feat: Added generic webhooks workflow engine, light mode support, and template permissions, few major and many minor bugs, fixes

[DibashSarkar]

Fork Contribution Summary

This fork introduces several key features, optimization improvements, and security enhancements to the base CRM template:

1. Generic Webhooks Integration & Workflows

A brand new automated workflow system triggered by incoming generic JSON payloads.

• Incoming Webhook Receiver: Created a dynamic incoming webhook receiver route (/api/webhooks/incoming/[id]) that parses JSON payloads.
• Workflow Automations Engine: Added a manager to configure rules/conditions matching payload fields, specifying when workflows should trigger.
• Action - Send WhatsApp Template: Configures workflows to automatically dispatch templated WhatsApp messages when matched.
• Dynamic Variable Mapping: Supports mapping template parameters directly to incoming JSON fields (via dot-notation paths like customer.name) or inserting them dynamically inside static texts.
• Media & Attachment Support: Supports mapping header images, videos, and PDFs via upload, static links, or incoming payload paths.
• Conditional Contact Creation: Introduced a toggle to dynamically create/update contacts and log message histories from the incoming trigger.

2. Comprehensive Light Mode Theme Support

Bridges the gap for complete light/dark theme toggle support across all sections:

• Theming Variables: Implemented light mode theme tokens consistently on the data-mode selectors.
• Inbox & Logs Polish: Polished component backgrounds, hover borders, and contrasting badge layouts specifically in light mode to preserve readability.

3. Template Management & Agent Permissions

• Agent Capabilities: Allowed non-admin Agent roles to create, view, and sync WhatsApp message templates to facilitate communication workflows.
• Account-Scoped Templates: Re-anchored settings requests to load templates using the current accountId context instead of matching userId, preventing isolation boundary leaks.

4. Performance & Messaging Latency Optimizations

• Reduced Message Delay: Configured inbox message feeds to call the local endpoint on a 5-second interval, reducing message delivery/rendering lag in active conversations.

5. Security & Access Control

• WhatsApp Settings Hardening: Restricted Meta WhatsApp Business API credentials management solely to users with owner and admin roles, establishing read-only view restrictions for agents.

[ArnasDon]

Thanks for this — it's a lot of solid work, and some of it is genuinely well done: the template-permission change is textbook (RLS + server predicate + UI gating + a test), the WhatsApp-config requireRole('admin') hardening is exactly right, and I like that the webhook management routes use the user-scoped client while service-role stays confined to the public receiver.

A few things I'd want addressed before this can merge:

1. Please split this up. It bundles the webhooks engine, light mode, template permissions, and several send-path bug fixes into one 58-file PR filed from your fork's main. Separate PRs (ideally from feature branches) would let the safe parts — light mode, template perms — merge quickly while we work through the riskier bits.

2. Marketing endpoint routing (meta-api.ts): routing category === 'Marketing' templates to /marketing_messages assumes every account is enrolled in Meta's Marketing Messages Lite API. Standard Cloud API accounts send marketing templates via /messages, so this would break sends for anyone not on MM Lite — and it affects broadcasts/automations, not just the new webhooks. Can we gate this behind a config flag with a /messages fallback?

3. Migration numbering: 036 now collides with the upstream 036_conversation_contact_dedup (this PR renames the upstream one to 040). On a DB that's already applied 036, the new 036_generic_webhooks.sql will be skipped and its tables won't be created. New migrations need numbers after the latest upstream one (041+), leaving released migrations untouched.

4. Webhook security: the public /api/webhooks/incoming/[id] endpoint triggers billable WhatsApp sends with no signature check or rate limiting — anyone with the URL can drive it. Could we add an HMAC secret per integration and basic rate limiting? Also, the hardcoded '91' prefix for 10-digit numbers should be configurable, since this is a generic engine.

None of this takes away from the effort here — happy to help work through the migration and endpoint pieces if useful. Thanks again for the contribution!

[ArnasDon]

Comment for the requested changes added in the thread.

[DibashSarkar]

Thank you for the reply, really appreciate you took out time to check.

I will complete the requested changes and send everything back for review.

While using the application extensively (our team has already crossed 2,000 message limit tier during testing), we found a few additional bugs and feature requests, these features are there in top tier whatsapp marketing crms like gallabox (https://gallabox.com/)

---

New Feature Requests & Bugs

3. Broadcast Test Message

Before sending a broadcast to all recipients, add an option to send a test broadcast message to a selected contact or number for verification.

---

5. Template Popup Scrolling Issue

When sending a template from the Contacts page, if the template body is long, the "Fill in all body variables to send" and "Send Template" section moves below the popup and becomes inaccessible.

Suggested Fix:

• Add an internal scrollbar to the popup, or
• Make the bottom action section (Send Template) sticky so it always remains visible.

---

6. Media Gallery Improvements

• Add Media Gallery support inside the Send Template dialog.
• Add a dedicated Media Gallery option in the main navigation/menu.
• Users should be able to:
  • View all uploaded media
  • Upload new media
  • Delete unused media

---

7. Delete All Contacts

Add an option to Delete All Contacts (with proper confirmation).

---

8. Select All Contacts

Add a Select All option on the Contacts page to simplify bulk operations.

---

9. Filter Contacts Without Tags

Add a filter to display only contacts that have no tags assigned.

---

10. Template Deletion Error

Deleting templates sometimes returns the following error:

(#100) Param hsm_id is not a valid WhatsApp Business HSM ID

These are reported issues from my team, some of the below i have completed.

---

Completed Fixes (Verified)

1. ✅ Image Template Creation Fixed

Template creation with images is now working correctly.

---

11. ✅ Clone & View Template Added

Settings → Message Templates now includes:

• Clone Template
• View Template

---

12. ✅ Broadcast CSV Upload Fixed

CSV upload for creating new broadcasts is working correctly.

---

13. ✅ Bulk Actions for Contacts Added

Bulk actions have been added to Contacts, including:

• Apply Tags
• Delete Contacts
• Other bulk operations

---

Thank you! Looking forward to the next review build.

[DibashSarkar]

"Thanks again for the feedback! I've closed this PR and split the work up into four separate PRs as requested to make reviewing easier. I have also fully addressed your feedback in the new PRs: the migrations have been cleanly re-numbered to 038+, the marketing endpoint is now gated behind a config flag, and the generic webhooks now use HMAC signature verification and rate-limiting."