privacy policy and business integration

backend/app/routes_whatsapp.py

@@ -11,8 +11,10 @@ from .config import settings
 from .database import get_db
 from .models import UserAccount, WhatsAppWebhookEvent
 from .whatsapp_graph_client import WhatsAppGraphClient, WhatsAppGraphError
+from .whatsapp_config import resolved_whatsapp_app_secret
 from .whatsapp_security import verify_meta_signature
 from .whatsapp_webhook import persist_webhook_payload
+from .whatsapp_messages import record_inbound_messages
 
 logger = logging.getLogger(__name__)
 
@@ -73,9 +75,10 @@ async def receive_webhook(
 ) -> dict[str, str]:
     """Receive inbound WhatsApp Business Platform webhook payloads."""
     raw_body = await request.body()
+    app_secret = resolved_whatsapp_app_secret(db)
 
-    if settings.whatsapp_app_secret:
-        if not verify_meta_signature(settings.whatsapp_app_secret, raw_body, x_hub_signature_256):
+    if app_secret:
+        if not verify_meta_signature(app_secret, raw_body, x_hub_signature_256):
             logger.warning("WhatsApp webhook signature validation failed")
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid signature")
     elif settings.environment == "production":
@@ -90,6 +93,7 @@ async def receive_webhook(
         payload = {}
 
     persist_webhook_payload(db, payload)
+    record_inbound_messages(db, payload)
     return {"status": "ok"}
 
 
@@ -100,6 +104,7 @@ def whatsapp_setup(
     """Console setup info — paste these values into Meta Developer Console."""
     return {
         "webhook_url": settings.whatsapp_webhook_url,
+        "verify_token": settings.whatsapp_verify_token or None,
         "verify_token_configured": bool(settings.whatsapp_verify_token),
         "app_secret_configured": bool(settings.whatsapp_app_secret),
         "access_token_configured": bool(settings.whatsapp_access_token),