Supabase Edge Function

supabase/
├── functions/
│   └── coexy-webhook/
│       └── index.ts
└── migrations/
    └── 001_messages.sql

-- supabase/migrations/001_messages.sql
create table if not exists messages (
  id          uuid primary key default gen_random_uuid(),
  wamid       text not null,
  channel_id  text not null,
  from_number text not null,
  type        text not null default 'text',
  body        text,
  received_at timestamptz not null default now(),
  created_at  timestamptz not null default now(),
  constraint messages_wamid_unique unique (wamid)
);

alter table messages enable row level security;

supabase db push

// supabase/functions/coexy-webhook/index.ts
/// <reference types="https://esm.sh/@supabase/functions-js/src/edge-runtime.d.ts" />
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

// Cliente criado uma vez, reutilizado entre invocações
const supabase = createClient(
  Deno.env.get('SUPABASE_URL')!,
  Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!,
)

const encoder = new TextEncoder()

async function verifySignature(
  body: string,
  signatureHeader: string,
  secret: string,
): Promise<boolean> {
  if (!signatureHeader.startsWith('sha256=')) return false

  const expectedHex = signatureHeader.slice(7)
  if (expectedHex.length % 2 !== 0) return false

  const key = await crypto.subtle.importKey(
    'raw',
    encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['verify'],
  )

  const expectedBytes = new Uint8Array(expectedHex.length / 2)
  for (let i = 0; i < expectedHex.length; i += 2) {
    expectedBytes[i / 2] = parseInt(expectedHex.slice(i, i + 2), 16)
  }

  return crypto.subtle.verify('HMAC', key, expectedBytes, encoder.encode(body))
}

async function processEvent(payload: Record<string, unknown>): Promise<void> {
  // O payload segue o formato nativo da Meta: entry[].changes[].value
  const entries = (payload.entry as Array<{ changes?: unknown[] }>) ?? []

  for (const entry of entries) {
    for (const change of entry.changes ?? []) {
      const value = (change as { value: Record<string, unknown> }).value

      // Mensagens recebidas
      for (const msg of (value.messages as unknown[]) ?? []) {
        const m = msg as Record<string, unknown>
        await supabase.from('messages').upsert({
          wamid:       m.id,
          from_number: m.from,
          type:        m.type ?? 'text',
          body:        (m.text as Record<string, string> | undefined)?.body ?? null,
          payload:     m,
          received_at: new Date(Number(m.timestamp) * 1000).toISOString(),
        }, { onConflict: 'wamid', ignoreDuplicates: true })
      }

      // Status de mensagens enviadas
      for (const st of (value.statuses as unknown[]) ?? []) {
        const s = st as Record<string, unknown>
        await supabase
          .from('messages')
          .update({ status: s.status })
          .eq('wamid', s.id)
      }
    }
  }
}

Deno.serve(async (req: Request) => {
  if (req.method !== 'POST') {
    return new Response('Method Not Allowed', { status: 405 })
  }

  const body = await req.text()
  const signature = req.headers.get('x-coexy-signature') ?? ''
  const secret = Deno.env.get('COEXY_HMAC_SECRET') ?? ''

  const valid = await verifySignature(body, signature, secret)
  if (!valid) {
    return new Response('Unauthorized', { status: 401 })
  }

  const event = JSON.parse(body) as Record<string, unknown>

  // Responde 200 ANTES de processar — EdgeRuntime.waitUntil garante que
  // o processamento conclua mesmo após o retorno da Response
  if (typeof EdgeRuntime !== 'undefined') {
    EdgeRuntime.waitUntil(processEvent(event).catch(console.error))
  } else {
    processEvent(event).catch(console.error)
  }

  return new Response('OK', { status: 200 })
})

supabase secrets set COEXY_HMAC_SECRET='seu-hmac-secret'

supabase functions deploy coexy-webhook

https://<project-ref>.supabase.co/functions/v1/coexy-webhook

curl -X POST https://api.coexy.com.br/functions/v1/api/webhooks \
  -H "x-api-key: crt_pk_sua-chave" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Meu receptor",
    "url": "https://<project-ref>.supabase.co/functions/v1/coexy-webhook",
    "events": ["messages", "message_template_status_update"]
  }'

supabase functions logs coexy-webhook --tail