from flask import Flask, request
import hashlib, hmac

app = Flask(__name__)
SEEN = set()
WEBHOOK_SECRET = ""  # pon tu secreto si lo configuraste en whapi.co

def verify_hmac(raw_body: bytes, signature: str) -> bool:
    if not WEBHOOK_SECRET:
        return True
    comp = hmac.new(WEBHOOK_SECRET.encode(), raw_body or b"", hashlib.sha256).hexdigest()
    return hmac.compare_digest(comp, signature or "")

@app.post("/webhook")
def webhook():
    raw = request.get_data(cache=False, as_text=False)
    if not verify_hmac(raw, request.headers.get("X-Whapi-Signature", "")):
        return ("", 401)

    ev = request.get_json(force=True, silent=True) or {}
    key = ev.get("id") or ev.get("message_id") or f'{ev.get("event_type")}:{ev.get("timestamp")}'
    if key in SEEN:
        return ("", 200)
    SEEN.add(key)

    et = ev.get("event_type")
    if et == "message_received":
        print("📥 In:", ev.get("from"), "->", ev.get("to"), "|", ev.get("type"), "|", ev.get("body"))
    elif et == "message_sent":
        print("📤 Out:", ev.get("to"), "|", ev.get("type"), "|", ev.get("status"))
    elif et == "ack_update":
        print("✅ ACK:", ev.get("id"), "->", ev.get("ack"))
    elif et == "message_reaction":
        print("😍 Reaction:", ev.get("message_id"), ev.get("reaction"), "by", ev.get("from_number"))
    elif et == "test_webhook":
        print("🧪 Test:", ev.get("message"))
    else:
        print("ℹ️ Evento desconocido:", et)

    return ("", 200)

if __name__ == "__main__":
    app.run(port=3000)

<?php
// webhook.php
// Si usas secret en whapi.co, valida HMAC:
$WEBHOOK_SECRET = ""; // pon aquí el mismo secreto (opcional)

$raw = file_get_contents("php://input");
$ev  = json_decode($raw, true) ?: [];

function verify_hmac($raw, $secret, $headerSig) {
  if (!$secret) return true;
  $calc = hash_hmac("sha256", $raw ?: "", $secret);
  return hash_equals($calc, $headerSig ?? "");
}
if (!verify_hmac($raw, $WEBHOOK_SECRET, $_SERVER["HTTP_X_WHAPI_SIGNATURE"] ?? "")) {
  http_response_code(401); exit;
}

// Idempotencia básica (usa Redis/DB en producción)
$key = $ev["id"] ?? ($ev["message_id"] ?? (($ev["event_type"] ?? "evt").":".($ev["timestamp"] ?? time())));
$flag = sys_get_temp_dir()."/whapi_".md5($key);
if (file_exists($flag)) { http_response_code(200); exit; }
touch($flag);

// Ruteo por evento
$et = $ev["event_type"] ?? "";
switch ($et) {
  case "message_received":
    error_log("📥 In: ".$ev["from"]." -> ".$ev["to"]." | ".$ev["type"]." | ".$ev["body"]);
    break;
  case "message_sent":
    error_log("📤 Out: ".$ev["to"]." | ".$ev["type"]." | ".$ev["status"]);
    break;
  case "ack_update":
    error_log("✅ ACK: ".$ev["id"]." -> ".$ev["ack"]);
    break;
  case "message_reaction":
    error_log("😍 Reaction: ".$ev["message_id"]." ".$ev["reaction"]." by ".$ev["from_number"]);
    break;
  case "test_webhook":
    error_log("🧪 Test: ".$ev["message"]);
    break;
  default:
    error_log("ℹ️ Evento desconocido: ".$et);
}

http_response_code(200);
echo json_encode(["ok" => true]);