Visão Geral

X-Coexy-Signature: sha256=<hex>   — assinatura HMAC-SHA256 do body
webhook-id:        <uuid>         — id da entrega; igual em todas as tentativas e no reenvio manual
webhook-timestamp: <segundos>     — hora desta tentativa (Unix, em segundos)
User-Agent:        Coexy-Webhooks/1.0
Content-Type:      application/json

{
  "messaging_product": "whatsapp",
  "metadata": {
    "display_phone_number": "15550783881",
    "phone_number_id": "<PHONE_NUMBER_ID>"
  },
  "contacts": [{ "profile": { "name": "João Silva" }, "wa_id": "5511987654321" }],
  "messages": [ /* mensagens recebidas */ ],
  "statuses": [ /* atualizações de status das mensagens enviadas */ ]
}

async function handleWebhook(req: Request): Promise<Response> {
  const body = await req.text()

  // 1. Verificar assinatura HMAC — obrigatório (ver Segurança)
  const valid = await verifySignature(body, req.headers.get('x-coexy-signature') ?? '', secret)
  if (!valid) return new Response('Unauthorized', { status: 401 })

  // 2. Responder 200 IMEDIATAMENTE — o Coexy considera falha após 10s
  processPayload(JSON.parse(body)).catch(console.error)
  return new Response('OK', { status: 200 })
}

async function processPayload(value: Record<string, unknown>): Promise<void> {
  // Eventos próprios do Coexy
  if (value.event === 'channel_status_update' || value.event === 'channel_health_update') {
    handleCoexyEvent(value)
    return
  }

  // Mensagens recebidas
  for (const msg of (value.messages as unknown[]) ?? []) {
    handleMessage(msg, value)
  }

  // Status de mensagens enviadas
  for (const status of (value.statuses as unknown[]) ?? []) {
    handleStatus(status)
  }
}

import json
from fastapi import BackgroundTasks, FastAPI, Request, Response

app = FastAPI()

@app.post("/webhook/coexy")
async def coexy_webhook(request: Request, background: BackgroundTasks):
    body = await request.body()
    if not verify_signature(body, request.headers.get("x-coexy-signature", ""), COEXY_HMAC_SECRET):
        return Response("Unauthorized", status_code=401)

    # Responder antes de processar (timeout de 10s)
    background.add_task(process_payload, json.loads(body))
    return Response("OK", status_code=200)

def process_payload(value: dict) -> None:
    if value.get("event") in ("channel_status_update", "channel_health_update"):
        return handle_coexy_event(value)
    for msg in value.get("messages", []):
        handle_message(msg, value)
    for status in value.get("statuses", []):
        handle_status(status)