ownsms 0.3.2__py3-none-any.whl

ownsms/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.2"

ownsms/admin.py

@@ -0,0 +1,33 @@
+from django.contrib import admin
+
+from . import models
+
+
+@admin.register(models.Account)
+class AccountAdmin(admin.ModelAdmin):
+    list_display = ("id", "email", "status", "created_at")
+    search_fields = ("email",)
+    list_filter = ("status",)
+
+
+@admin.register(models.Device)
+class DeviceAdmin(admin.ModelAdmin):
+    list_display = ("id", "account", "name", "status", "last_seen_at")
+    list_filter = ("status",)
+
+
+@admin.register(models.Message)
+class MessageAdmin(admin.ModelAdmin):
+    list_display = ("id", "account", "to", "status", "is_test", "created_at")
+    list_filter = ("status", "is_test")
+    search_fields = ("to",)
+
+
+@admin.register(models.Campaign)
+class CampaignAdmin(admin.ModelAdmin):
+    list_display = ("id", "account", "status", "total", "created_at")
+    list_filter = ("status",)
+
+
+for m in (models.Sim, models.ApiKey, models.PairingCode, models.Webhook, models.WebhookDelivery, models.AuditLog):
+    admin.site.register(m)

ownsms/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class OwnsmsConfig(AppConfig):
+    name = "ownsms"
+    default_auto_field = "django.db.models.BigAutoField"
+    verbose_name = "ownsms"

ownsms/auth.py

@@ -0,0 +1,64 @@
+import ipaddress
+
+from django.utils import timezone
+
+from .errors import ApiError
+from .models import ApiKey, Device
+from .tokens import hash_token
+
+
+def bearer_from_request(request) -> str:
+    header = request.META.get("HTTP_AUTHORIZATION", "")
+    if not header.startswith("Bearer "):
+        raise ApiError("unauthorized", "Missing Bearer token", 401)
+    return header[len("Bearer ") :].strip()
+
+
+def _client_ip(request):
+    xff = request.META.get("HTTP_X_FORWARDED_FOR", "")
+    if xff:
+        return xff.split(",")[0].strip()
+    return request.META.get("REMOTE_ADDR", "")
+
+
+def _ip_allowed(ip, allow):
+    try:
+        addr = ipaddress.ip_address(ip)
+    except ValueError:
+        return False
+    for entry in allow:
+        try:
+            if addr in ipaddress.ip_network(entry, strict=False):
+                return True
+        except ValueError:
+            if entry == ip:
+                return True
+    return False
+
+
+def resolve_api_key(request, scope=None) -> ApiKey:
+    token = bearer_from_request(request)
+    try:
+        key = ApiKey.objects.select_related("account", "device").get(key_hash=hash_token(token))
+    except ApiKey.DoesNotExist:
+        raise ApiError("unauthorized", "Invalid API key", 401)
+    if key.revoked:
+        raise ApiError("unauthorized", "API key revoked", 401)
+    if scope and scope not in key.scopes:
+        raise ApiError("forbidden", f"Key lacks scope '{scope}'", 403)
+    if key.ip_allowlist:
+        if not _ip_allowed(_client_ip(request), key.ip_allowlist):
+            raise ApiError("ip_not_allowed", "Request IP is not in the allowlist", 403)
+    ApiKey.objects.filter(pk=key.pk).update(last_used_at=timezone.now())
+    return key
+
+
+def resolve_device(request) -> Device:
+    token = bearer_from_request(request)
+    try:
+        dev = Device.objects.select_related("account").get(device_token=hash_token(token))
+    except Device.DoesNotExist:
+        raise ApiError("unauthorized", "Invalid device token", 401)
+    if dev.status != "active":
+        raise ApiError("device_inactive", "Device is inactive", 403)
+    return dev

ownsms/conf.py

@@ -0,0 +1,14 @@
+from django.conf import settings
+
+DEFAULTS = {
+    "DEVICE_ONLINE_SECONDS": 60,
+    "POLL_TIMEOUT_SECONDS": 30,
+    "POLL_INTERVAL_SECONDS": 1,
+    "POLL_BATCH_SIZE": 100,
+    "LEASE_SECONDS": 60,
+    "DEFAULT_TTL_SECONDS": 24 * 3600,
+}
+
+
+def get(name):
+    return getattr(settings, "OWNSMS", {}).get(name, DEFAULTS[name])

ownsms/errors.py

@@ -0,0 +1,13 @@
+from django.http import JsonResponse
+
+
+class ApiError(Exception):
+    def __init__(self, code, message, status):
+        super().__init__(message)
+        self.code = code
+        self.message = message
+        self.status = status
+
+
+def error_response(err: "ApiError") -> JsonResponse:
+    return JsonResponse({"error": {"code": err.code, "message": err.message}}, status=err.status)

ownsms/management/commands/ownsms_housekeeping.py

@@ -0,0 +1,12 @@
+from django.core.management.base import BaseCommand
+from django.utils import timezone
+
+from ownsms.services.dispatch import expire_and_reclaim
+
+
+class Command(BaseCommand):
+    help = "Expire TTL-passed queued messages and reclaim leases (run periodically)."
+
+    def handle(self, *args, **opts):
+        res = expire_and_reclaim(timezone.now())
+        self.stdout.write(f"expired={res['expired']} reclaimed={res['reclaimed']}")

ownsms/management/commands/ownsms_webhooks.py

@@ -0,0 +1,10 @@
+from django.core.management.base import BaseCommand
+
+from ownsms.services import webhooks
+
+
+class Command(BaseCommand):
+    help = "Deliver pending webhooks (run periodically)."
+
+    def handle(self, *args, **opts):
+        self.stdout.write(f"delivered={webhooks.send_pending()}")

ownsms/migrations/0001_initial.py

@@ -0,0 +1,89 @@
+# Generated by Django 5.2.15 on 2026-06-30 11:07
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Account',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(blank=True, max_length=200)),
+                ('email', models.EmailField(max_length=254)),
+                ('status', models.CharField(default='active', max_length=20)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Device',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=200)),
+                ('device_token', models.CharField(max_length=64, unique=True)),
+                ('app_version', models.CharField(blank=True, max_length=40)),
+                ('status', models.CharField(default='active', max_length=20)),
+                ('last_seen_at', models.DateTimeField(blank=True, null=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='devices', to='ownsms.account')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='ApiKey',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('key_hash', models.CharField(max_length=64, unique=True)),
+                ('prefix', models.CharField(max_length=16)),
+                ('name', models.CharField(blank=True, max_length=200)),
+                ('scopes', models.JSONField(default=list)),
+                ('revoked', models.BooleanField(default=False)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('last_used_at', models.DateTimeField(blank=True, null=True)),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='api_keys', to='ownsms.account')),
+                ('device', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='api_keys', to='ownsms.device')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Sim',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('subscription_id', models.IntegerField()),
+                ('number', models.CharField(max_length=20)),
+                ('operator', models.CharField(blank=True, max_length=40)),
+                ('is_default', models.BooleanField(default=False)),
+                ('device', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='sims', to='ownsms.device')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Message',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('to', models.CharField(max_length=20)),
+                ('text', models.TextField()),
+                ('status', models.CharField(default='queued', max_length=20)),
+                ('queued', models.BooleanField(default=False)),
+                ('ttl', models.IntegerField(blank=True, null=True)),
+                ('segments', models.IntegerField(default=1)),
+                ('idempotency_key', models.CharField(blank=True, default='', max_length=120)),
+                ('error_code', models.CharField(blank=True, default='', max_length=60)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('dispatched_at', models.DateTimeField(blank=True, null=True)),
+                ('sent_at', models.DateTimeField(blank=True, null=True)),
+                ('delivered_at', models.DateTimeField(blank=True, null=True)),
+                ('lease_expires_at', models.DateTimeField(blank=True, null=True)),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='messages', to='ownsms.account')),
+                ('device', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='messages', to='ownsms.device')),
+                ('sim', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='messages', to='ownsms.sim')),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(condition=models.Q(('idempotency_key__gt', '')), fields=('account', 'idempotency_key'), name='uniq_account_idempotency')],
+            },
+        ),
+    ]

ownsms/migrations/0002_sim_daily_quota_sim_jitter_max_sim_jitter_min_and_more.py

@@ -0,0 +1,53 @@
+# Generated by Django 5.2.15 on 2026-06-30 14:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='sim',
+            name='daily_quota',
+            field=models.IntegerField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='jitter_max',
+            field=models.IntegerField(default=5),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='jitter_min',
+            field=models.IntegerField(default=2),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='rate_per_day',
+            field=models.IntegerField(default=500),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='rate_per_hour',
+            field=models.IntegerField(default=200),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='rate_per_min',
+            field=models.IntegerField(default=15),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='work_hours_end',
+            field=models.TimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='sim',
+            name='work_hours_start',
+            field=models.TimeField(blank=True, null=True),
+        ),
+    ]

ownsms/migrations/0003_pairingcode.py

@@ -0,0 +1,25 @@
+# Generated by Django 5.2.15 on 2026-06-30 14:20
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0002_sim_daily_quota_sim_jitter_max_sim_jitter_min_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='PairingCode',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('code', models.CharField(max_length=32, unique=True)),
+                ('expires_at', models.DateTimeField()),
+                ('used', models.BooleanField(default=False)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='pairing_codes', to='ownsms.account')),
+            ],
+        ),
+    ]

ownsms/migrations/0004_alter_account_email.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.15 on 2026-06-30 14:26
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0003_pairingcode'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='account',
+            name='email',
+            field=models.EmailField(blank=True, max_length=254),
+        ),
+    ]

ownsms/migrations/0005_message_scheduled_at_campaign_message_campaign.py

@@ -0,0 +1,42 @@
+# Generated by Django 5.2.15 on 2026-06-30 18:03
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0004_alter_account_email'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='message',
+            name='scheduled_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.CreateModel(
+            name='Campaign',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('text', models.TextField()),
+                ('from_number', models.CharField(blank=True, max_length=20)),
+                ('rotate_sims', models.BooleanField(default=False)),
+                ('send_at', models.DateTimeField(blank=True, null=True)),
+                ('queued', models.BooleanField(default=True)),
+                ('callback_url', models.CharField(blank=True, max_length=500)),
+                ('status', models.CharField(default='running', max_length=20)),
+                ('total', models.IntegerField(default=0)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='campaigns', to='ownsms.account')),
+                ('device', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='campaigns', to='ownsms.device')),
+                ('sim', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='campaigns', to='ownsms.sim')),
+            ],
+        ),
+        migrations.AddField(
+            model_name='message',
+            name='campaign',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='messages', to='ownsms.campaign'),
+        ),
+    ]

ownsms/migrations/0006_webhook_webhookdelivery.py

@@ -0,0 +1,42 @@
+# Generated by Django 5.2.15 on 2026-06-30 18:08
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0005_message_scheduled_at_campaign_message_campaign'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Webhook',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('url', models.CharField(blank=True, max_length=500)),
+                ('secret', models.CharField(max_length=64)),
+                ('events', models.JSONField(default=list)),
+                ('enabled', models.BooleanField(default=False)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('account', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, related_name='webhook', to='ownsms.account')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='WebhookDelivery',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('event_id', models.CharField(max_length=64, unique=True)),
+                ('event', models.CharField(max_length=40)),
+                ('url', models.CharField(max_length=500)),
+                ('payload', models.JSONField()),
+                ('attempts', models.IntegerField(default=0)),
+                ('status', models.CharField(default='pending', max_length=20)),
+                ('next_retry_at', models.DateTimeField(blank=True, null=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webhook_deliveries', to='ownsms.account')),
+                ('message', models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, to='ownsms.message')),
+            ],
+        ),
+    ]

ownsms/migrations/0007_apikey_is_test_message_callback_url_message_is_test.py

@@ -0,0 +1,28 @@
+# Generated by Django 5.2.15 on 2026-06-30 18:13
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0006_webhook_webhookdelivery'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='apikey',
+            name='is_test',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name='message',
+            name='callback_url',
+            field=models.CharField(blank=True, default='', max_length=500),
+        ),
+        migrations.AddField(
+            model_name='message',
+            name='is_test',
+            field=models.BooleanField(default=False),
+        ),
+    ]

ownsms/migrations/0008_apikey_ip_allowlist_auditlog.py

@@ -0,0 +1,31 @@
+# Generated by Django 5.2.15 on 2026-06-30 18:16
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ownsms', '0007_apikey_is_test_message_callback_url_message_is_test'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='apikey',
+            name='ip_allowlist',
+            field=models.JSONField(default=list),
+        ),
+        migrations.CreateModel(
+            name='AuditLog',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('actor', models.CharField(max_length=40)),
+                ('action', models.CharField(max_length=60)),
+                ('target', models.CharField(blank=True, max_length=120)),
+                ('ip', models.CharField(blank=True, max_length=64)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('account', models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='audit_logs', to='ownsms.account')),
+            ],
+        ),
+    ]

ownsms/models.py

@@ -0,0 +1,144 @@
+from datetime import timedelta
+
+from django.db import models
+
+from . import conf
+
+
+class Account(models.Model):
+    name = models.CharField(max_length=200, blank=True)
+    email = models.EmailField(blank=True)  # optional (no verification in v1)
+    status = models.CharField(max_length=20, default="active")  # active|suspended
+    created_at = models.DateTimeField(auto_now_add=True)
+
+
+class Device(models.Model):
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="devices")
+    name = models.CharField(max_length=200)
+    device_token = models.CharField(max_length=64, unique=True)  # sha256 hex
+    app_version = models.CharField(max_length=40, blank=True)
+    status = models.CharField(max_length=20, default="active")  # active|inactive
+    last_seen_at = models.DateTimeField(null=True, blank=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    def is_online(self, now):
+        if not self.last_seen_at:
+            return False
+        return (now - self.last_seen_at) < timedelta(seconds=conf.get("DEVICE_ONLINE_SECONDS"))
+
+
+class Sim(models.Model):
+    device = models.ForeignKey(Device, on_delete=models.CASCADE, related_name="sims")
+    subscription_id = models.IntegerField()
+    number = models.CharField(max_length=20)
+    operator = models.CharField(max_length=40, blank=True)
+    is_default = models.BooleanField(default=False)
+    rate_per_min = models.IntegerField(default=15)
+    rate_per_hour = models.IntegerField(default=200)
+    rate_per_day = models.IntegerField(default=500)
+    jitter_min = models.IntegerField(default=2)  # seconds
+    jitter_max = models.IntegerField(default=5)
+    work_hours_start = models.TimeField(null=True, blank=True)
+    work_hours_end = models.TimeField(null=True, blank=True)
+    daily_quota = models.IntegerField(null=True, blank=True)
+
+
+class ApiKey(models.Model):
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="api_keys")
+    device = models.ForeignKey(Device, on_delete=models.CASCADE, related_name="api_keys")
+    key_hash = models.CharField(max_length=64, unique=True)
+    prefix = models.CharField(max_length=16)
+    name = models.CharField(max_length=200, blank=True)
+    scopes = models.JSONField(default=list)  # ["send","read"]
+    ip_allowlist = models.JSONField(default=list)  # [] = unrestricted; ["10.0.0.0/8", "1.2.3.4"]
+    is_test = models.BooleanField(default=False)
+    revoked = models.BooleanField(default=False)
+    created_at = models.DateTimeField(auto_now_add=True)
+    last_used_at = models.DateTimeField(null=True, blank=True)
+
+
+class Campaign(models.Model):
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="campaigns")
+    device = models.ForeignKey(Device, on_delete=models.CASCADE, related_name="campaigns")
+    sim = models.ForeignKey(Sim, on_delete=models.SET_NULL, null=True, related_name="campaigns")
+    text = models.TextField()
+    from_number = models.CharField(max_length=20, blank=True)
+    rotate_sims = models.BooleanField(default=False)
+    send_at = models.DateTimeField(null=True, blank=True)
+    queued = models.BooleanField(default=True)
+    callback_url = models.CharField(max_length=500, blank=True)
+    status = models.CharField(max_length=20, default="running")  # scheduled|running|paused|completed|canceled
+    total = models.IntegerField(default=0)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+
+class Message(models.Model):
+    STATUS = ["queued", "dispatched", "sent", "delivered", "failed", "expired", "canceled"]
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="messages")
+    device = models.ForeignKey(Device, on_delete=models.CASCADE, related_name="messages")
+    sim = models.ForeignKey(Sim, on_delete=models.SET_NULL, null=True, related_name="messages")
+    to = models.CharField(max_length=20)
+    text = models.TextField()
+    status = models.CharField(max_length=20, default="queued")
+    queued = models.BooleanField(default=False)  # True = send when online
+    ttl = models.IntegerField(null=True, blank=True)
+    segments = models.IntegerField(default=1)
+    idempotency_key = models.CharField(max_length=120, blank=True, default="")
+    error_code = models.CharField(max_length=60, blank=True, default="")
+    created_at = models.DateTimeField(auto_now_add=True)
+    dispatched_at = models.DateTimeField(null=True, blank=True)
+    sent_at = models.DateTimeField(null=True, blank=True)
+    delivered_at = models.DateTimeField(null=True, blank=True)
+    lease_expires_at = models.DateTimeField(null=True, blank=True)
+    campaign = models.ForeignKey("Campaign", on_delete=models.CASCADE, null=True, related_name="messages")
+    scheduled_at = models.DateTimeField(null=True, blank=True)
+    callback_url = models.CharField(max_length=500, blank=True, default="")
+    is_test = models.BooleanField(default=False)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(
+                fields=["account", "idempotency_key"],
+                condition=models.Q(idempotency_key__gt=""),
+                name="uniq_account_idempotency",
+            )
+        ]
+
+
+class PairingCode(models.Model):
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="pairing_codes")
+    code = models.CharField(max_length=32, unique=True)
+    expires_at = models.DateTimeField()
+    used = models.BooleanField(default=False)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+
+class Webhook(models.Model):
+    account = models.OneToOneField(Account, on_delete=models.CASCADE, related_name="webhook")
+    url = models.CharField(max_length=500, blank=True)
+    secret = models.CharField(max_length=64)
+    events = models.JSONField(default=list)  # ["message.sent","message.delivered","message.failed","message.expired"]
+    enabled = models.BooleanField(default=False)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+
+class WebhookDelivery(models.Model):
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="webhook_deliveries")
+    event_id = models.CharField(max_length=64, unique=True)
+    event = models.CharField(max_length=40)
+    message = models.ForeignKey(Message, on_delete=models.CASCADE, null=True)
+    url = models.CharField(max_length=500)
+    payload = models.JSONField()
+    attempts = models.IntegerField(default=0)
+    status = models.CharField(max_length=20, default="pending")  # pending|delivered|failed
+    next_retry_at = models.DateTimeField(null=True, blank=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+
+class AuditLog(models.Model):
+    account = models.ForeignKey(Account, on_delete=models.CASCADE, related_name="audit_logs", null=True)
+    actor = models.CharField(max_length=40)  # system|device|key|user|admin
+    action = models.CharField(max_length=60)
+    target = models.CharField(max_length=120, blank=True)
+    ip = models.CharField(max_length=64, blank=True)
+    created_at = models.DateTimeField(auto_now_add=True)