whatsapp integration

backend/app/whatsapp_security.py

@@ -0,0 +1,13 @@
+import hashlib
+import hmac
+
+
+def verify_meta_signature(app_secret: str, raw_body: bytes, signature_header: str | None) -> bool:
+    """Validate X-Hub-Signature-256 from Meta webhook POSTs."""
+    if not app_secret or not signature_header:
+        return False
+    if not signature_header.startswith("sha256="):
+        return False
+    expected = signature_header.removeprefix("sha256=")
+    computed = hmac.new(app_secret.encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
+    return hmac.compare_digest(computed, expected)