Add WhatsApp as a second front door onto the handover pipeline - #3
Open
Laolex wants to merge 1 commit into
Open
Conversation
The friction was never the feature set: a carer already has the voice note in WhatsApp, and Memreda asked them to remember to open a website. This accepts messages where the care conversation already happens and runs them through the same source-to-handover pipeline as the web app and email. A verified X-Hub-Signature-256 proves Meta sent the request but says nothing about who owns the number, so a number only becomes a sender after a signed-in member mints a single-use, hashed, fifteen-minute code and sends it in. Unlinked numbers get instructions and write nothing. Voice notes are downloaded from Graph and content-sniffed like any upload rather than trusting the declared mime type. Messages are deduplicated on WhatsApp's message id through the existing inbound_message_ids table.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The friction was never the feature set. A carer already has the voice note in WhatsApp; Memreda asked them to remember to open a website. This accepts messages where the care conversation already happens and runs them through the same source → handover pipeline as the web app and the email channel.
A WhatsApp message becomes a
notesource. A voice note becomes avoicesource. Nothing downstream changes.Identity is the hard part, not transport
A verified
X-Hub-Signature-256proves Meta sent the request. It proves nothing about who owns the number. So:401.WHATSAPP_APP_SECRETset, every delivery is rejected — the channel is off by default.Other decisions worth reviewing
Voice notes are content-sniffed, not trusted. Media is downloaded from Graph in two hops (the lookup returns a URL, and the download still needs the bearer token), then run through the same
sniffAudioTypecheck as any upload — the existing defence against Safari mislabelling its own recordings.Deduplication reuses
inbound_message_ids. Same table the email channel uses, keyed on WhatsApp's message id.Deliberate divergence from the email path: forwarded email becomes an owner-reviewable draft because the caregiver did not write it. WhatsApp messages go straight to a handover, because the member typed or recorded them on purpose — exactly as they would in the app. Removing that step is the point of the channel. Everything stays editable and erasable afterwards. This is the decision most worth pushing back on if you disagree.
New tables
user_phones,phone_link_codes— both additive, created in the existingCREATE TABLE IF NOT EXISTSblock.Verification
npm test— 27/27 pass (17 existing, 10 new). New coverage: the subscription handshake, unsigned and wrongly signed deliveries, unlinked numbers, code binding and single-use replay, text → handover, duplicate message ids, voice → Graph download → transcript → handover, unsupported attachments, and delivery-status callbacks.Not code — what still blocks going live
A Meta Business account, WhatsApp Business Platform access, a verified business number, and the webhook pointed at HTTPS on memreda.xyz. Replies are always inside the 24-hour service window so they should not need approved templates, but Meta's current terms and conversation pricing have not been verified.
Not merged yet, by request.