Repository navigation
Corrigir autenticação WA.Auto e diagnóstico da automação - #45
Conversation
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. |
✅ Deploy Preview for lexispredict ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7596cdad8f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const {data:profile,error:lookupError} = await db.from("usuarios") | ||
| .select("auth_user_id,empresa_id,cargo") | ||
| .eq("auth_user_id",actorId).maybeSingle(); |
There was a problem hiding this comment.
When an automation setting retains an owner who has since moved to another company, this lookup authenticates that user's current profile and returns the new empresa_id instead of rejecting the old company's request. waAutoForOwner(userId, empresaId, ...) validates but never transmits empresaId, and callers such as processOneDailyReturn can use a stored owner without rechecking membership, so an old tenant's customer message can be sent through a manager/session now belonging to another tenant. Carry the expected company in the authenticated request and include it in this lookup, as the existing signed-worker path does.
Useful? React with 👍 / 👎.
| const sharedMatch = | ||
| integrationToken.length >= 24 && | ||
| token.length === integrationToken.length && | ||
| timingSafeEqual(Buffer.from(token), Buffer.from(integrationToken)); |
There was a problem hiding this comment.
An unauthenticated caller can send a bearer token with the same JavaScript character length as the configured ASCII secret but with multibyte characters. The string-length guard then passes while the two Buffers have different byte lengths, causing timingSafeEqual to throw ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH and turn an invalid credential into an uncaught HTTP 500. Construct both buffers first and compare their byte lengths before invoking timingSafeEqual.
Useful? React with 👍 / 👎.
| const result = await waAutoAutomationReadinessAction(); | ||
| setAutomationResult(result); |
There was a problem hiding this comment.
After a successful automation check, automationResult remains successful indefinitely even if the user immediately disconnects or a subsequent refresh observes that the WA.Auto session is offline. The card then simultaneously shows a disconnected connection and the green message that the bridge is validated for automation, which can lead a manager to leave scheduled sends enabled under the false impression that they are operational. Clear or invalidate this result on logout and whenever refreshed connection state is no longer ready.
Useful? React with 👍 / 👎.
| const permission=resolveWaAutoPermissions(profile); | ||
| if (!profile?.empresa_id || !permission.canManage) { | ||
| return NextResponse.json({ok:false,error:"worker_not_authorized"},{status:403}); |
There was a problem hiding this comment.
When WA_INTEGRATION_TOKEN is configured, every normal status/chat/send call uses this shared-token branch, not only background automation. sendWhatsAppAction explicitly permits authenticated non-viewer operators, but this branch returns 403 for them; because waAutoFetch retries with the user's JWT only after a 401, operators can no longer send messages or query WA.Auto even though the JWT path supports their non-manager identity. Either distinguish automated requests from interactive shared-token calls or return/fallback to JWT authentication for valid operators.
Useful? React with 👍 / 👎.
Defeito observado
O LexisPredict enviava token de integração com
x-lexis-user-id, mas o callback/api/integration/wa-auto/authaceitava apenas JWT do Supabase ou tokenslexiswa1, rejeitando a identidade do serviço. Além disso,WA_AUTO_TOKEN(legado) prevalecia sobreWA_INTEGRATION_TOKEN.Correção
WA_INTEGRATION_TOKENao identificar a credencial canônica.Produção
Não reinicia filas nem envia aos clientes. Validação externa depende de as credenciais configuradas no Render e no LexisPredict corresponderem e de o serviço WA.Auto estar acessível. Não foi possível consultar os logs do Render sem conexão da conta.