+      throw new NotFoundException(`Agent not found for ElevenLabs ID: ${agentId}`);
+    }
+
+    this.logger.log(
+      `Tool call: ${toolName} (agent=${agent.agent_id}, tenant=${agent.agent_tenant_id})`,
+    );
+
+    // TODO: Implement individual tool handlers
+    // Each toolName maps to a specific handler:
+    //   check_availability, reserve_slot, list_reservations,
+    //   cancel_reservation, reschedule_reservation,
+    //   check_patient_history, confirm_appointment_validation
+    return { result: 'not_implemented' };
+  }
+}

package/nestjs/src/webhooks/elevenlabs-webhook.controller.ts

@@ -0,0 +1,60 @@
+import {
+  Controller,
+  Post,
+  Req,
+  Logger,
+  BadRequestException,
+} from '@nestjs/common';
+import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
+import { InjectQueue } from '@nestjs/bullmq';
+import { Queue } from 'bullmq';
+
+@ApiTags('Webhooks')
+@Controller('webhooks/elevenlabs')
+export class ElevenLabsWebhookController {
+  private readonly logger = new Logger(ElevenLabsWebhookController.name);
+
+  constructor(
+    @InjectQueue('elevenlabs-webhook')
+    private readonly webhookQueue: Queue,
+  ) {}
+
+  /* ------------------------------------------------------------------ */
+  /*  POST /webhooks/elevenlabs — post-call webhook                      */
+  /* ------------------------------------------------------------------ */
+
+  @Post()
+  @Throttle({ default: { ttl: 60000, limit: 100 } })
+  @ApiOperation({ summary: 'ElevenLabs post-call webhook' })
+  async handlePostCall(@Req() req: any) {
+    const body = req.body;
+
+    if (!body || typeof body !== 'object') {
+      throw new BadRequestException('Missing or invalid request body');
+    }
+
+    const conversationId = body.conversation_id ?? body.data?.conversation_id;
+
+    this.logger.log(
+      `Received ElevenLabs post-call webhook (conversation_id=${conversationId ?? 'unknown'})`,
+    );
+
+    // Enqueue for async processing — return 200 immediately
+    await this.webhookQueue.add(
+      'post-call',
+      {
+        payload: body,
+        receivedAt: new Date().toISOString(),
+      },
+      {
+        attempts: 3,
+        backoff: { type: 'exponential', delay: 5000 },
+        removeOnComplete: 100,
+        removeOnFail: 500,
+      },
+    );
+
+    return { status: 'queued' };
+  }
+}

package/nestjs/src/webhooks/meta-webhook.controller.ts

@@ -0,0 +1,178 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Req,
+  Query,
+  Logger,
+  ForbiddenException,
+} from '@nestjs/common';
+import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import { Throttle, SkipThrottle } from '@nestjs/throttler';
+import { ConfigService } from '@nestjs/config';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { createHmac } from 'crypto';
+
+@ApiTags('Webhooks')
+@Controller('webhooks/meta')
+export class MetaWebhookController {
+  private readonly logger = new Logger(MetaWebhookController.name);
+
+  constructor(
+    private readonly configService: ConfigService,
+    private readonly eventEmitter: EventEmitter2,
+  ) {}
+
+  /* ------------------------------------------------------------------ */
+  /*  GET /webhooks/meta — hub.challenge verification                    */
+  /* ------------------------------------------------------------------ */
+
+  @Get()
+  @SkipThrottle()
+  @ApiOperation({ summary: 'Meta webhook verification (hub.challenge)' })
+  verifyWebhook(
+    @Query('hub.mode') mode: string,
+    @Query('hub.verify_token') verifyToken: string,
+    @Query('hub.challenge') challenge: string,
+  ) {
+    const expectedToken = this.configService.get<string>('META_VERIFY_TOKEN');
+
+    if (mode === 'subscribe' && verifyToken === expectedToken) {
+      this.logger.log('Meta webhook verification successful');
+      return challenge;
+    }
+
+    this.logger.warn('Meta webhook verification failed');
+    throw new ForbiddenException('Verification failed');
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  POST /webhooks/meta — incoming messages                            */
+  /* ------------------------------------------------------------------ */
+
+  @Post()
+  @Throttle({ default: { ttl: 60000, limit: 100 } })
+  @ApiOperation({ summary: 'Meta incoming WhatsApp + Instagram messages' })
+  async handleIncoming(@Req() req: any) {
+    const signature = req.headers['x-hub-signature-256'] as string;
+
+    // Verify HMAC signature (skip for Instagram in dev — TODO: fix secret)
+    if (!this.verifySignature(req, signature)) {
+      if (req.body?.object !== 'instagram') {
+        this.logger.warn('Invalid Meta webhook signature');
+        throw new ForbiddenException('Invalid signature');
+      }
+      this.logger.warn('Instagram webhook signature mismatch — skipping verification (dev mode)');
+    }
+
+    const body = req.body;
+    this.logger.log(`Webhook: object=${body?.object}, entries=${body?.entry?.length ?? 0}, body=${JSON.stringify(body).substring(0, 500)}`);
+
+    if (!body?.object) {
+      return 'EVENT_RECEIVED';
+    }
+
+    // Process each entry
+    const entries = body.entry ?? [];
+    for (const entry of entries) {
+      if (body.object === 'whatsapp_business_account') {
+        const changes = entry.changes ?? [];
+        for (const change of changes) {
+          const value = change.value ?? {};
+          const messages = value.messages ?? [];
+          if (messages.length > 0) {
+            this.eventEmitter.emit('meta.whatsapp.message', {
+              wabaId: entry.id,
+              phoneNumberId: value.metadata?.phone_number_id ?? '',
+              displayPhoneNumber: value.metadata?.display_phone_number ?? '',
+              contacts: value.contacts ?? [],
+              messages,
+            });
+          }
+
+          const statuses = value.statuses ?? [];
+          if (statuses.length > 0) {
+            this.logger.debug(
+              `WhatsApp status update: ${statuses.map((s: any) => `${s.id}=${s.status}`).join(', ')}`,
+            );
+          }
+        }
+      } else if (body.object === 'instagram') {
+        const messaging = entry.messaging ?? [];
+        for (const msg of messaging) {
+          // Regular message (text, media, story reply, share, etc.)
+          if (msg.message) {
+            this.eventEmitter.emit('meta.instagram.message', {
+              pageId: entry.id,
+              senderId: msg.sender?.id ?? '',
+              message: msg.message,
+              postback: null,
+              reaction: null,
+              referral: msg.message?.referral || null,
+              timestamp: msg.timestamp ?? Math.floor(Date.now() / 1000),
+            });
+          }
+          // Reaction (heart/emoji on a message)
+          if (msg.reaction) {
+            this.eventEmitter.emit('meta.instagram.message', {
+              pageId: entry.id,
+              senderId: msg.sender?.id ?? '',
+              message: null,
+              postback: null,
+              reaction: msg.reaction,
+              referral: null,
+              timestamp: msg.timestamp ?? Math.floor(Date.now() / 1000),
+            });
+          }
+          // Postback (ice breaker / persistent menu tap)
+          if (msg.postback) {
+            this.eventEmitter.emit('meta.instagram.message', {
+              pageId: entry.id,
+              senderId: msg.sender?.id ?? '',
+              message: null,
+              postback: msg.postback,
+              reaction: null,
+              referral: msg.referral || null,
+              timestamp: msg.timestamp ?? Math.floor(Date.now() / 1000),
+            });
+          }
+        }
+      }
+    }
+
+    return 'EVENT_RECEIVED';
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  PRIVATE HELPERS                                                    */
+  /* ------------------------------------------------------------------ */
+
+  private verifySignature(req: any, signature: string): boolean {
+    const waSecret = this.configService.get<string>('META_WHATSAPP_APP_SECRET');
+    const igSecret = this.configService.get<string>('META_INSTAGRAM_APP_SECRET');
+    const verifyToken = this.configService.get<string>('META_VERIFY_TOKEN');
+    const secrets = [waSecret, igSecret, verifyToken].filter(Boolean) as string[];
+
+    if (secrets.length === 0) {
+      this.logger.warn('No META app secrets configured — skipping verification');
+      return true;
+    }
+
+    if (!signature) {
+      return false;
+    }
+
+    const rawBody =
+      (req as any).rawBody ??
+      Buffer.from(JSON.stringify(req.body), 'utf-8');
+
+    // Try each secret — WhatsApp and Instagram sign with different app secrets
+    for (const secret of secrets) {
+      const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
+      if (signature === expected) return true;
+    }
+
+    this.logger.debug(`Webhook signature mismatch — tried ${secrets.length} secrets`);
+    return false;
+  }
+}

package/nestjs/src/webhooks/processors/elevenlabs-webhook.processor.ts

@@ -0,0 +1,28 @@
+import { Processor, WorkerHost } from '@nestjs/bullmq';
+import { Logger } from '@nestjs/common';
+import { Job } from 'bullmq';
+
+@Processor('elevenlabs-webhook')
+export class ElevenLabsWebhookProcessor extends WorkerHost {
+  private readonly logger = new Logger(ElevenLabsWebhookProcessor.name);
+
+  async process(job: Job<{ payload: Record<string, any>; receivedAt: string }>) {
+    const { payload, receivedAt } = job.data;
+    const conversationId = payload.conversation_id ?? payload.data?.conversation_id;
+
+    this.logger.log(
+      `Processing post-call webhook (conversation_id=${conversationId}, receivedAt=${receivedAt})`,
+    );
+
+    // TODO: Implement post-call processing
+    // 1. Look up agent by agent_id → resolve tenant + clinic
+    // 2. Extract transcript, analysis, metadata
+    // 3. Create/update Call record
+    // 4. Run post-call strategy (summarize, notify, etc.)
+    // 5. Create Lead if applicable
+
+    this.logger.log(
+      `Post-call webhook processed (conversation_id=${conversationId})`,
+    );
+  }
+}

package/nestjs/src/webhooks/webhooks.module.ts

@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { ElevenLabsWebhookController } from './elevenlabs-webhook.controller';
+import { ElevenLabsToolController } from './elevenlabs-tool.controller';
+import { MetaWebhookController } from './meta-webhook.controller';
+import { ElevenLabsWebhookProcessor } from './processors/elevenlabs-webhook.processor';
+import { AgentsModule } from '../agents/agents.module';
+
+@Module({
+  imports: [AgentsModule],
+  controllers: [
+    ElevenLabsWebhookController,
+    ElevenLabsToolController,
+    MetaWebhookController,
+  ],
+  providers: [ElevenLabsWebhookProcessor],
+})
+export class WebhooksModule {}