feat(whatsapp,branding): WhatsApp demo-number wiring + Denya logo assets

WhatsApp demo path (relay #748): - WHATSAPP_DEMO_TO config under the WhatsApp section (env-based, .env-only; .env.example keeps an empty placeholder; real numbers never enter source). - build_demo_webhook_payload() in app/routers/whatsapp.py builds the Meta demo payload from it (fails closed when unset), so the webhook round trip logs from_number = demo number (surfaces in GET /api/whatsapp/mock-log) and the auto-reply targets the same number. - tests/test_whatsapp_demo_number.py: default empty + never committed in tracked files, payload builder from/to, 200/403/401 gates unchanged. Branding (logo-assets-v1, sha256-verified, same-origin app/static/branding): - Login header uses h96 full lockup; logged-in topbar (base.html) uses h48 on a light chip (logo ink is ~2:1 vs the dark nav); favicons 32x32 + 16x16 in <head>. img-src 'self' data: blob: already allows /static/branding/*. - tests/test_branding_assets.py: page placement + same-origin serving + CSP. - AGENTS.md synced.
2026-09-09 19:32:21 +00:00
parent f1428335ef
commit a6eb799efa
15 changed files with 330 additions and 13 deletions
@@ -39,6 +39,14 @@ class Settings(BaseSettings):
    # Shared secret for inbound webhook POSTs (header ``X-Webhook-Secret``).
    # Fail-closed: when unset/empty the webhook rejects every message.
    WHATSAPP_WEBHOOK_SECRET: str = ""
+    # Expected sender/recipient number (E.164) for the WhatsApp demo round
+    # trip (webhook -> ticket -> mock-log). Set per deployment in .env only —
+    # never commit a real number. When set, the demo payload builder
+    # (``app/routers/whatsapp.py::build_demo_webhook_payload``) originates
+    # messages from it, the auto-reply targets it, and ``/api/whatsapp/mock-log``
+    # surfaces it. Empty (default) means the demo payload cannot be built:
+    # the helper fails closed rather than fabricating a sender.
+    WHATSAPP_DEMO_TO: str = ""

    # ── Login rate limiting ──────────────────────────────────────────
    LOGIN_RATE_LIMIT_MAX_ATTEMPTS: int = 5
@@ -46,6 +46,47 @@ REPLY_TEMPLATE = (
 )


+# ── WhatsApp demo round trip (WHATSAPP_DEMO_TO) ─────────────────────
+def build_demo_webhook_payload(
+    text: str = "Demo message — Denya OneCare WhatsApp round trip",
+    wa_message_id: str = "wamid.demo.000001",
+) -> dict:
+    """Build a Meta webhook payload for the WhatsApp demo round trip.
+
+    The message ``from`` is ``settings.WHATSAPP_DEMO_TO`` (E.164), so the demo
+    surfaces the expected number end-to-end: the webhook logs it in
+    ``whatsapp_log`` (visible via ``GET /api/whatsapp/mock-log``) and the
+    auto-reply is sent back to the same number.  The demo number is configured
+    per deployment in .env (never committed); when it is unset this raises
+    rather than fabricating a sender (same fail-closed posture as the webhook
+    secret).
+    """
+    demo_to = (settings.WHATSAPP_DEMO_TO or "").strip()
+    if not demo_to:
+        raise RuntimeError(
+            "WHATSAPP_DEMO_TO is not configured — set the demo sender number "
+            "in .env to run the WhatsApp demo round trip."
+        )
+    return {
+        "object": "whatsapp_business_account",
+        "entry": [
+            {
+                "id": "1",
+                "changes": [
+                    {
+                        "id": wa_message_id,
+                        "message": {
+                            "from": demo_to,
+                            "id": wa_message_id,
+                            "text": {"text": text},
+                        },
+                    }
+                ],
+            }
+        ],
+    }
+
+
 # ── Meta Graph API helpers ──────────────────────────────────────────
 async def send_whatsapp_reply(
    to_phone: str,
@@ -4,6 +4,9 @@
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Denya OneCare</title>
+    <!-- Favicons (same-origin app/static/branding) -->
+    <link rel="icon" type="image/png" sizes="32x32" href="/static/branding/denya-logo-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/static/branding/denya-logo-16x16.png">
    <!-- Vendored same-origin (no CDN): app/static/vendor/ — LAN-safe demo -->
    <script src="/static/vendor/alpine-3.17.2.min.js" defer></script>
    <script src="/static/vendor/tailwind-3.4.17.js"></script>
@@ -68,15 +71,11 @@
                <!-- Left side -->
                <div class="flex items-center space-x-4">
                    <a href="/dashboard/cs" class="flex items-center space-x-3">
-                        <!-- Denya Developers Logo Mark -->
-                        <div class="w-9 h-9 bg-gold rounded-lg flex items-center justify-center shadow-sm">
-                            <svg class="w-5 h-5 text-[#0d2b18]" fill="none" stroke="currentColor" stroke-width="2.5" viewBox="0 0 24 24">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6"/>
-                            </svg>
-                        </div>
+                        <!-- Denya Developers logo (same-origin app/static/branding) -->
+                        <img src="/static/branding/denya-logo-h48.png" alt="Denya Developers"
+                             class="h-9 w-auto bg-white rounded-md px-1.5 py-1 shadow-sm">
                        <div class="flex flex-col">
-                            <span class="text-white font-bold text-base leading-tight">Denya Developers</span>
-                            <span class="text-gold text-xs leading-tight font-medium">OneCare</span>
+                            <span class="text-gold text-sm leading-tight font-bold">OneCare</span>
                        </div>
                    </a>
                    <!-- Nav Links -->
@@ -4,11 +4,9 @@
    <div class="w-full max-w-md" x-data="loginForm()">
        <div class="bg-white rounded-2xl shadow-lg p-8">
            <div class="text-center mb-8">
-                <div class="mx-auto w-16 h-16 bg-denya-100 rounded-full flex items-center justify-center mb-4">
-                    <svg class="w-8 h-8 text-denya-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4"/>
-                    </svg>
-                </div>
+                <!-- Denya Developers full lockup (same-origin app/static/branding) -->
+                <img src="/static/branding/denya-logo-h96.png" alt="Denya Developers"
+                     class="mx-auto mb-4 h-24 w-auto">
                <h1 class="text-2xl font-bold text-gray-900">Denya OneCare</h1>
                <p class="text-gray-500 mt-1">Sign in to your dashboard</p>
            </div>