FM / whatsapp

/opt/mawid/apps/api/src/whatsapp

Name	Size	Mode	Actions
owner-notifier.service.ts	1745	0644	edit dl rm
wa-core.module.ts	1352	0644	edit dl rm
wa-http.client.ts	1736	0644	edit dl rm
wa-inbound.service.spec.ts	5066	0644	edit dl rm
wa-inbound.service.ts	5431	0644	edit dl rm
wa-outbound.worker.ts	2723	0644	edit dl rm
wa-queue.ts	447	0644	edit dl rm
wa-sender.service.ts	4959	0644	edit dl rm
wa-signature.spec.ts	1264	0644	edit dl rm
wa-signature.ts	662	0644	edit dl rm
wa-types.ts	1683	0644	edit dl rm
wa-webhook.controller.spec.ts	2684	0644	edit dl rm
wa-webhook.controller.ts	2308	0644	edit dl rm
wa-window.spec.ts	860	0644	edit dl rm
wa-window.ts	509	0644	edit dl rm
whatsapp.module.ts	579	0644	edit dl rm

Edit: /opt/mawid/apps/api/src/whatsapp/wa-signature.spec.ts (1264B)

import { createHmac } from 'node:crypto';
import { verifyWaSignature } from './wa-signature';

const SECRET = 'test-app-secret';
const sign = (body: Buffer, secret = SECRET) =>
  `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`;

describe('verifyWaSignature', () => {
  const body = Buffer.from(JSON.stringify({ object: 'whatsapp_business_account', entry: [] }));

it('accepts a valid signature', () => {
    expect(verifyWaSignature(body, sign(body), SECRET)).toBe(true);
  });

it('rejects a tampered payload', () => {
    const signature = sign(body);
    const tampered = Buffer.from(body.toString().replace('entry', 'ENTRY'));
    expect(verifyWaSignature(tampered, signature, SECRET)).toBe(false);
  });

it('rejects a signature from the wrong secret', () => {
    expect(verifyWaSignature(body, sign(body, 'other-secret'), SECRET)).toBe(false);
  });

it('rejects missing raw body, missing header, and malformed header', () => {
    expect(verifyWaSignature(undefined, sign(body), SECRET)).toBe(false);
    expect(verifyWaSignature(body, undefined, SECRET)).toBe(false);
    expect(verifyWaSignature(body, 'md5=abc', SECRET)).toBe(false);
    expect(verifyWaSignature(body, 'sha256=notlongenough', SECRET)).toBe(false);
  });
});

import { createHmac } from 'node:crypto'; import { verifyWaSignature } from './wa-signature'; const SECRET = 'test-app-secret'; const sign = (body: Buffer, secret = SECRET) => `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`; describe('verifyWaSignature', () => { const body = Buffer.from(JSON.stringify({ object: 'whatsapp_business_account', entry: [] })); it('accepts a valid signature', () => { expect(verifyWaSignature(body, sign(body), SECRET)).toBe(true); }); it('rejects a tampered payload', () => { const signature = sign(body); const tampered = Buffer.from(body.toString().replace('entry', 'ENTRY')); expect(verifyWaSignature(tampered, signature, SECRET)).toBe(false); }); it('rejects a signature from the wrong secret', () => { expect(verifyWaSignature(body, sign(body, 'other-secret'), SECRET)).toBe(false); }); it('rejects missing raw body, missing header, and malformed header', () => { expect(verifyWaSignature(undefined, sign(body), SECRET)).toBe(false); expect(verifyWaSignature(body, undefined, SECRET)).toBe(false); expect(verifyWaSignature(body, 'md5=abc', SECRET)).toBe(false); expect(verifyWaSignature(body, 'sha256=notlongenough', SECRET)).toBe(false); }); });