WhatsApp Automation with Node.js

const API_VERSION = process.env.WA_API_VERSION ?? "v21.0"; // use a version Meta currently supports
const PHONE_NUMBER_ID = process.env.WA_PHONE_NUMBER_ID;
const TOKEN = process.env.WA_ACCESS_TOKEN;
const URL = `https://graph.facebook.com/${API_VERSION}/${PHONE_NUMBER_ID}/messages`;

async function post(payload) {
  const response = await fetch(URL, {
    method: "POST",
    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json" },
    body: JSON.stringify(payload),
    signal: AbortSignal.timeout(10_000),
  });
  if (!response.ok) throw new Error(`WhatsApp API ${response.status}: ${await response.text()}`);
  return response.json();
}

/** Free-form text. Only valid inside the 24-hour customer service window. */
export function sendText(to, body) {
  return post({ messaging_product: "whatsapp", to, type: "text", text: { body } });
}

/** Approved template. Required to start a conversation or after the 24-hour window. */
export function sendTemplate(to, name, language = "en") {
  return post({
    messaging_product: "whatsapp",
    to,
    type: "template",
    template: { name, language: { code: language } },
  });
}

import crypto from "node:crypto";
import express from "express";
import { sendText } from "./send-message.mjs";

const VERIFY_TOKEN = process.env.WA_VERIFY_TOKEN;
const APP_SECRET = process.env.WA_APP_SECRET;
const seen = new Set(); // use Redis or a database in production

const app = express();
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }));

app.get("/webhook", (req, res) => {
  if (req.query["hub.mode"] === "subscribe" && req.query["hub.verify_token"] === VERIFY_TOKEN) {
    return res.status(200).send(req.query["hub.challenge"]);
  }
  res.sendStatus(403);
});

function validSignature(req) {
  const header = req.get("X-Hub-Signature-256") ?? "";
  if (!header.startsWith("sha256=") || !req.rawBody) return false;
  const expected = crypto.createHmac("sha256", APP_SECRET).update(req.rawBody).digest("hex");
  const received = header.slice("sha256=".length);
  return received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
}

app.post("/webhook", (req, res) => {
  if (!validSignature(req)) return res.sendStatus(403);
  res.sendStatus(200); // acknowledge fast; do slow work in a queue

  for (const entry of req.body.entry ?? []) {
    for (const change of entry.changes ?? []) {
      for (const message of change.value?.messages ?? []) {
        if (seen.has(message.id)) continue; // Meta may deliver the same message more than once
        seen.add(message.id);
        handleMessage(message).catch(console.error);
      }
    }
  }
});

async function handleMessage(message) {
  const text = (message.text?.body ?? "").trim().toLowerCase();
  if (text === "price" || text === "pricing") {
    await sendText(message.from, "Our pricing depends on your volume. Reply HUMAN to talk to a person.");
  } else if (text === "human") {
    await sendText(message.from, "Thanks, a team member will reply shortly.");
    // notify your team here
  } else {
    await sendText(message.from, "Hi! Reply PRICE for pricing or HUMAN to talk to a person.");
  }
}

app.listen(8000);