Receive webhooks

{
  "object": "whatsapp_business_account",
  "entry": [
    {
      "id": "102290000000001",
      "changes": [
        {
          "field": "messages",
          "value": {
            "messaging_product": "whatsapp",
            "metadata": { "phone_number_id": "106540000000002" },
            "messages": [
              {
                "from": "15551234567",
                "id": "wamid.abc123...",
                "timestamp": "1716300000",
                "type": "text",
                "text": { "body": "hello" }
              }
            ]
          }
        }
      ]
    }
  ]
}

{
  "object": "whatsapp_business_account",
  "entry": [
    {
      "id": "102290000000001",
      "changes": [
        {
          "field": "smb_message_echoes",
          "value": {
            "messaging_product": "whatsapp",
            "metadata": { "phone_number_id": "106540000000002" },
            "message_echoes": [
              {
                "from": "15550000000",
                "to": "15551234567",
                "id": "wamid.def456...",
                "timestamp": "1716300060",
                "type": "text",
                "text": { "body": "on it, sending that over now" }
              }
            ]
          }
        }
      ]
    }
  ]
}

for (const change of payload.entry?.[0]?.changes ?? []) {
  if (change.field === 'messages') {
    for (const m of change.value.messages ?? []) handleCustomerMessage(m)
  }
  if (change.field === 'smb_message_echoes') {
    for (const m of change.value.message_echoes ?? []) recordOwnReply(m)
  }
}

{
  "field": "smb_app_state_sync",
  "value": {
    "messaging_product": "whatsapp",
    "metadata": { "phone_number_id": "106540000000002" },
    "state_sync": [
      {
        "type": "contact",
        "action": "add",
        "contact": { "phone_number": "15551234567", "full_name": "Dana Cohen", "first_name": "Dana" },
        "metadata": { "timestamp": "1716300000", "version": 1 }
      }
    ]
  }
}

{
  "field": "history",
  "value": {
    "messaging_product": "whatsapp",
    "metadata": { "phone_number_id": "106540000000002" },
    "history": [
      {
        "metadata": { "phase": 1, "chunk_order": 1, "progress": 55 },
        "threads": [
          {
            "id": "15551234567",
            "messages": [
              {
                "from": "15551234567",
                "id": "wamid.ghi789...",
                "timestamp": "1716000000",
                "type": "text",
                "text": { "body": "do you ship to Haifa?" },
                "history_context": { "status": "read" }
              }
            ]
          }
        ]
      }
    ]
  }
}

if (change.field === 'smb_app_state_sync') {
  for (const s of change.value.state_sync ?? []) saveContact(s.action, s.contact)
}
if (change.field === 'history') {
  for (const h of change.value.history ?? []) {
    if (h.errors?.length) continue // history sharing turned off
    for (const t of h.threads ?? []) {
      for (const m of t.messages ?? []) if (m.type !== 'errors') savePastMessage(t.id, m)
    }
  }
}

app.get('/webhook/whatsapp', (req, res) => {
  res.send(process.env.VERIFY_TOKEN)
})

import express from 'express'
import { createHmac, timingSafeEqual } from 'node:crypto'

const app = express()
const HMAC_SECRET = process.env.WEBHOOK_HMAC_SECRET
const VERIFY_TOKEN = process.env.VERIFY_TOKEN // only for the GET ownership probe

// Capture the raw body. express.json() would re-serialize and
// break the HMAC comparison.
app.post(
  '/webhook/whatsapp',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    // The `webhook set` verification probe is unsigned and empty;
    // acknowledge it before the signature check. Match the full probe
    // contract (header + user agent + empty body); anything else falls
    // through to signature verification.
    if (
      req.get('X-HookMyApp-Probe') === 'webhook-verification' &&
      req.get('User-Agent') === 'HookMyApp-Webhook-Verifier' &&
      !req.body?.length
    ) {
      return res.sendStatus(200)
    }

    const signature = req.get('X-HookMyApp-Signature-256') || ''
    const expected = 'sha256=' +
      createHmac('sha256', HMAC_SECRET)
        .update(req.body)
        .digest('hex')

    const a = Buffer.from(signature)
    const b = Buffer.from(expected)
    if (a.length !== b.length || !timingSafeEqual(a, b)) {
      return res.sendStatus(401)
    }

    const payload = JSON.parse(req.body.toString('utf8'))
    // Process payload.entry[...].changes[...].value.messages[...]
    res.json({ status: 'ok' })
  },
)