[core] 2025.7.3

fix #1043
fix #1068
fix #1094

.env.example

@@ -1,191 +1,107 @@
-# WAHA Configuration
+# WAHA - WhatsApp HTTP API
+#
 # https://waha.devlike.pro/docs/how-to/config/
 #
-# Common
-#
-# If you know the right URL, you can use it here.
-# Use any port in WHATSAPP_API_PORT and domain in WHATSAPP_API_HOSTNAME
-# https://waha.devlike.pro/docs/how-to/config/#common
+
+# ==================
+# ===== COMMON =====
+# ==================
+# Base URL for the API (used for webhooks, file URLs, etc.)
 WAHA_BASE_URL=http://localhost:3000
 
-#WHATSAPP_API_SCHEMA=http
-#WHATSAPP_API_PORT=3000
-#WHATSAPP_API_HOSTNAME=localhost
+# Server configuration (if you need to customize hostname/port)
+# WHATSAPP_API_SCHEMA=http
+# WHATSAPP_API_PORT=3000
+# WHATSAPP_API_HOSTNAME=localhost
 
-#
-# Set your timezone to see the right time on screenshots
-# Find your timezone name in the list
-# https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
-#TZ=Europe/Dublin
-
-#
-# Security
-#
-# https://waha.devlike.pro/docs/how-to/security/
-#
-WHATSAPP_API_KEY=admin
+# ====================
+# ===== SECURITY =====
+# ====================
+# "sha512:{SHA}" format - below is "admin" api key
+WAHA_API_KEY=sha512:c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec
+WAHA_DASHBOARD_ENABLED=True
 WAHA_DASHBOARD_USERNAME=admin
 WAHA_DASHBOARD_PASSWORD=admin
-#WHATSAPP_SWAGGER_USERNAME=admin
-#WHATSAPP_SWAGGER_PASSWORD=admin
-
-#
-# Dashboard
-#
-# https://waha.devlike.pro/docs/how-to/waha-dashboard/#configuration
-# Enabled by default
-#WAHA_DASHBOARD_ENABLED=true
-#WAHA_DASHBOARD_USERNAME=admin
-#WAHA_DASHBOARD_PASSWORD=admin
-
-#
-# Logging
-# https://waha.devlike.pro/docs/how-to/observability/#logging
-#
-# Set log format to JSON if you consume logs with log management systems
-WAHA_LOG_FORMAT=JSON
-WAHA_LOG_LEVEL=info
-# WAHA_LOG_FORMAT=PRETTY
-# If you want to see more logs, you can set the log level to debug
-#WAHA_LOG_LEVEL=debug
-# DEBUG=1 # shortcut for setting log level to debug
-
-#
-# Engine
-# https://waha.devlike.pro/docs/how-to/engines/
-#
-# Choose the right engine for your needs (WEBJS by default)
-WHATSAPP_DEFAULT_ENGINE=WEBJS
-# Use NOWEB engine for the fastest performance
-#WHATSAPP_DEFAULT_ENGINE=NOWEB
-
-# Worker
-# WAHA_WORKER_ID=waha1
-
-#
-# Sessions
-# https://waha.devlike.pro/docs/how-to/config/#sessions
-#
-# Do not print QR codes in logs
-WAHA_PRINT_QR=False
-#
-# OR you can specify sessions by name, if you have handful amount of sessions
-#WHATSAPP_START_SESSION=session1,session2
-#
-# Restart all sessions when container starts
-# !!! Do not use it with multiple workers against one database !!!
-# WHATSAPP_RESTART_ALL_SESSIONS=True
-
-#
-# Swagger
-# https://waha.devlike.pro/docs/how-to/swagger/
-#
+WHATSAPP_SWAGGER_ENABLED=True
 WHATSAPP_SWAGGER_USERNAME=admin
 WHATSAPP_SWAGGER_PASSWORD=admin
-# Disable Swagger
-#WHATSAPP_SWAGGER_ENABLED=false
-# Enable advanced Swagger configuration
-#WHATSAPP_SWAGGER_CONFIG_ADVANCED=true
-#
-# Swagger White Label customization
-# https://waha.devlike.pro/docs/how-to/swagger/#white-label
-#WHATSAPP_SWAGGER_TITLE=WAHA API
-#
 
-#
-# PostgresSQL Configuration
-# https://waha.devlike.pro/docs/how-to/storages/#sessions---postgresql
-#WHATSAPP_SESSIONS_POSTGRESQL_URL=postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable
-#
-# Media - PostgresSQL Storage
-# https://waha.devlike.pro/docs/how-to/storages/#media---postgresql
-#WAHA_MEDIA_STORAGE=POSTGRESQL
-#WAHA_MEDIA_POSTGRESQL_URL=postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable
-#
+# WhatsApp engine (WEBJS is default, GOWS or NOWEB for better performance)
+WHATSAPP_DEFAULT_ENGINE=WEBJS
 
-#
-# Global Proxy Settings
-# https://waha.devlike.pro/docs/how-to/config/#global-proxy-configuration
-#
-# You can also set proxy settings for each session later when starting it
-# https://waha.devlike.pro/docs/how-to/sessions/#configure-proxy
-#WHATSAPP_PROXY_SERVER=proxy.example.com:3128
-#WHATSAPP_PROXY_SERVER_USERNAME=user
-#WHATSAPP_PROXY_SERVER_PASSWORD=pass
-#
+# ===================
+# ===== LOGGING =====
+# ===================
+# Log format: JSON (for log management systems) or PRETTY (for development)
+WAHA_LOG_FORMAT=JSON
 
-#
-# Media Configuration
-#
-# https://waha.devlike.pro/docs/how-to/config/#files
-#
-# Disable media (images, videos, files) download for incoming messages
-#WHATSAPP_DOWNLOAD_MEDIA=false
-#
-# Download only specific media types
-#WHATSAPP_FILES_MIMETYPES=image/jpeg,image/png
-#
+# Log level: info, debug, error, warn
+WAHA_LOG_LEVEL=info
 
-# Media - Local Storage
-# https://waha.devlike.pro/docs/how-to/storages/#media---local
-#
-# Set to 0 to keep media files forever
-# https://waha.devlike.pro/docs/how-to/storages/#save-media-files-between-the-container-restarts
+# Don't print QR codes in logs
+WAHA_PRINT_QR=False
+
+# =========================
+# ===== MEDIA STORAGE =====
+# =========================
+# Local storage (default)
 WAHA_MEDIA_STORAGE=LOCAL
 WHATSAPP_FILES_LIFETIME=0
 WHATSAPP_FILES_FOLDER=/app/.media
-# Keep media files for 180 seconds (3 minutes)
-#WHATSAPP_FILES_LIFETIME=180
-#
 
-# Media - S3 Storage
-# https://waha.devlike.pro/docs/how-to/storages/#media---s3
-#WAHA_MEDIA_STORAGE=S3
-#WAHA_S3_REGION=eu-west-2
-#WAHA_S3_BUCKET=waha
-#WAHA_S3_ACCESS_KEY_ID=minioadmin
-#WAHA_S3_SECRET_ACCESS_KEY=minioadmin
-#WAHA_S3_ENDPOINT=http://minio:9000 # Not required if you're using AWS S3
-#WAHA_S3_FORCE_PATH_STYLE=True # Required for Minio
-#WAHA_S3_PROXY_FILES=True # Required for docker-compose setup
+# Media download settings
+# WHATSAPP_DOWNLOAD_MEDIA=true
+# WHATSAPP_FILES_MIMETYPES=image/jpeg,image/png
 
-#
-# Global Webhooks
-#
-# https://waha.devlike.pro/docs/how-to/config/#webhooks
-# https://waha.devlike.pro/docs/how-to/webhooks/
-#WHATSAPP_HOOK_URL=https://webhook.site/11111111-1111-1111-1111-11111111
-#WHATSAPP_HOOK_EVENTS=session.status,message,message.reaction
-#
+# S3 storage (uncomment to use)
+# WAHA_MEDIA_STORAGE=S3
+# WAHA_S3_REGION=eu-west-2
+# WAHA_S3_BUCKET=waha
+# WAHA_S3_ACCESS_KEY_ID=minioadmin
+# WAHA_S3_SECRET_ACCESS_KEY=minioadmin
+# WAHA_S3_ENDPOINT=http://minio:9000
+# WAHA_S3_FORCE_PATH_STYLE=True
+# WAHA_S3_PROXY_FILES=True
 
-#
-# Local Configuration
-#
-# WAHA_LOCAL_STORE_BASE_DIR=/app/sessions
-# Remember to map the volume to the host machine to the right direction in "volumes" field in docker-compose.yml
-# volumes:
-# - './.sessions:/app/sessions'
+# PostgreSQL storage (uncomment to use)
+# WAHA_MEDIA_STORAGE=POSTGRESQL
+# WAHA_MEDIA_POSTGRESQL_URL=postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable
+
+# ===========================
+# ===== SESSION STORAGE =====
+# ===========================
+# PostgreSQL for sessions (uncomment to use)
+# WHATSAPP_SESSIONS_POSTGRESQL_URL=postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable
+
+# MongoDB for sessions (uncomment to use)
+# WHATSAPP_SESSIONS_MONGO_URL=mongodb://mongouser:mongopassword@mongodb:27017
 
 
-#
-# MongoDB Configuration
-# https://waha.devlike.pro/docs/how-to/storages/#sessions---mongodb
-#WHATSAPP_SESSIONS_MONGO_URL=mongodb://mongouser:mongopassword@mongodb:27017
-#
+# ==================================
+# ===== ADVANCED CONFIGURATION =====
+# ==================================
 
-#
-# HTTPS Configuration
-# https://waha.devlike.pro/docs/how-to/config/#https
-#
-# Consider using certbot for HTTPS
-# https://waha.devlike.pro/blog/setting-up-https-for-waha/#lets-encrypt-certbot--waha
-#
-#WAHA_HTTPS_ENABLED=true
-#WAHA_HTTPS_PATH_KEY=/etc/letsencrypt/live/waha.example.pro/privkey.pem
-#WAHA_HTTPS_PATH_CERT=/etc/letsencrypt/live/waha.example.pro/cert.pem \
-#WAHA_HTTPS_PATH_CA=/etc/letsencrypt/live/waha.example.pro/chain.pem
-#WHATSAPP_API_SCHEMA=https
-#WHATSAPP_API_PORT=3000
-#WHATSAPP_API_HOSTNAME=waha.example.pro
-#
+# Timezone for screenshots and logs
+# TZ=Europe/Dublin
 
+# Session management
+# WHATSAPP_START_SESSION=session1,session2
+# WHATSAPP_RESTART_ALL_SESSIONS=False
+
+# Webhooks
+# WHATSAPP_HOOK_URL=https://webhook.site/11111111-1111-1111-1111-11111111
+# WHATSAPP_HOOK_EVENTS=session.status,message,message.reaction
+
+# Proxy configuration
+# WHATSAPP_PROXY_SERVER=proxy.example.com:3128
+# WHATSAPP_PROXY_SERVER_USERNAME=user
+# WHATSAPP_PROXY_SERVER_PASSWORD=pass
+
+# HTTPS configuration
+# !DEPRECATED!
+# Setup nginx reverse proxy to handle TLS connection
+# using Let's encrypt or self-issued certificate
+# WAHA_HTTPS_ENABLED=true
+# WAHA_HTTPS_PATH_KEY=/etc/letsencrypt/live/waha.example.pro/privkey.pem
+# WAHA_HTTPS_PATH_CERT=/etc/letsencrypt/live/waha.example.pro/cert.pem
+# WAHA_HTTPS_PATH_CA=/etc/letsencrypt/live/waha.example.pro/chain.pem

.github/workflows/build.yaml

@@ -126,7 +126,11 @@ jobs:
         working-directory: tests/smoke
         timeout-minutes: 2
         run: |
-          docker run -d --name smoke --rm -p3000:3000 ${{ vars.DOCKER_IMAGE }}:${{ matrix.tag }}
+          docker run -d \
+            --name smoke \
+            --rm -p3000:3000 \
+            ${{ vars.DOCKER_IMAGE }}:${{ matrix.tag }}
+
           sleep 3
           docker logs smoke
           goss validate --retry-timeout 30s --sleep 1s

.nvmrc

@@ -1 +1 @@
-v22.8
+v22.16

.pre-commit-config.yaml

@@ -39,6 +39,7 @@ repos:
           (?x)^(
               docs/.*|
               README.md|
+              tests/smoke/goss.yaml|
           )$
   - repo: https://github.com/Lucas-C/pre-commit-hooks-nodejs
     rev: v1.1.2

Dockerfile

@@ -1,8 +1,10 @@
+ARG NODE_IMAGE_TAG=22.16-bookworm-slim
+ARG GOLANG_IMAGE_TAG=1.23-bookworm
+
 #
 # Build
 #
-ARG NODE_VERSION=22.8-bullseye
-FROM node:${NODE_VERSION} AS build
+FROM node:${NODE_IMAGE_TAG} AS build
 ENV PUPPETEER_SKIP_DOWNLOAD=True
 
 # npm packages
@@ -10,6 +12,10 @@ WORKDIR /git
 COPY package.json .
 COPY yarn.lock .
 ENV YARN_CHECKSUM_BEHAVIOR=update
+
+# git
+RUN apt-get update && apt-get install -y git
+
 RUN npm install -g corepack && corepack enable
 RUN yarn set version 3.6.3
 RUN yarn install
@@ -23,11 +29,14 @@ RUN yarn build && find ./dist -name "*.d.ts" -delete
 #
 # Dashboard
 #
-FROM node:${NODE_VERSION} AS dashboard
+FROM node:${NODE_IMAGE_TAG} AS dashboard
 
 # jq to parse json
 RUN apt-get update && apt-get install -y jq && rm -rf /var/lib/apt/lists/*
 
+# wget, unzip
+RUN apt-get update && apt-get install -y wget unzip && rm -rf /var/lib/apt/lists/*
+
 COPY waha.config.json /tmp/waha.config.json
 RUN \
     WAHA_DASHBOARD_GITHUB_REPO=$(jq -r '.waha.dashboard.repo' /tmp/waha.config.json) && \
@@ -42,7 +51,7 @@ RUN \
 #
 # GOWS
 #
-FROM golang:1.23-bullseye AS gows
+FROM golang:${GOLANG_IMAGE_TAG} AS gows
 
 # jq to parse json
 RUN apt-get update && apt-get install -y jq && rm -rf /var/lib/apt/lists/*
@@ -73,7 +82,7 @@ RUN \
 #
 # Final
 #
-FROM node:${NODE_VERSION} AS release
+FROM node:${NODE_IMAGE_TAG} AS release
 ENV PUPPETEER_SKIP_DOWNLOAD=True
 # Quick fix for memory potential memory leaks
 # https://github.com/devlikeapro/waha/issues/347
@@ -98,6 +107,13 @@ RUN if [ "$USE_BROWSER" = "chromium" ] || [ "$USE_BROWSER" = "chrome" ]; then \
     && rm -rf /var/lib/apt/lists/*; \
     fi
 
+# Install wget - either for chromium or chrome
+RUN if [ "$USE_BROWSER" = "chromium" ] || [ "$USE_BROWSER" = "chrome" ]; then \
+    apt-get update  \
+    && apt-get install -y wget \
+    && rm -rf /var/lib/apt/lists/*; \
+    fi
+
 # Install fonts if using either chromium or chrome
 RUN if [ "$USE_BROWSER" = "chromium" ] || [ "$USE_BROWSER" = "chrome" ]; then \
     apt-get update  \
@@ -119,6 +135,21 @@ RUN if [ "$USE_BROWSER" = "chromium" ] || [ "$USE_BROWSER" = "chrome" ]; then \
     && rm -rf /var/lib/apt/lists/*; \
     fi
 
+# Install xvfb, xauth
+RUN if [ "$USE_BROWSER" = "chromium" ] || [ "$USE_BROWSER" = "chrome" ]; then \
+    apt-get update && apt-get install -y --no-install-recommends \
+        xvfb \
+        xauth \
+        libnss3 \
+        libxss1 \
+        libasound2 \
+        libatk-bridge2.0-0 \
+        libgtk-3-0 \
+        libdrm2 \
+        ca-certificates \
+        && rm -rf /var/lib/apt/lists/*; \
+    fi
+
 # Install Chromium
 RUN if [ "$USE_BROWSER" = "chromium" ]; then \
         apt-get update  \
@@ -131,7 +162,7 @@ RUN if [ "$USE_BROWSER" = "chromium" ]; then \
 # Install Chrome
 # Available versions:
 # https://www.ubuntuupdates.org/package/google_chrome/stable/main/base/google-chrome-stable
-ARG CHROME_VERSION="137.0.7151.55-1"
+ARG CHROME_VERSION="137.0.7151.103-1"
 RUN if [ "$USE_BROWSER" = "chrome" ]; then \
         wget --no-verbose -O /tmp/chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb \
           && apt-get update \
@@ -140,6 +171,11 @@ RUN if [ "$USE_BROWSER" = "chrome" ]; then \
           && rm -rf /var/lib/apt/lists/*; \
     fi
 
+# curl
+RUN apt-get update  \
+    && apt-get install -y curl \
+    && rm -rf /var/lib/apt/lists/*
+
 # GOWS requirements
 # libc6
 RUN  apt-get update \

Makefile

@@ -1,20 +1,20 @@
+build-all: build-plus build-chrome build-gows build-noweb
+
 build:
 	docker build . -t devlikeapro/waha
 
+build-plus:
+	docker build . -t devlikeapro/waha-plus
+
 build-chrome:
 	docker build . -t devlikeapro/waha-plus:chrome --build-arg USE_BROWSER=chrome
 
 build-noweb:
-	docker build . -t devlikeapro/waha:noweb --build-arg USE_BROWSER=none --build-arg WHATSAPP_DEFAULT_ENGINE=NOWEB
+	docker build . -t devlikeapro/waha-plus:noweb --build-arg USE_BROWSER=none --build-arg WHATSAPP_DEFAULT_ENGINE=NOWEB
 
-build-plus-gows:
+build-gows:
 	docker build . -t devlikeapro/waha-plus:gows --build-arg USE_BROWSER=none --build-arg WHATSAPP_DEFAULT_ENGINE=GOWS
 
-build-all: build build-chrome build-noweb
-
-build-plus:
-	docker build . -t devlikeapro/waha-plus
-
 build-ssh:
 	# check IMAGE provided
 	@[ "${IMAGE}" ]  || ( echo "Add APP: make build-ssh image=devlikeapro/waha"; exit 1 );

README.md

@@ -146,7 +146,7 @@ curl -d "{\"chatId\": \"${PHONE}@c.us\", \"text\": \"Hello from WhatsApp HTTP AP
 
 ## Start the project
 1. Clone the repository
-2. Make sure you're using node>=22
+2. Make sure you're using node>=22 (check [.nvmrc](/.nvmrc) to get the version)
 3. Run the following commands:
 ```bash
 # Install dependencies

docker-compose.yaml

@@ -8,6 +8,11 @@ services:
     # WAHA Core
     # image: devlikeapro/waha:latest
 
+    # Add "dns" if you have a problem with resolving "web.whatsapp.com"
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
+
     logging:
       driver: 'json-file'
       options:
@@ -38,7 +43,7 @@ services:
 #      POSTGRES_PASSWORD: postgres
 #      POSTGRES_DB: postgres
 #    ports:
-#      - "5432:5432"
+#      - "127.0.0.1:5432:5432"
 #    volumes:
 #      - pg_data:/var/lib/postgresql/data
 #    command:

docker-compose/n8n/docker-compose.yaml

@@ -10,7 +10,7 @@ services:
       - './.sessions:/app/.sessions'
       - './.media:/app/.media'
     environment:
-      - WHATSAPP_API_KEY=321
+      - WAHA_API_KEY=321
       - WAHA_DASHBOARD_USERNAME=admin
       - WAHA_DASHBOARD_PASSWORD=admin
       - WHATSAPP_DEFAULT_ENGINE=WEBJS

docker-compose/test/docker-compose.yaml

@@ -29,7 +29,7 @@ services:
       # - WHATSAPP_HOOK_EVENTS=message
       # - WHATSAPP_API_HOSTNAME=localhost
       - WHATSAPP_DEFAULT_ENGINE=WEBJS
-      - WHATSAPP_API_KEY=321
+      - WAHA_API_KEY=321
       # Username and password for Swagger
       - WHATSAPP_SWAGGER_USERNAME=swagger
       - WHATSAPP_SWAGGER_PASSWORD=admin
@@ -55,7 +55,7 @@ services:
       # Environment variables from https://waha.devlike.pro/docs/how-to/config/
       # - WHATSAPP_HOOK_URL=https://webhook.site/11111111-1111-1111-1111-11111111
       # - WHATSAPP_HOOK_EVENTS=message
-      # - WHATSAPP_API_KEY=321
+      # - WAHA_API_KEY=321
       # - WHATSAPP_SWAGGER_USERNAME=admin
       # - WHATSAPP_SWAGGER_PASSWORD=123
       # - WAHA_DASHBOARD_USERNAME=admin

entrypoint.sh

@@ -1,11 +1,66 @@
 #!/bin/sh
 
+
+#
 # Calculate UV_THREADPOOL_SIZE based on number of CPUs
+#
 cpus=$(node -e "const os = require('os'); console.log(os.cpus().length);")
 uv_threadpool_size=$(($cpus * 1))
 
 # Set UV_THREADPOOL_SIZE as an environment variable
 export UV_THREADPOOL_SIZE="${UV_THREADPOOL_SIZE:-$uv_threadpool_size}"
 
+#
+# Handle API key hashing
+#
+# Save WHATSAPP_API_KEY or WAHA_API_KEY in a variable (WHATSAPP_API_KEY has priority)
+if [ -n "$WHATSAPP_API_KEY" ]; then
+  key="$WHATSAPP_API_KEY"
+elif [ -n "$WAHA_API_KEY" ]; then
+  key="$WAHA_API_KEY"
+fi
+
+# Unset both environment variables
+unset WHATSAPP_API_KEY
+unset WAHA_API_KEY
+
+# Process the key if it exists
+if [ -n "$key" ]; then
+  # Check if key is already hashed
+  if echo "$key" | grep -q "^sha512:"; then
+    # If already hashed, use it as is
+    export WAHA_API_KEY="$key"
+  else
+    # Display warning about using plain text API key
+    echo "⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️"
+    echo "WARNING: Plain text API key detected. Converting to hashed format for security."
+    echo "For better security, use WAHA_API_KEY=sha512:{SHA512_HASH_FOR_YOUR_API_KEY}"
+    echo "⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️"
+    # Hash the key using sha512sum
+    HASHED_KEY=$(echo -n "$key" | sha512sum | awk '{print $1}')
+    export WAHA_API_KEY="sha512:$HASHED_KEY"
+  fi
+fi
+
+#
+# xvfb-run
+#
+USE_XVFB=false
+if [ -z "$WHATSAPP_DEFAULT_ENGINE" ] || [ "$WHATSAPP_DEFAULT_ENGINE" = "WEBJS" ]; then
+  # Try to run xvfb-run with a test command
+  if xvfb-run --auto-servernum echo "xvfb-run is working!"; then
+    USE_XVFB=true
+  else
+    echo "xvfb-run test failed, do not run it"
+    USE_XVFB=false
+  fi
+fi
+
+#
 # Start your application using node with exec to ensure proper signal handling
-exec node dist/main
+#
+if [ "$USE_XVFB" = "true" ]; then
+  exec xvfb-run --auto-servernum node dist/main
+else
+  exec node dist/main
+fi

package.json

@@ -49,14 +49,14 @@
     "agentkeepalive": "^4.5.0",
     "async-lock": "^1.4.1",
     "audio-decode": "^2.2.2",
-    "axios": "^1.7.7",
+    "axios": "^1.9.0",
     "axios-retry": "^4.5.0",
     "better-sqlite3": "11.3.0",
     "check-disk-space": "^3.4.0",
     "chokidar": "^3.6.0",
     "class-transformer": "^0.5.1",
     "class-validator": "0.14.0",
-    "del": "^6.0.0",
+    "del": "^8.0.0",
     "express-basic-auth": "^1.2.1",
     "file-type": "16.5.4",
     "fs-extra": "^11.2.0",
@@ -79,11 +79,11 @@
     "pino-pretty": "^11.2.1",
     "pretty-bytes": "5.6.0",
     "promise-retry": "^2.0.1",
-    "puppeteer": "^23.6.0",
+    "puppeteer": "^24.10.0",
     "qrcode": "^1.5.1",
     "qrcode-terminal": "^0.12.0",
     "reflect-metadata": "^0.1.13",
-    "rimraf": "^3.0.2",
+    "rimraf": "^4.3.0",
     "rxjs": "^7.8.1",
     "sharp": "^0.33.4",
     "swagger-ui-express": "^4.1.4",
@@ -99,7 +99,8 @@
     "ws": "^8.18.0",
     "puppeteer": "^24.10.0",
     "whatwg-url": "13.0.0",
-    "libsignal": "github:devlikeapro/libsignal-node#fork-master"
+    "libsignal": "github:devlikeapro/libsignal-node#fork-master",
+    "axios": "^1.9.0"
   },
   "devDependencies": {
     "@grpc/grpc-js": "^1.13.4",

src/api/server.controller.ts

@@ -1,15 +1,12 @@
 import * as process from 'node:process';
-import * as v8 from 'node:v8';
 
 import {
   Body,
   Controller,
   Get,
   Logger,
-  NotFoundException,
   Post,
   Query,
-  StreamableFile,
   UsePipes,
 } from '@nestjs/common';
 import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
@@ -112,34 +109,3 @@ export class ServerController {
     return { stopping: true };
   }
 }
-
-@ApiSecurity('api_key')
-@Controller('api/server/debug')
-@ApiTags('🔍 Observability')
-export class ServerDebugController {
-  private logger: Logger;
-  private readonly enabled: boolean;
-
-  constructor(protected config: WhatsappConfigService) {
-    this.logger = new Logger('ServerDebugController');
-    this.enabled = this.config.debugModeEnabled;
-  }
-
-  @Get('heapsnapshot')
-  @ApiOperation({
-    summary: 'Return a heapsnapshot',
-    description: "Return a heapsnapshot of the server's memory",
-  })
-  async heapsnapshot() {
-    if (!this.enabled) {
-      throw new NotFoundException('WAHA_DEBUG_MODE is disabled');
-    }
-    this.logger.log('Creating a heap snapshot...');
-    const heap = v8.getHeapSnapshot();
-    const fileName = `${Date.now()}.heapsnapshot`;
-    return new StreamableFile(heap, {
-      type: 'application/octet-stream',
-      disposition: `attachment; filename=${fileName}`,
-    });
-  }
-}

src/api/server.debug.controller.ts

@@ -0,0 +1,79 @@
+import * as v8 from 'node:v8';
+
+import {
+  Controller,
+  Get,
+  Logger,
+  NotFoundException,
+  Query,
+  StreamableFile,
+  UsePipes,
+} from '@nestjs/common';
+import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import { WhatsappConfigService } from '@waha/config.service';
+import { SessionManager } from '@waha/core/abc/manager.abc';
+import { WhatsappSession } from '@waha/core/abc/session.abc';
+import {
+  SessionApiParam,
+  WorkingSessionParam,
+} from '@waha/nestjs/params/SessionApiParam';
+import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
+import { BrowserTraceQuery } from '@waha/structures/server.debug.dto';
+import { createReadStream } from 'fs';
+
+@ApiSecurity('api_key')
+@Controller('api/server/debug')
+@ApiTags('🔍 Observability')
+export class ServerDebugController {
+  private logger: Logger;
+  private readonly enabled: boolean;
+
+  constructor(
+    private config: WhatsappConfigService,
+    private manager: SessionManager,
+  ) {
+    this.logger = new Logger('ServerDebugController');
+    this.enabled = this.config.debugModeEnabled;
+  }
+
+  @Get('heapsnapshot')
+  @ApiOperation({
+    summary: 'Return a heapsnapshot for the current nodejs process',
+    description: "Return a heapsnapshot of the server's memory",
+  })
+  async heapsnapshot() {
+    if (!this.enabled) {
+      throw new NotFoundException('WAHA_DEBUG_MODE is disabled');
+    }
+    this.logger.log('Creating a heap snapshot...');
+    const heap = v8.getHeapSnapshot();
+    const fileName = `${Date.now()}.heapsnapshot`;
+    return new StreamableFile(heap, {
+      type: 'application/octet-stream',
+      disposition: `attachment; filename=${fileName}`,
+    });
+  }
+
+  @Get('browser/trace/:session')
+  @ApiOperation({
+    summary: 'Collect and get a trace.json for Chrome DevTools ',
+    description: 'Uses https://pptr.dev/api/puppeteer.tracing',
+  })
+  @SessionApiParam
+  @UsePipes(new WAHAValidationPipe())
+  async browserTrace(
+    @WorkingSessionParam session: WhatsappSession,
+    @Query() query: BrowserTraceQuery,
+  ) {
+    if (!this.enabled) {
+      throw new NotFoundException('WAHA_DEBUG_MODE is disabled');
+    }
+    const filepath = await session.browserTrace(query);
+    const stream = createReadStream(filepath);
+    const filename = `trace - ${session.name} - ${new Date()}.json`;
+    return new StreamableFile(stream, {
+      type: 'application/octet-stream',
+      disposition: `attachment; filename=${filename}`,
+    });
+  }
+}

src/api/websocket.gateway.core.ts

@@ -12,6 +12,7 @@ import {
   WebSocketServer,
 } from '@nestjs/websockets';
 import { SessionManager } from '@waha/core/abc/manager.abc';
+import { WebSocketAuth } from '@waha/core/auth/WebSocketAuth';
 import { WebsocketHeartbeatJob } from '@waha/nestjs/ws/WebsocketHeartbeatJob';
 import { WebSocket } from '@waha/nestjs/ws/ws';
 import { WAHAEvents, WAHAEventsWild } from '@waha/structures/enums.dto';
@@ -21,6 +22,15 @@ import { IncomingMessage } from 'http';
 import * as url from 'url';
 import { Server } from 'ws';
 
+export enum WebSocketCloseCode {
+  NORMAL = 1000,
+  GOING_AWAY = 1001,
+  PROTOCOL_ERROR = 1002,
+  UNSUPPORTED_DATA = 1003,
+  POLICY_VIOLATION = 1008,
+  INTERNAL_ERROR = 1011,
+}
+
 @WebSocketGateway({
   path: '/ws',
   cors: true,
@@ -41,7 +51,10 @@ export class WebsocketGatewayCore
   private heartbeat: WebsocketHeartbeatJob;
   private eventUnmask = new EventWildUnmask(WAHAEvents, WAHAEventsWild);
 
-  constructor(private manager: SessionManager) {
+  constructor(
+    private manager: SessionManager,
+    private auth: WebSocketAuth,
+  ) {
     this.logger = new Logger('WebsocketGateway');
     this.heartbeat = new WebsocketHeartbeatJob(
       this.logger,
@@ -51,14 +64,23 @@ export class WebsocketGatewayCore
 
   handleConnection(socket: WebSocket, request: IncomingMessage, ...args): any {
     // wsc - websocket client
-    const id = generatePrefixedId('wsc');
-    socket.id = id;
-    this.logger.debug(`New client connected: ${request.url}`);
+    socket.id = generatePrefixedId('wsc');
+
+    if (!this.auth.validateRequest(request)) {
+      // Not authorized - close connection
+      socket.close(WebSocketCloseCode.POLICY_VIOLATION, 'Unauthorized');
+      this.logger.debug(
+        `Unauthorized websocket connection attempt: ${request.url} - ${socket.id}`,
+      );
+      return;
+    }
+
+    this.logger.debug(`New client connected: ${request.url} - ${socket.id}`);
     const params = this.getParams(request);
     const session: string = params.session;
     const events: WAHAEvents[] = params.events;
     this.logger.debug(
-      `Client connected to session: '${session}', events: ${events}, ${id}`,
+      `Client connected to session: '${session}', events: ${events}, ${socket.id}`,
     );
 
     const sub = this.manager
@@ -97,26 +119,11 @@ export class WebsocketGatewayCore
   async beforeApplicationShutdown(signal?: string) {
     this.logger.log('Shutting down websocket server');
     this.heartbeat?.stop();
-
     // Allow pending messages to be sent, it can be even 1ms, just to release the event loop
     await sleep(100);
-    // Close clients and server
-    await this.close(this.server);
     this.logger.log('Websocket server is down');
   }
 
-  // Cherry-pick from nestjs new version
-  // https://github.com/nestjs/nest/pull/13531/files
-  private async close(server: any) {
-    const closeEventSignal = new Promise((resolve, reject) =>
-      server.close((err) => (err ? reject(err) : resolve(undefined))),
-    );
-    for (const ws of server.clients) {
-      ws.terminate();
-    }
-    await closeEventSignal;
-  }
-
   afterInit(server: Server) {
     this.logger.debug('Websocket server initialized');
 

src/config.service.ts

@@ -138,7 +138,10 @@ export class WhatsappConfigService implements OnApplicationBootstrap {
   }
 
   getApiKey(): string | undefined {
-    return this.configService.get('WHATSAPP_API_KEY', '');
+    return (
+      this.configService.get('WHATSAPP_API_KEY', '') ||
+      this.configService.get('WAHA_API_KEY', '')
+    );
   }
 
   getExcludedPaths(): string[] {

src/core/SwaggerConfiguratorCore.ts

@@ -1,6 +1,8 @@
 import { INestApplication } from '@nestjs/common';
 import { DocumentBuilder, OpenAPIObject, SwaggerModule } from '@nestjs/swagger';
 import { DECORATORS } from '@nestjs/swagger/dist/constants';
+import { BasicAuthFunction } from '@waha/core/auth/basicAuth';
+import { DashboardConfigServiceCore } from '@waha/core/config/DashboardConfigServiceCore';
 import { Logger } from 'nestjs-pino';
 
 import { WhatsappConfigService } from '../config.service';
@@ -9,16 +11,22 @@ import { SwaggerConfigServiceCore } from './config/SwaggerConfigServiceCore';
 
 export class SwaggerConfiguratorCore {
   protected logger: any;
+  private config: SwaggerConfigServiceCore;
 
   constructor(protected app: INestApplication) {
     this.logger = app.get(Logger);
+    this.config = app.get(SwaggerConfigServiceCore);
   }
 
   get title() {
-    return 'WAHA - WhatsApp HTTP API';
+    return this.config.title || 'WAHA - WhatsApp HTTP API';
   }
 
   get description() {
+    if (this.config.description) {
+      return this.config.description;
+    }
+
     return (
       '<b>WhatsApp HTTP API</b> that you can run in a click!<br/>' +
       '<a href="/dashboard"><b>📊 Dashboard</b></a><br/>' +
@@ -43,10 +51,19 @@ export class SwaggerConfiguratorCore {
   }
 
   get externalDocUrl() {
-    return 'https://waha.devlike.pro/';
+    return this.config.externalDocUrl || 'https://waha.devlike.pro/';
   }
 
   configure(webhooks: any[]) {
+    if (!this.config.enabled) {
+      return;
+    }
+
+    const credentials = this.config.credentials;
+    if (credentials) {
+      this.setUpAuth(credentials);
+    }
+
     const app = this.app;
     const builder = new DocumentBuilder();
 
@@ -163,4 +180,12 @@ export class SwaggerConfiguratorCore {
     document.webhooks = webhooks;
     return document;
   }
+
+  setUpAuth(credentials: [string, string]): void {
+    const [username, password] = credentials;
+    const dashboardConfig = this.app.get(DashboardConfigServiceCore);
+    const exclude = ['/api/', dashboardConfig.dashboardUri, '/health', '/ws'];
+    const authFunction = BasicAuthFunction(username, password, exclude);
+    this.app.use(authFunction);
+  }
 }

src/core/abc/manager.abc.ts

@@ -57,6 +57,7 @@ export abstract class SessionManager
     protected gowsConfigService: GowsEngineConfigService,
   ) {
     this.lock = new AsyncLock({
+      timeout: 5_000,
       maxPending: Infinity,
       maxExecutionTime: 30_000,
     });

src/core/abc/session.abc.ts

@@ -30,6 +30,7 @@ import { Label, LabelDTO, LabelID } from '@waha/structures/labels.dto';
 import { LidToPhoneNumber } from '@waha/structures/lids.dto';
 import { PaginationParams } from '@waha/structures/pagination.dto';
 import { MessageSource, WAMessage } from '@waha/structures/responses.dto';
+import { BrowserTraceQuery } from '@waha/structures/server.debug.dto';
 import { DefaultMap } from '@waha/utils/DefaultMap';
 import { generatePrefixedId } from '@waha/utils/ids';
 import { LoggerBuilder } from '@waha/utils/logging';
@@ -285,7 +286,6 @@ export abstract class WhatsappSession {
       '--aggressive-cache-discard',
       '--disable-accelerated-2d-canvas',
       '--disable-application-cache',
-      // '--disable-background-networking', // COMMENTED to test WEBJS stability
       // DO NOT disable software rasterizer, it will break the video
       // https://github.com/devlikeapro/waha/issues/629
       // '--disable-software-rasterizer',
@@ -296,7 +296,7 @@ export abstract class WhatsappSession {
       '--disable-dev-shm-usage',
       '--disable-extensions',
       // '--disable-features=site-per-process', // COMMENTED to test WEBJS stability
-      //'--disable-gpu', // COMMENTED to test WEBJS stability
+      '--disable-gpu', // COMMENTED to test WEBJS stability
       '--disable-offer-store-unmasked-wallet-cards',
       '--disable-offline-load-stale-cache',
       '--disable-popup-blocking',
@@ -320,9 +320,8 @@ export abstract class WhatsappSession {
       '--no-sandbox',
       '--no-zygote',
       '--password-store=basic',
-      // '--renderer-process-limit=2', // COMMENTED to test WEBJS stability
+      '--renderer-process-limit=1',
       '--safebrowsing-disable-auto-update',
-      // '--single-process',
       '--use-mock-keychain',
       '--window-size=1280,720',
     ];
@@ -351,6 +350,10 @@ export abstract class WhatsappSession {
    * START - Methods for API
    */
 
+  public browserTrace(query: BrowserTraceQuery): Promise<string> {
+    throw new NotImplementedByEngineError();
+  }
+
   /**
    * Auth methods
    */
@@ -682,10 +685,17 @@ export abstract class WhatsappSession {
   }
 
   protected async refreshProfilePicture(id: string) {
-    let fn: Promise<string>;
-    if (isJidBroadcast(id)) {
+    this.logger.debug(`Refreshing profile picture for id "${id}"...`);
+    // Have no pictures
+    if (id === '0@c.us' || id === '0@s.whatsapp.net') {
       return null;
-    } else if (isJidNewsletter(id)) {
+    } else if (isJidBroadcast(id)) {
+      return null;
+    }
+
+    // Find the right method
+    let fn: Promise<string>;
+    if (isJidNewsletter(id)) {
       fn = this.channelsGetChannel(id).then(
         (channel: Channel) => channel.picture || channel.preview,
       );

src/core/app.module.core.ts

@@ -1,4 +1,7 @@
-import { INestApplication, Module } from '@nestjs/common';
+import * as process from 'node:process';
+
+import { INestApplication, MiddlewareConsumer, Module } from '@nestjs/common';
+import { Provider } from '@nestjs/common/interfaces/modules/provider.interface';
 import { ConfigModule } from '@nestjs/config';
 import { APP_INTERCEPTOR } from '@nestjs/core';
 import { PassportModule } from '@nestjs/passport';
@@ -7,24 +10,31 @@ import { TerminusModule } from '@nestjs/terminus';
 import { ChannelsController } from '@waha/api/channels.controller';
 import { LidsController } from '@waha/api/lids.controller';
 import { ProfileController } from '@waha/api/profile.controller';
-import {
-  ServerController,
-  ServerDebugController,
-} from '@waha/api/server.controller';
-import { WebsocketGatewayCore } from '@waha/core/api/websocket.gateway.core';
+import { ServerController } from '@waha/api/server.controller';
+import { ServerDebugController } from '@waha/api/server.debug.controller';
+import { WebsocketGatewayCore } from '@waha/api/websocket.gateway.core';
+import { ApiKeyStrategy } from '@waha/core/auth/apiKey.strategy';
+import { IApiKeyAuth } from '@waha/core/auth/auth';
+import { AuthMiddleware } from '@waha/core/auth/auth.middleware';
+import { BasicAuthFunction } from '@waha/core/auth/basicAuth';
+import { WebSocketAuth } from '@waha/core/auth/WebSocketAuth';
 import { GowsEngineConfigService } from '@waha/core/config/GowsEngineConfigService';
 import { WebJSEngineConfigService } from '@waha/core/config/WebJSEngineConfigService';
 import { MediaLocalStorageModule } from '@waha/core/media/local/media.local.storage.module';
 import { MediaLocalStorageConfig } from '@waha/core/media/local/MediaLocalStorageConfig';
 import { ChannelsInfoServiceCore } from '@waha/core/services/ChannelsInfoServiceCore';
+import { parseBool } from '@waha/helpers';
 import { BufferJsonReplacerInterceptor } from '@waha/nestjs/BufferJsonReplacerInterceptor';
+import { HttpsExpress } from '@waha/nestjs/HttpsExpress';
 import {
   getPinoHttpUseLevel,
   getPinoLogLevel,
   getPinoTransport,
 } from '@waha/utils/logging';
+import { noSlashAtTheEnd } from '@waha/utils/string';
 import * as Joi from 'joi';
 import { LoggerModule } from 'nestjs-pino';
+import { Logger as NestJSPinoLogger } from 'nestjs-pino';
 import { join } from 'path';
 import { Logger } from 'pino';
 
@@ -46,6 +56,7 @@ import { VersionController } from '../api/version.controller';
 import { WhatsappConfigService } from '../config.service';
 import { SessionManager } from './abc/manager.abc';
 import { WAHAHealthCheckService } from './abc/WAHAHealthCheckService';
+import { ApiKeyAuthFactory } from './auth/ApiKeyAuthFactory';
 import { DashboardConfigServiceCore } from './config/DashboardConfigServiceCore';
 import { EngineConfigService } from './config/EngineConfigService';
 import { SwaggerConfigServiceCore } from './config/SwaggerConfigServiceCore';
@@ -63,6 +74,7 @@ export const IMPORTS_CORE = [
       autoLogging: {
         ignore: (req) => {
           return (
+            req.url.startsWith('/ping') ||
             req.url.startsWith('/dashboard/') ||
             req.url.startsWith('/api/files/') ||
             req.url.startsWith('/api/s3/')
@@ -144,6 +156,28 @@ export const CONTROLLERS = [
   VersionController,
   MediaController,
 ];
+export const PROVIDERS_BASE: Provider[] = [
+  {
+    provide: APP_INTERCEPTOR,
+    useClass: BufferJsonReplacerInterceptor,
+  },
+  DashboardConfigServiceCore,
+  SwaggerConfigServiceCore,
+  WebJSEngineConfigService,
+  GowsEngineConfigService,
+  WhatsappConfigService,
+  EngineConfigService,
+  WebsocketGatewayCore,
+  MediaLocalStorageConfig,
+  WebSocketAuth,
+  ApiKeyStrategy,
+  {
+    provide: IApiKeyAuth,
+    useFactory: ApiKeyAuthFactory,
+    inject: [WhatsappConfigService, NestJSPinoLogger],
+  },
+];
+
 const PROVIDERS = [
   {
     provide: SessionManager,
@@ -153,19 +187,8 @@ const PROVIDERS = [
     provide: WAHAHealthCheckService,
     useClass: WAHAHealthCheckServiceCore,
   },
-  {
-    provide: APP_INTERCEPTOR,
-    useClass: BufferJsonReplacerInterceptor,
-  },
   ChannelsInfoServiceCore,
-  DashboardConfigServiceCore,
-  SwaggerConfigServiceCore,
-  WebJSEngineConfigService,
-  GowsEngineConfigService,
-  WhatsappConfigService,
-  EngineConfigService,
-  WebsocketGatewayCore,
-  MediaLocalStorageConfig,
+  ...PROVIDERS_BASE,
 ];
 
 @Module({
@@ -176,15 +199,44 @@ const PROVIDERS = [
 export class AppModuleCore {
   public startTimestamp: number;
 
-  constructor(protected config: WhatsappConfigService) {
+  constructor(
+    protected config: WhatsappConfigService,
+    private dashboardConfig: DashboardConfigServiceCore,
+  ) {
     this.startTimestamp = Date.now();
   }
 
   static getHttpsOptions(logger: Logger) {
-    return undefined;
+    const httpsEnabled = parseBool(process.env.WAHA_HTTPS_ENABLED);
+    if (!httpsEnabled) {
+      return undefined;
+    }
+    const httpsExpress = new HttpsExpress(logger);
+    return httpsExpress.readSync();
   }
 
   static appReady(app: INestApplication, logger: Logger) {
-    return;
+    const httpsEnabled = parseBool(process.env.WAHA_HTTPS_ENABLED);
+    if (!httpsEnabled) {
+      return;
+    }
+    const httpd = app.getHttpServer();
+    const httpsExpress = new HttpsExpress(logger);
+    httpsExpress.watchCertChanges(httpd);
+  }
+
+  configure(consumer: MiddlewareConsumer) {
+    const exclude = this.config.getExcludedPaths();
+    consumer
+      .apply(AuthMiddleware)
+      .exclude(...exclude)
+      .forRoutes('api', 'health', 'ws');
+    const dashboardCredentials = this.dashboardConfig.credentials;
+    if (dashboardCredentials) {
+      const username = dashboardCredentials[0];
+      const password = dashboardCredentials[1];
+      const route = noSlashAtTheEnd(this.dashboardConfig.dashboardUri);
+      consumer.apply(BasicAuthFunction(username, password)).forRoutes(route);
+    }
   }
 }

src/core/auth/ApiKeyAuthFactory.ts

@@ -0,0 +1,53 @@
+import { LoggerService } from '@nestjs/common';
+import { WhatsappConfigService } from '@waha/config.service';
+import {
+  HashAuth,
+  IApiKeyAuth,
+  NoAuth,
+  PlainApiKeyAuth,
+} from '@waha/core/auth/auth';
+
+export function ApiKeyAuthFactory(
+  config: WhatsappConfigService,
+  logger: LoggerService,
+): IApiKeyAuth {
+  const apiKey = config.getApiKey();
+  if (!apiKey) {
+    setTimeout(() => {
+      logger.warn('🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫');
+      logger.warn('WARNING: No API key detected. This is a security risk.');
+      logger.warn(
+        'Your API is publicly accessible without any authentication.',
+      );
+      logger.warn(
+        'To secure your API, set environment variable: WAHA_API_KEY=your_api_key',
+      );
+      logger.warn(
+        'For better security, use WAHA_API_KEY=sha512:{SHA512_HASH_FOR_YOUR_API_KEY}',
+      );
+      logger.warn('🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫🚫');
+    }, 3000);
+    return new NoAuth();
+  }
+
+  if (apiKey.startsWith('sha512:')) {
+    const hash = apiKey.slice(7);
+    return new HashAuth(hash, 'sha512');
+  }
+
+  // Fallback to plain text
+  setTimeout(() => {
+    logger.warn('⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️');
+    logger.warn(
+      'WARNING: Plain text API key detected. This is a security risk.',
+    );
+    logger.warn(
+      'Your API key can be exposed in environment variables or process lists.',
+    );
+    logger.warn(
+      'For better security, use WAHA_API_KEY=sha512:{SHA512_HASH_FOR_YOUR_API_KEY}',
+    );
+    logger.warn('⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️');
+  }, 2000);
+  return new PlainApiKeyAuth(apiKey);
+}

src/core/auth/WebSocketAuth.ts

@@ -0,0 +1,34 @@
+import { Injectable } from '@nestjs/common';
+import { IncomingMessage } from 'http';
+import * as url from 'url';
+
+import { IApiKeyAuth } from './auth';
+
+@Injectable()
+export class WebSocketAuth {
+  constructor(private auth: IApiKeyAuth) {}
+
+  validateRequest(request: IncomingMessage) {
+    if (this.auth.skipAuth()) {
+      return true;
+    }
+    const provided = this.getKeyFromQueryParams(request);
+    return this.auth.isValid(provided);
+  }
+
+  private getKeyFromQueryParams(request: IncomingMessage) {
+    let query = url.parse(request.url, true).query;
+    // case-insensitive query params
+    query = Object.keys(query).reduce((acc, key) => {
+      acc[key.toLowerCase()] = query[key];
+      return acc;
+    }, {});
+
+    const provided = query['x-api-key'];
+    // Check if it's array - return first
+    if (Array.isArray(provided)) {
+      return provided[0];
+    }
+    return provided;
+  }
+}

src/core/auth/apiKey.strategy.ts

@@ -0,0 +1,19 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { IApiKeyAuth } from '@waha/core/auth/auth';
+import { HeaderAPIKeyStrategy } from 'passport-headerapikey';
+
+@Injectable()
+export class ApiKeyStrategy extends PassportStrategy(HeaderAPIKeyStrategy) {
+  constructor(private auth: IApiKeyAuth) {
+    super({ header: 'X-Api-Key', prefix: '' }, true, (apikey, done) => {
+      const isValid = this.auth.isValid(apikey);
+      return done(isValid);
+    });
+  }
+
+  validate(apikey: string, done: (result: boolean) => void): void {
+    const isValid = this.auth.isValid(apikey);
+    return done(isValid);
+  }
+}

src/core/auth/auth.middleware.ts

@@ -0,0 +1,28 @@
+import {
+  Injectable,
+  NestMiddleware,
+  UnauthorizedException,
+} from '@nestjs/common';
+import * as passport from 'passport';
+
+import { IApiKeyAuth } from './auth';
+
+@Injectable()
+export class AuthMiddleware implements NestMiddleware {
+  constructor(private auth: IApiKeyAuth) {}
+
+  use(req: any, res: any, next: () => void) {
+    // Skip authentication if auth says so
+    if (this.auth.skipAuth()) {
+      next();
+      return;
+    }
+
+    passport.authenticate('headerapikey', { session: false }, (value) => {
+      if (!value) {
+        throw new UnauthorizedException();
+      }
+      next();
+    })(req, res, next);
+  }
+}

src/core/auth/auth.ts

@@ -0,0 +1,79 @@
+import * as crypto from 'crypto';
+
+export abstract class IApiKeyAuth {
+  abstract isValid(plain: string): boolean;
+
+  abstract skipAuth(): boolean;
+}
+
+export class NoAuth implements IApiKeyAuth {
+  isValid(plain: string): boolean {
+    return true;
+  }
+
+  skipAuth(): boolean {
+    return true;
+  }
+}
+
+export class PlainApiKeyAuth implements IApiKeyAuth {
+  constructor(private key: string) {}
+
+  isValid(plain: string): boolean {
+    return compare(plain, this.key);
+  }
+
+  skipAuth(): boolean {
+    return false;
+  }
+}
+
+export class HashAuth implements IApiKeyAuth {
+  constructor(
+    private hash: string,
+    private algorithm: string,
+  ) {
+    this.algorithm = algorithm;
+  }
+
+  isValid(plain: string): boolean {
+    if (!plain) {
+      return false;
+    }
+    const hash = crypto.createHash(this.algorithm).update(plain).digest('hex');
+    return compare(hash, this.hash);
+  }
+
+  skipAuth(): boolean {
+    return false;
+  }
+}
+
+/**
+ * Securely compare 2 strings
+ */
+export function compare(provided: string, stored: string | undefined): boolean {
+  if (!stored || !provided) {
+    return false;
+  }
+
+  try {
+    // Convert strings to buffers for constant-time comparison
+    const providedBuffer = Buffer.from(provided);
+    const storedBuffer = Buffer.from(stored);
+
+    // If lengths are different, return false but use a dummy comparison to prevent timing attacks
+    if (providedBuffer.length !== storedBuffer.length) {
+      // Create a dummy buffer of the same length as the provided key
+      const dummyBuffer = Buffer.alloc(providedBuffer.length);
+      // Perform comparison with dummy buffer to maintain constant time
+      crypto.timingSafeEqual(providedBuffer, dummyBuffer);
+      return false;
+    }
+
+    // Perform constant-time comparison
+    return crypto.timingSafeEqual(providedBuffer, storedBuffer);
+  } catch (error) {
+    return false;
+  }
+}

src/core/auth/basicAuth.ts

@@ -0,0 +1,21 @@
+import * as basicAuth from 'express-basic-auth';
+
+export function BasicAuthFunction(username, password, exclude: string[] = []) {
+  function authFunction(req, res, next) {
+    const ignore = exclude.filter((url) => req.url.startsWith(url)).length > 0;
+    if (ignore) {
+      next();
+      return;
+    }
+
+    const auth = basicAuth({
+      challenge: true,
+      users: {
+        [username]: password,
+      },
+    });
+    auth(req, res, next);
+  }
+
+  return authFunction;
+}

src/core/config/DashboardConfigServiceCore.ts

@@ -18,4 +18,20 @@ export class DashboardConfigServiceCore {
     const value = this.configService.get('WAHA_DASHBOARD_ENABLED', 'true');
     return parseBool(value);
   }
+
+  get credentials(): [string, string] | null {
+    const user = this.configService.get('WAHA_DASHBOARD_USERNAME', '');
+    const password = this.configService.get('WAHA_DASHBOARD_PASSWORD', '');
+    if (!user && !password) {
+      return null;
+    }
+    if ((user && !password) || (!user && password)) {
+      this.logger.warn(
+        'Set up both WAHA_DASHBOARD_USERNAME and WAHA_DASHBOARD_PASSWORD ' +
+          'to enable dashboard authentication.',
+      );
+      return null;
+    }
+    return [user, password];
+  }
 }

src/core/config/SwaggerConfigServiceCore.ts

@@ -19,4 +19,43 @@ export class SwaggerConfigServiceCore {
     );
     return parseBool(value);
   }
+
+  get enabled(): boolean {
+    const value = this.configService.get('WHATSAPP_SWAGGER_ENABLED', 'true');
+    return parseBool(value);
+  }
+
+  get credentials(): [string, string] | undefined {
+    const user = this.configService.get<string>(
+      'WHATSAPP_SWAGGER_USERNAME',
+      undefined,
+    );
+    const password = this.configService.get<string>(
+      'WHATSAPP_SWAGGER_PASSWORD',
+      undefined,
+    );
+    if (!user && !password) {
+      return null;
+    }
+    if ((user && !password) || (!user && password)) {
+      this.logger.warn(
+        'Set up both WHATSAPP_SWAGGER_USERNAME and WHATSAPP_SWAGGER_PASSWORD ' +
+          'to enable swagger authentication.',
+      );
+      return null;
+    }
+    return [user, password];
+  }
+
+  get title() {
+    return this.configService.get('WHATSAPP_SWAGGER_TITLE', '');
+  }
+
+  get description() {
+    return this.configService.get('WHATSAPP_SWAGGER_DESCRIPTION', '');
+  }
+
+  get externalDocUrl() {
+    return this.configService.get('WHATSAPP_SWAGGER_EXTERNAL_DOC_URL', '');
+  }
 }

src/core/engines/gows/grpc/gows.ts

@@ -7031,6 +7031,8 @@ export namespace messages {
         constructor(data?: any[] | {
             session?: Session;
             message?: string;
+            jid?: string;
+            messageId?: string;
         }) {
             super();
             pb_1.Message.initialize(this, Array.isArray(data) ? data : [], 0, -1, [], this.#one_of_decls);
@@ -7041,6 +7043,12 @@ export namespace messages {
                 if ("message" in data && data.message != undefined) {
                     this.message = data.message;
                 }
+                if ("jid" in data && data.jid != undefined) {
+                    this.jid = data.jid;
+                }
+                if ("messageId" in data && data.messageId != undefined) {
+                    this.messageId = data.messageId;
+                }
             }
         }
         get session() {
@@ -7058,9 +7066,23 @@ export namespace messages {
         set message(value: string) {
             pb_1.Message.setField(this, 2, value);
         }
+        get jid() {
+            return pb_1.Message.getFieldWithDefault(this, 3, "") as string;
+        }
+        set jid(value: string) {
+            pb_1.Message.setField(this, 3, value);
+        }
+        get messageId() {
+            return pb_1.Message.getFieldWithDefault(this, 4, "") as string;
+        }
+        set messageId(value: string) {
+            pb_1.Message.setField(this, 4, value);
+        }
         static fromObject(data: {
             session?: ReturnType<typeof Session.prototype.toObject>;
             message?: string;
+            jid?: string;
+            messageId?: string;
         }): DownloadMediaRequest {
             const message = new DownloadMediaRequest({});
             if (data.session != null) {
@@ -7069,12 +7091,20 @@ export namespace messages {
             if (data.message != null) {
                 message.message = data.message;
             }
+            if (data.jid != null) {
+                message.jid = data.jid;
+            }
+            if (data.messageId != null) {
+                message.messageId = data.messageId;
+            }
             return message;
         }
         toObject() {
             const data: {
                 session?: ReturnType<typeof Session.prototype.toObject>;
                 message?: string;
+                jid?: string;
+                messageId?: string;
             } = {};
             if (this.session != null) {
                 data.session = this.session.toObject();
@@ -7082,6 +7112,12 @@ export namespace messages {
             if (this.message != null) {
                 data.message = this.message;
             }
+            if (this.jid != null) {
+                data.jid = this.jid;
+            }
+            if (this.messageId != null) {
+                data.messageId = this.messageId;
+            }
             return data;
         }
         serialize(): Uint8Array;
@@ -7092,6 +7128,10 @@ export namespace messages {
                 writer.writeMessage(1, this.session, () => this.session.serialize(writer));
             if (this.message.length)
                 writer.writeString(2, this.message);
+            if (this.jid.length)
+                writer.writeString(3, this.jid);
+            if (this.messageId.length)
+                writer.writeString(4, this.messageId);
             if (!w)
                 return writer.getResultBuffer();
         }
@@ -7107,6 +7147,12 @@ export namespace messages {
                     case 2:
                         message.message = reader.readString();
                         break;
+                    case 3:
+                        message.jid = reader.readString();
+                        break;
+                    case 4:
+                        message.messageId = reader.readString();
+                        break;
                     default: reader.skipField();
                 }
             }

src/core/engines/gows/grpc/gows_pb.js

@@ -14889,7 +14889,9 @@ proto.messages.DownloadMediaRequest.prototype.toObject = function(opt_includeIns
 proto.messages.DownloadMediaRequest.toObject = function(includeInstance, msg) {
   var f, obj = {
     session: (f = msg.getSession()) && proto.messages.Session.toObject(includeInstance, f),
-    message: jspb.Message.getFieldWithDefault(msg, 2, "")
+    message: jspb.Message.getFieldWithDefault(msg, 2, ""),
+    jid: jspb.Message.getFieldWithDefault(msg, 3, ""),
+    messageid: jspb.Message.getFieldWithDefault(msg, 4, "")
   };
 
   if (includeInstance) {
@@ -14935,6 +14937,14 @@ proto.messages.DownloadMediaRequest.deserializeBinaryFromReader = function(msg,
       var value = /** @type {string} */ (reader.readString());
       msg.setMessage(value);
       break;
+    case 3:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setJid(value);
+      break;
+    case 4:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setMessageid(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -14979,6 +14989,20 @@ proto.messages.DownloadMediaRequest.serializeBinaryToWriter = function(message,
       f
     );
   }
+  f = message.getJid();
+  if (f.length > 0) {
+    writer.writeString(
+      3,
+      f
+    );
+  }
+  f = message.getMessageid();
+  if (f.length > 0) {
+    writer.writeString(
+      4,
+      f
+    );
+  }
 };
 
 
@@ -15037,6 +15061,42 @@ proto.messages.DownloadMediaRequest.prototype.setMessage = function(value) {
 };
 
 
+/**
+ * optional string jid = 3;
+ * @return {string}
+ */
+proto.messages.DownloadMediaRequest.prototype.getJid = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 3, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.messages.DownloadMediaRequest} returns this
+ */
+proto.messages.DownloadMediaRequest.prototype.setJid = function(value) {
+  return jspb.Message.setProto3StringField(this, 3, value);
+};
+
+
+/**
+ * optional string messageId = 4;
+ * @return {string}
+ */
+proto.messages.DownloadMediaRequest.prototype.getMessageid = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 4, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.messages.DownloadMediaRequest} returns this
+ */
+proto.messages.DownloadMediaRequest.prototype.setMessageid = function(value) {
+  return jspb.Message.setProto3StringField(this, 4, value);
+};
+
+
 
 
 

src/core/engines/gows/session.gows.core.ts

@@ -129,6 +129,8 @@ import {
   EnginePayload,
   PollVotePayload,
   WAMessageAckBody,
+  WAMessageEditedBody,
+  WAMessageRevokedBody,
 } from '@waha/structures/webhooks.dto';
 import { PaginatorInMemory } from '@waha/utils/Paginator';
 import { sleep, waitUntil } from '@waha/utils/promiseTimeout';
@@ -407,6 +409,53 @@ export class WhatsappSessionGoWSCore extends WhatsappSession {
     this.events2.get(WAHAEvents.MESSAGE).switch(messagesFromOthers$);
     this.events2.get(WAHAEvents.MESSAGE_ANY).switch(messagesFromAll$);
 
+    // Handle revoked messages
+    const messagesRevoked$ = messages$.pipe(
+      filter((msg) => {
+        return (
+          msg?.Message?.protocolMessage?.type === 0 &&
+          msg?.Message?.protocolMessage?.key !== undefined
+        );
+      }),
+      mergeMap(async (message): Promise<WAMessageRevokedBody> => {
+        const afterMessage = await this.toWAMessage(message);
+        // Extract the revoked message ID from protocolMessage.key
+        const revokedMessageId = message.Message.protocolMessage.key?.ID;
+        return {
+          after: afterMessage,
+          before: null,
+          revokedMessageId: revokedMessageId,
+          _data: message,
+        };
+      }),
+    );
+    this.events2.get(WAHAEvents.MESSAGE_REVOKED).switch(messagesRevoked$);
+
+    // Handle edited messages
+    const messagesEdited$ = messages$.pipe(
+      filter((msg) => {
+        return (
+          msg?.Message?.protocolMessage?.type === 14 &&
+          msg?.Message?.protocolMessage?.editedMessage !== undefined
+        );
+      }),
+      mergeMap(async (message): Promise<WAMessageEditedBody> => {
+        const waMessage = await this.toWAMessage(message);
+        // Extract the body from editedMessage using extractBody function
+        const body =
+          this.extractBody(message.Message.protocolMessage.editedMessage) || '';
+        // Extract the original message ID from protocolMessage.key
+        const editedMessageId = message.Message.protocolMessage.key?.ID;
+        return {
+          ...waMessage,
+          body: body,
+          editedMessageId: editedMessageId,
+          _data: message,
+        };
+      }),
+    );
+    this.events2.get(WAHAEvents.MESSAGE_EDITED).switch(messagesEdited$);
+
     const receipt$ = all$.pipe(onlyEvent(WhatsMeowEvent.RECEIPT));
     const messageAck$ = receipt$.pipe(
       mergeMap(this.receiptToMessageAck.bind(this)),
@@ -2103,6 +2152,8 @@ export class GOWSEngineMediaProcessor implements IMediaEngineProcessor<any> {
       // double "session" it's not a mistake here
       session: this.session.session,
       message: data,
+      jid: message.Info.Chat,
+      messageId: message.Info.ID,
     });
     const response = await promisify(this.session.client.DownloadMedia)(
       request,

src/core/engines/noweb/session.noweb.core.ts

@@ -159,6 +159,7 @@ import {
   PollVote,
   PollVotePayload,
   WAMessageAckBody,
+  WAMessageEditedBody,
   WAMessageRevokedBody,
 } from '@waha/structures/webhooks.dto';
 import { LoggerBuilder } from '@waha/utils/logging';
@@ -595,7 +596,8 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
         if (
           protocolMsg !== null &&
           protocolMsg !== undefined &&
-          protocolMsg.editedMessage
+          protocolMsg.editedMessage &&
+          protocolMsg.key
         ) {
           this.sock?.ev.emit('messages.update', [
             {
@@ -1803,6 +1805,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     const messagesUpsert$ = fromEvent(this.sock.ev, 'messages.upsert').pipe(
       map((event: BaileysEventMap['messages.upsert']) => event.messages),
       mergeAll(),
+      share(),
     );
     let [messagesFromMe$, messagesFromOthers$] = partition(
       messagesUpsert$,
@@ -1829,15 +1832,45 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
       ),
       mergeMap(async (message): Promise<WAMessageRevokedBody> => {
         const afterMessage = await this.toWAMessage(message);
+        // Extract the revoked message ID from protocolMessage.key
+        const revokedMessageId = message.message.protocolMessage.key?.id;
         return {
           after: afterMessage,
           before: null,
+          revokedMessageId: revokedMessageId,
           _data: message,
         };
       }),
     );
     this.events2.get(WAHAEvents.MESSAGE_REVOKED).switch(messagesRevoked$);
 
+    // Handle edited messages
+    // @ts-ignore
+    const messagesEdited$ = messagesUpsert$.pipe(
+      filter(
+        (message) =>
+          // @ts-ignore
+          message.message?.protocolMessage?.type ===
+            proto.Message.ProtocolMessage.Type.MESSAGE_EDIT &&
+          message.message?.protocolMessage?.editedMessage !== undefined,
+      ),
+      mergeMap(async (message): Promise<WAMessageEditedBody> => {
+        const waMessage = await this.toWAMessage(message);
+        // Extract the body from editedMessage using extractBody function
+        const body =
+          this.extractBody(message.message.protocolMessage.editedMessage) || '';
+        // Extract the original message ID from protocolMessage.key
+        const editedMessageId = message.message.protocolMessage.key?.id;
+        return {
+          ...waMessage,
+          body: body,
+          editedMessageId: editedMessageId,
+          _data: message,
+        };
+      }),
+    );
+    this.events2.get(WAHAEvents.MESSAGE_EDITED).switch(messagesEdited$);
+
     //
     // Message Reactions
     //
@@ -1856,6 +1889,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     ).pipe(
       // @ts-ignore
       mergeAll(),
+      share(),
     );
     const messageAckDirect$ = messageUpdates$.pipe(
       filter(isMine), // ack comes only for MY messages
@@ -1866,6 +1900,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
       fromEvent(this.sock.ev, 'message-receipt.update').pipe(
         // @ts-ignore
         mergeAll(),
+        share(),
       );
 
     const messageAckGroups$ = messageReceiptUpdate$.pipe(
@@ -1882,7 +1917,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     //
     this.events2
       .get(WAHAEvents.STATE_CHANGE)
-      .switch(fromEvent(this.sock.ev, 'connection.update'));
+      .switch(fromEvent(this.sock.ev, 'connection.update').pipe(share()));
 
     const groupsUpsert$: Observable<GroupMetadata> = fromEvent(
       this.sock.ev,
@@ -1890,6 +1925,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     ).pipe(
       // @ts-ignore
       mergeAll(),
+      share(),
     );
     const groupsUpdate$: Observable<Partial<GroupMetadata>> = fromEvent(
       this.sock.ev,
@@ -1897,11 +1933,12 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     ).pipe(
       // @ts-ignore
       mergeAll(),
+      share(),
     );
     const groupsParticipantsUpdate$: Observable<any> = fromEvent(
       this.sock.ev,
       'group-participants.update',
-    );
+    ).pipe(share());
 
     this.events2.get(WAHAEvents.GROUP_JOIN).switch(groupsUpsert$);
 
@@ -1928,13 +1965,12 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     );
     this.events2.get(WAHAEvents.GROUP_V2_LEAVE).switch(groupV2Leave$);
 
-    this.events2
-      .get(WAHAEvents.PRESENCE_UPDATE)
-      .switch(
-        fromEvent(this.sock.ev, 'presence.update').pipe(
-          map((data: any) => this.toWahaPresences(data.id, data.presences)),
-        ),
-      );
+    this.events2.get(WAHAEvents.PRESENCE_UPDATE).switch(
+      fromEvent(this.sock.ev, 'presence.update').pipe(
+        map((data: any) => this.toWahaPresences(data.id, data.presences)),
+        share(),
+      ),
+    );
 
     //
     // Poll votes
@@ -1961,7 +1997,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     //
     // @ts-ignore
     const calls$: Observable<WACallEvent[]> = fromEvent(this.sock.ev, 'call');
-    const call$ = calls$.pipe(mergeMap(identity));
+    const call$ = calls$.pipe(mergeMap(identity), share());
     this.events2.get(WAHAEvents.CALL_RECEIVED).switch(
       call$.pipe(
         filter((call: WACallEvent) => call.status === 'offer'),
@@ -1994,7 +2030,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     const labelsEdit$: Observable<NOWEBLabel> = fromEvent(
       this.sock.ev,
       'labels.edit',
-    );
+    ).pipe(share());
     this.events2.get(WAHAEvents.LABEL_UPSERT).switch(
       labelsEdit$.pipe(
         exclude((data: NOWEBLabel) => data.deleted),
@@ -2007,7 +2043,10 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
         map(this.toLabel.bind(this)),
       ),
     );
-    const labelsAssociation$ = fromEvent(this.sock.ev, 'labels.association');
+    const labelsAssociation$ = fromEvent(
+      this.sock.ev,
+      'labels.association',
+    ).pipe(share());
     const labelsAssociationAdd$: Observable<ChatLabelAssociation> =
       labelsAssociation$.pipe(
         filter(({ type }: any) => type === 'add'),
@@ -2101,12 +2140,18 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     if (message.message.pollUpdateMessage) return;
     // Ignore calls, we have dedicated handler for that
     if (message.message.call?.callKey) return;
-    // Ignore revoke, we have a dedicated handler for that
+    // Ignore revoke, we have a dedicated event for that
     if (
       message.message?.protocolMessage?.type ===
       proto.Message.ProtocolMessage.Type.REVOKE
     )
       return;
+    // Ignore edit, we have a dedicated event for that
+    if (
+      message.message?.protocolMessage?.type ===
+      proto.Message.ProtocolMessage.Type.MESSAGE_EDIT
+    )
+      return;
     if (
       message.message?.protocolMessage?.type ===
       proto.Message.ProtocolMessage.Type.EPHEMERAL_SYNC_RESPONSE

src/core/engines/noweb/store/NowebPersistentStore.ts

@@ -64,11 +64,13 @@ export class NowebPersistentStore implements INowebStore {
   public presences: any;
 
   private lock: any = new AsyncLock({
+    timeout: 5_000,
     maxPending: Infinity,
     maxExecutionTime: 60_000,
   });
 
   private groupsFetchLock: any = new AsyncLock({
+    timeout: 5_000,
     maxPending: Infinity,
     maxExecutionTime: 60_000,
   });

src/core/engines/noweb/store/sqlite3/Sqlite3SchemaValidation.ts

@@ -1,20 +1,18 @@
 import { Schema } from '@waha/core/storage/Schema';
-
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const Database = require('better-sqlite3');
+import Knex from 'knex';
 
 export class Sqlite3SchemaValidation {
   constructor(
     private table: Schema,
-    private db,
+    private knex: Knex.Knex,
   ) {}
 
-  validate() {
+  async validate() {
     const table = this.table;
 
     // Check table has the columns
-    const columns = this.db.prepare(`PRAGMA table_info(${table.name})`).all();
-    // Check exact number of columns
+    const columns = await this.knex.raw(`PRAGMA table_info(${table.name})`);
+    // Check the exact number of columns
     if (columns.length !== table.columns.length) {
       throw new Error(
         `Table '${table.name}' does not have expected number of columns. Expected ${table.columns.length}, got ${columns.length}`,
@@ -37,7 +35,7 @@ export class Sqlite3SchemaValidation {
     }
 
     // Check table has expected indexes
-    const indexes = this.db.prepare(`PRAGMA index_list(${table.name})`).all();
+    const indexes = await this.knex.raw(`PRAGMA index_list(${table.name})`);
     const indexNames = indexes.map((index) => index.name);
     for (const index of table.indexes) {
       if (!indexNames.includes(index.name)) {

src/core/engines/noweb/store/sqlite3/Sqlite3Storage.ts

@@ -6,6 +6,7 @@ import { Sqlite3LabelAssociationsRepository } from '@waha/core/engines/noweb/sto
 import { Sqlite3LabelsRepository } from '@waha/core/engines/noweb/store/sqlite3/Sqlite3LabelsRepository';
 import { Sqlite3LidPNRepository } from '@waha/core/engines/noweb/store/sqlite3/Sqlite3LidPNRepository';
 import { Schema } from '@waha/core/storage/Schema';
+import Knex from 'knex';
 
 import { INowebStorage } from '../INowebStorage';
 import { Migrations, NOWEB_STORE_SCHEMA } from '../schemas';
@@ -14,70 +15,71 @@ import { Sqlite3ContactRepository } from './Sqlite3ContactRepository';
 import { Sqlite3MessagesRepository } from './Sqlite3MessagesRepository';
 import { Sqlite3SchemaValidation } from './Sqlite3SchemaValidation';
 
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const Database = require('better-sqlite3');
-
 export class Sqlite3Storage extends INowebStorage {
-  private readonly db: any;
   private readonly tables: Schema[];
+  private readonly knex: Knex.Knex;
 
   constructor(filePath: string) {
     super();
-    this.db = new Database(filePath);
+    this.knex = Knex({
+      client: 'better-sqlite3',
+      connection: { filename: filePath },
+      useNullAsDefault: true,
+    });
     this.tables = NOWEB_STORE_SCHEMA;
   }
 
   async init() {
-    this.db.pragma('journal_mode = WAL;');
-    this.migrate();
-    this.validateSchema();
+    await this.knex.raw('PRAGMA journal_mode = WAL;');
+    await this.migrate();
+    await this.validateSchema();
   }
 
-  private migrate() {
-    this.migration0001init();
+  private async migrate() {
+    await this.migration0001init();
   }
 
-  private validateSchema() {
+  private async validateSchema() {
     for (const table of this.tables) {
-      new Sqlite3SchemaValidation(table, this.db).validate();
+      await new Sqlite3SchemaValidation(table, this.knex).validate();
     }
   }
 
-  private migration0001init() {
+  private async migration0001init() {
     for (const migration of Migrations) {
-      this.db.exec(migration);
+      await this.knex.raw(migration);
     }
   }
 
   async close() {
-    return this.db.close();
+    return this.knex.destroy();
   }
 
   getContactsRepository() {
-    return new Sqlite3ContactRepository(this.db);
+    return new Sqlite3ContactRepository(this.knex);
   }
 
   getChatRepository() {
-    return new Sqlite3ChatRepository(this.db);
+    return new Sqlite3ChatRepository(this.knex);
   }
 
   getGroupRepository() {
-    return new Sqlite3GroupRepository(this.db);
+    return new Sqlite3GroupRepository(this.knex);
   }
 
   getLabelsRepository(): ILabelsRepository {
-    return new Sqlite3LabelsRepository(this.db);
+    return new Sqlite3LabelsRepository(this.knex);
   }
 
   getLabelAssociationRepository(): ILabelAssociationRepository {
-    return new Sqlite3LabelAssociationsRepository(this.db);
+    return new Sqlite3LabelAssociationsRepository(this.knex);
   }
 
   getMessagesRepository() {
-    return new Sqlite3MessagesRepository(this.db);
+    return new Sqlite3MessagesRepository(this.knex);
   }
 
   getLidPNRepository(): INowebLidPNRepository {
-    return new Sqlite3LidPNRepository(this.db);
+    return new Sqlite3LidPNRepository(this.knex);
   }
 }

src/core/engines/noweb/useMultiFileAuthState.ts

@@ -19,6 +19,7 @@ const AsyncLock = require('async-lock');
 // Default pending is 1000, set it to infinity
 // https://github.com/rogierschouten/async-lock/issues/63
 const fileLock = new AsyncLock({
+  timeout: 5_000,
   maxPending: Infinity,
   maxExecutionTime: 30_000,
 });

src/core/engines/webjs/WPage.ts

@@ -119,4 +119,8 @@ export class WPage extends EventEmitter {
     this.page.on(event, listener);
     return this.page as any;
   }
+
+  get tracing() {
+    return this.page.tracing;
+  }
 }

src/core/engines/webjs/session.webjs.core.ts

@@ -106,17 +106,21 @@ import {
   WAHAPresenceData,
 } from '@waha/structures/presence.dto';
 import { WAMessage, WAMessageReaction } from '@waha/structures/responses.dto';
+import { BrowserTraceQuery } from '@waha/structures/server.debug.dto';
 import { MeInfo } from '@waha/structures/sessions.dto';
 import { StatusRequest, TextStatus } from '@waha/structures/status.dto';
 import {
   EnginePayload,
   WAMessageAckBody,
+  WAMessageEditedBody,
   WAMessageRevokedBody,
 } from '@waha/structures/webhooks.dto';
 import { PaginatorInMemory } from '@waha/utils/Paginator';
 import { sleep, waitUntil } from '@waha/utils/promiseTimeout';
 import { SingleDelayedJobRunner } from '@waha/utils/SingleDelayedJobRunner';
+import { TmpDir } from '@waha/utils/tmpdir';
 import * as lodash from 'lodash';
+import * as path from 'path';
 import { ProtocolError } from 'puppeteer';
 import { filter, fromEvent, merge, mergeMap, Observable, share } from 'rxjs';
 import { map } from 'rxjs/operators';
@@ -193,13 +197,19 @@ export class WhatsappSessionWebJSCore extends WhatsappSession {
     if (cacheType === 'local') {
       this.logger.info(`Using web version: '${webVersion}'`);
     }
+    const args = this.getBrowserArgsForPuppeteer();
+    // add at the start
+    args.unshift(`--a-waha-timestamp=${new Date()}`);
+    args.unshift(`--a-waha-session=${this.name}`);
     return {
       puppeteer: {
         headless: true,
         executablePath: this.getBrowserExecutablePath(),
-        args: this.getBrowserArgsForPuppeteer(),
+        args: args,
         dumpio: this.isDebugEnabled(),
       },
+      userAgent:
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36',
       webVersion: webVersion,
       webVersionCache: {
         type: cacheType,
@@ -512,6 +522,23 @@ export class WhatsappSessionWebJSCore extends WhatsappSession {
   /**
    * START - Methods for API
    */
+  public async browserTrace(query: BrowserTraceQuery): Promise<string> {
+    const tmpdir = new TmpDir(
+      this.logger,
+      `waha-browser-trace-${this.name}-`,
+      (10 * query.seconds + 120) * 1000,
+    );
+    const page = this.whatsapp.pupPage;
+    return await tmpdir.use(async (dir) => {
+      this.logger.info({ query }, `Starting browser tracing...`);
+      const filepath = path.join(dir, 'trace.json');
+      await page.tracing.start({ path: filepath });
+      await sleep(query.seconds * 1000);
+      await page.tracing.stop();
+      this.logger.info(`Browser tracing finished, saved to ${filepath}`);
+      return filepath;
+    });
+  }
 
   /**
    * Auth methods
@@ -1418,9 +1445,12 @@ export class WhatsappSessionWebJSCore extends WhatsappSession {
         const beforeMessage = event.before
           ? this.toWAMessage(event.before)
           : null;
+        // Extract the revoked message ID from the protocolMessageKey.id field
+        const revokedMessageId = afterMessage?._data?.protocolMessageKey?.id;
         return {
           after: afterMessage,
           before: beforeMessage,
+          revokedMessageId: revokedMessageId,
         };
       }),
     );
@@ -1432,6 +1462,26 @@ export class WhatsappSessionWebJSCore extends WhatsappSession {
     );
     this.events2.get(WAHAEvents.MESSAGE_REACTION).switch(messagesReaction$);
 
+    const messageEdit$ = fromEvent(
+      this.whatsapp,
+      Events.MESSAGE_EDIT,
+      (message, newBody, prevBody) => {
+        return { message, newBody, prevBody };
+      },
+    );
+    const messagesEdit$ = messageEdit$.pipe(
+      map((event): WAMessageEditedBody => {
+        const message = this.toWAMessage(event.message);
+        return {
+          ...message,
+          body: event.newBody,
+          editedMessageId: message._data?.id?.id,
+          _data: event,
+        };
+      }),
+    );
+    this.events2.get(WAHAEvents.MESSAGE_EDITED).switch(messagesEdit$);
+
     const messageAckWEBJS$ = fromEvent(
       this.whatsapp,
       Events.MESSAGE_ACK,

src/core/exceptions.ts

@@ -1,8 +1,11 @@
-import { UnprocessableEntityException } from '@nestjs/common';
+import {
+  NotImplementedException,
+  UnprocessableEntityException,
+} from '@nestjs/common';
 
 export const DOCS_URL = 'https://waha.devlike.pro/';
 
-export class NotImplementedByEngineError extends UnprocessableEntityException {
+export class NotImplementedByEngineError extends NotImplementedException {
   constructor(msg = '') {
     let error = 'The method is not implemented by the engine.';
     if (msg) {

src/core/media/local/MediaLocalStorage.ts

@@ -4,8 +4,8 @@ import * as fsp from 'fs/promises';
 import * as path from 'path';
 import { Logger } from 'pino';
 import fs = require('fs');
-import del = require('del');
 import { fileExists } from '@waha/utils/files';
+import { deleteAsync } from 'del';
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const writeFileAtomic = require('write-file-atomic');
@@ -59,7 +59,7 @@ export class MediaLocalStorage implements IMediaStorage {
     }
 
     if (fs.existsSync(this.filesFolder)) {
-      del([`${this.filesFolder}/*`], { force: true }).then((paths) => {
+      deleteAsync([`${this.filesFolder}/*`], { force: true }).then((paths) => {
         if (paths.length === 0) {
           return;
         }

src/core/storage/LocalStore.ts

@@ -1,3 +1,5 @@
+import Knex from 'knex';
+
 import { DataStore } from '../abc/DataStore';
 
 export abstract class LocalStore extends DataStore {
@@ -23,5 +25,5 @@ export abstract class LocalStore extends DataStore {
    */
   abstract getFilePath(session: string, file: string): string;
 
-  abstract getWAHADatabase(): any;
+  abstract getWAHADatabase(): Knex.Knex;
 }

src/core/storage/LocalStoreCore.ts

@@ -1,18 +1,16 @@
 import { safeJoin } from '@waha/utils/files';
 import * as fs from 'fs/promises';
+import Knex from 'knex';
 import * as path from 'path';
 
 import { LocalStore } from './LocalStore';
 
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const Database = require('better-sqlite3');
-
 export class LocalStoreCore extends LocalStore {
   protected readonly baseDirectory: string =
     process.env.WAHA_LOCAL_STORE_BASE_DIR || './.sessions';
 
   private readonly engine: string;
-  private db: any;
+  private knex: Knex.Knex;
 
   constructor(engine: string) {
     super();
@@ -21,6 +19,11 @@ export class LocalStoreCore extends LocalStore {
 
   async init(sessionName?: string) {
     await fs.mkdir(this.getEngineDirectory(), { recursive: true });
+    if (!this.knex) {
+      this.knex = this.buildKnex();
+      await this.knex.raw('PRAGMA journal_mode = WAL;');
+      await this.knex.raw('PRAGMA foreign_keys = ON;');
+    }
     if (sessionName) {
       await fs.mkdir(this.getSessionDirectory(sessionName), {
         recursive: true,
@@ -54,17 +57,24 @@ export class LocalStoreCore extends LocalStore {
     return safeJoin(this.getEngineDirectory(), name);
   }
 
-  getWAHADatabase(): any {
-    if (!this.db) {
-      const engineDir = this.getEngineDirectory();
-      const database = safeJoin(engineDir, 'waha.sqlite3');
-      this.db = new Database(database);
-      this.db.pragma('journal_mode = WAL;');
+  getWAHADatabase(): Knex.Knex {
+    if (!this.knex) {
+      throw new Error('Knex is not initialized, call LocalStore.init() first');
     }
-    return this.db;
+    return this.knex;
+  }
+
+  buildKnex(): Knex.Knex {
+    const engineDir = this.getEngineDirectory();
+    const database = path.join(engineDir, 'waha.sqlite3');
+    return Knex({
+      client: 'better-sqlite3',
+      connection: { filename: database },
+      useNullAsDefault: true,
+    });
   }
 
   async close() {
-    this.db?.close();
+    await this.knex.destroy();
   }
 }

src/core/storage/sql/ISQLEngine.ts

@@ -1,28 +0,0 @@
-import Knex from 'knex';
-
-export interface ISQLEngine {
-  /**
-   * Run a query that does not return any data
-   */
-  run(query: Knex.QueryBuilder): Promise<void>;
-
-  /**
-   * Get a single row from the database
-   */
-  get(query: Knex.QueryBuilder): Promise<any | null>;
-
-  /**
-   * Get all rows from the database
-   */
-  all(query: Knex.QueryBuilder): Promise<any[]>;
-
-  /**
-   * Run a raw SQL query with bindings
-   */
-  raw(sql: string, bindings: any[]): Promise<void>;
-
-  /**
-   * Execute a raw SQL query
-   */
-  exec(sql: string): Promise<void>;
-}

src/core/storage/sql/SqlKVRepository.ts

@@ -1,9 +1,8 @@
 import { Field, Schema } from '@waha/core/storage/Schema';
 import { IJsonQuery } from '@waha/core/storage/sql/IJsonQuery';
-import { ISQLEngine } from '@waha/core/storage/sql/ISQLEngine';
 import { PaginationParams } from '@waha/structures/pagination.dto';
 import { KnexPaginator } from '@waha/utils/Paginator';
-import Knex from 'knex';
+import { Knex } from 'knex';
 import * as lodash from 'lodash';
 
 export type Migration = string;
@@ -26,10 +25,7 @@ export class SqlKVRepository<Entity> {
     return [];
   }
 
-  constructor(
-    private engine: ISQLEngine,
-    protected knex: Knex.Knex,
-  ) {}
+  constructor(protected knex: Knex) {}
 
   get columns(): Field[] {
     return this.schema.columns;
@@ -49,7 +45,7 @@ export class SqlKVRepository<Entity> {
 
   protected async applyMigrations() {
     for (const migration of this.migrations) {
-      await this.engine.exec(migration);
+      await this.knex.raw(migration);
     }
   }
 
@@ -79,15 +75,13 @@ export class SqlKVRepository<Entity> {
     }
   }
 
-  private async upsertBatch(entities: Entity[]): Promise<void> {
+  protected async upsertBatch(entities: Entity[]): Promise<void> {
     const all = entities.map((entity) => this.dump(entity));
     // make it unique by .id
     const data = lodash.uniqBy(all, (d: any) => d.id);
     if (data.length != all.length) {
       console.warn(
-        `WARNING - Duplicated entities for upsert batch: ${JSON.stringify(
-          entities,
-        )}`,
+        `WARNING - Duplicated entities for upsert batch: all=${all.length}, data=${data.length}`,
       );
     }
     const columns = this.columns.map((c) => `"${c.fieldName}"`);
@@ -121,7 +115,7 @@ export class SqlKVRepository<Entity> {
 
   async getCount(): Promise<number> {
     const query = this.select().count({ count: 'id' });
-    const row = await this.engine.get(query);
+    const row = await query.first();
     if (!row) {
       return 0;
     }
@@ -140,7 +134,7 @@ export class SqlKVRepository<Entity> {
       return new Map();
     }
 
-    const rows = await this.engine.all(this.select().whereIn('id', ids));
+    const rows = await this.select().whereIn('id', ids);
     const entitiesMap = new Map<string, Entity | null>();
 
     // Initialize a map with null values for all requested IDs
@@ -193,15 +187,15 @@ export class SqlKVRepository<Entity> {
    * SQL Implementation details
    */
   public async raw(sql: string, bindings: any[]): Promise<void> {
-    await this.engine.raw(sql, bindings);
+    await this.knex.raw(sql, bindings);
   }
 
   protected async run(query: Knex.QueryBuilder): Promise<void> {
-    await this.engine.run(query);
+    await query;
   }
 
   protected async get(query: Knex.QueryBuilder): Promise<Entity | null> {
-    const row = await this.engine.get(query);
+    const row = await query.first();
     if (!row) {
       return null;
     }
@@ -209,7 +203,7 @@ export class SqlKVRepository<Entity> {
   }
 
   public async all(query: Knex.QueryBuilder): Promise<Entity[]> {
-    const rows = await this.engine.all(query);
+    const rows = await query;
     return rows.map((row) => this.parse(row));
   }
 

src/core/storage/sqlite3/Sqlite3Engine.ts

@@ -1,38 +0,0 @@
-import { ISQLEngine } from '@waha/core/storage/sql/ISQLEngine';
-import { Database } from 'better-sqlite3';
-import { Knex } from 'knex';
-
-export class Sqlite3Engine implements ISQLEngine {
-  constructor(protected db: Database) {}
-
-  async all(query: Knex.QueryBuilder): Promise<any[]> {
-    const sql = query.toSQL().sql;
-    const bind = query.toSQL().bindings;
-    return this.db.prepare(sql).all(bind);
-  }
-
-  async get(query: Knex.QueryBuilder): Promise<any | null> {
-    const sql = query.toSQL().sql;
-    const bind = query.toSQL().bindings;
-    const row: any = this.db.prepare(sql).get(bind);
-    if (!row) {
-      return null;
-    }
-    return row;
-  }
-
-  async run(query: Knex.QueryBuilder): Promise<void> {
-    const sql = query.toSQL().sql;
-    const bind = query.toSQL().bindings;
-    this.db.prepare(sql).run(bind);
-    return;
-  }
-
-  async raw(sql: string, bindings: any[]) {
-    this.db.prepare(sql).run(bindings);
-  }
-
-  async exec(sql): Promise<void> {
-    this.db.exec(sql);
-  }
-}

src/core/storage/sqlite3/Sqlite3KVRepository.ts

@@ -1,21 +1,24 @@
 import { SqlKVRepository } from '@waha/core/storage/sql/SqlKVRepository';
-import { Sqlite3Engine } from '@waha/core/storage/sqlite3/Sqlite3Engine';
 import { Sqlite3JsonQuery } from '@waha/core/storage/sqlite3/Sqlite3JsonQuery';
-import { Database } from 'better-sqlite3';
+import { sleep } from '@waha/utils/promiseTimeout';
 import Knex from 'knex';
 
 /**
  * Key value repository with extra metadata
  */
 export class Sqlite3KVRepository<Entity> extends SqlKVRepository<Entity> {
-  protected db: Database;
+  protected knex: Knex.Knex;
   protected jsonQuery = new Sqlite3JsonQuery();
 
-  constructor(db: Database) {
-    // sqlite does not support inserting default values. Set the `useNullAsDefault` flag to hide this warning. (see docs https://knexjs.org/guide/query-builder.html#insert).
-    const knex = Knex({ client: 'better-sqlite3', useNullAsDefault: true });
-    const engine = new Sqlite3Engine(db);
-    super(engine, knex);
-    this.db = db;
+  constructor(knex: Knex.Knex) {
+    super(knex);
+  }
+
+  protected async upsertBatch(entities: Entity[]): Promise<void> {
+    await super.upsertBatch(entities);
+    // Give some time to the Node.js loop because we're using sync better-sqlite
+    if (entities.length >= this.UPSERT_BATCH_SIZE) {
+      await sleep(1);
+    }
   }
 }

src/core/storage/sqlite3/Sqlite3SessionMeRepository.ts

@@ -23,8 +23,8 @@ export class Sqlite3SessionMeRepository
   }
 
   constructor(store: LocalStore) {
-    const db = store.getWAHADatabase();
-    super(db);
+    const knex = store.getWAHADatabase();
+    super(knex);
   }
 
   upsertMe(sessionName: string, me: MeInfo): Promise<void> {
@@ -41,7 +41,7 @@ export class Sqlite3SessionMeRepository
   }
 
   protected async validateSchema() {
-    const validation = new Sqlite3SchemaValidation(this.schema, this.db);
-    validation.validate();
+    const validation = new Sqlite3SchemaValidation(this.schema, this.knex);
+    await validation.validate();
   }
 }

src/core/storage/sqlite3/Sqlite3SessionWorkerRepository.ts

@@ -23,8 +23,8 @@ export class Sqlite3SessionWorkerRepository
   }
 
   constructor(store: LocalStore) {
-    const db = store.getWAHADatabase();
-    super(db);
+    const knex = store.getWAHADatabase();
+    super(knex);
   }
 
   assign(session: string, worker: string): Promise<void> {
@@ -45,7 +45,7 @@ export class Sqlite3SessionWorkerRepository
   }
 
   protected async validateSchema() {
-    const validation = new Sqlite3SchemaValidation(this.schema, this.db);
-    validation.validate();
+    const validation = new Sqlite3SchemaValidation(this.schema, this.knex);
+    await validation.validate();
   }
 }

src/main.ts

@@ -47,31 +47,24 @@ process.on('SIGTERM', () => {
   logger.info('SIGTERM received');
 });
 
-async function loadModules(): Promise<
-  [typeof AppModuleCore, typeof SwaggerConfiguratorCore]
-> {
+async function loadModules(): Promise<typeof AppModuleCore> {
   const version = getWAHAVersion();
 
   if (version === WAHAVersion.CORE) {
     const { AppModuleCore } = await import('./core/app.module.core');
-    const { SwaggerConfiguratorCore } = await import(
-      './core/SwaggerConfiguratorCore'
-    );
-    return [AppModuleCore, SwaggerConfiguratorCore];
+    return AppModuleCore;
   }
-  // Ignore if it's core version - there's no plus module
+  // Ignore if it's a core version - there's no plus module
   // @ts-ignore
   const { AppModulePlus } = await import('./plus/app.module.plus');
   // @ts-ignore
-  const { SwaggerConfiguratorPlus } = await import('./plus/SwaggerConfiguratorPlus'); // prettier-ignore
-  // @ts-ignore
-  return [AppModulePlus, SwaggerConfiguratorPlus];
+  return AppModulePlus;
 }
 
 async function bootstrap() {
   const version = getWAHAVersion();
   logger.info(`WAHA (WhatsApp HTTP API) - Running ${version} version...`);
-  const [AppModule, SwaggerModule] = await loadModules();
+  const AppModule = await loadModules();
   const httpsOptions = AppModule.getHttpsOptions(logger);
   const app = await NestFactory.create(AppModule, {
     logger: getNestJSLogLevels(),
@@ -81,7 +74,7 @@ async function bootstrap() {
   });
   app.useLogger(app.get(NestJSPinoLogger));
 
-  // Print original stack, not pino one
+  // Print the original stack, not pino one
   // https://github.com/iamolegga/nestjs-pino?tab=readme-ov-file#expose-stack-trace-and-error-class-in-err-property
   app.useGlobalInterceptors(new LoggerErrorInterceptor());
 
@@ -91,13 +84,13 @@ async function bootstrap() {
   // but for now we added it ValidationPipe on Controller or endpoint level
   // app.useGlobalPipes(new ValidationPipe({ transform: true }));
 
-  // Allow to send big body - for images and attachments
+  // Allow sending big body - for images and attachments
   app.use(json({ limit: '50mb' }));
   app.use(urlencoded({ limit: '50mb', extended: false }));
   app.useWebSocketAdapter(new WsAdapter(app));
 
   // Configure swagger
-  const swaggerConfigurator = new SwaggerModule(app);
+  const swaggerConfigurator = new SwaggerConfiguratorCore(app);
   swaggerConfigurator.configure(WAHA_WEBHOOKS);
 
   AppModule.appReady(app, logger);

src/nestjs/HttpsExpress.ts

@@ -0,0 +1,73 @@
+import * as fs from 'node:fs';
+
+import { LoggerBuilder } from '@waha/utils/logging';
+import { Logger } from 'pino';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const chokidar = require('chokidar');
+
+export class HttpsExpress {
+  private readonly keyPath: string;
+  private readonly certPath: string;
+  private readonly caPath: string;
+
+  constructor(private logger: Logger) {
+    //
+    // Let's encrypt certificates default paths
+    // cert.pem  chain.pem  fullchain.pem  privkey.pem
+    //
+    this.keyPath = process.env.WAHA_HTTPS_PATH_KEY || './.secrets/privkey.pem';
+    this.certPath = process.env.WAHA_HTTPS_PATH_CERT || './.secrets/cert.pem';
+    this.caPath = process.env.WAHA_HTTPS_PATH_CA;
+    if (this.caPath == null) {
+      this.caPath = './.secrets/chain.pem';
+    }
+  }
+
+  readSync() {
+    this.logger.info('Reading HTTPS certificates...');
+    this.logger.info('HTTPS Key Path:', this.keyPath);
+    const key = fs.readFileSync(this.keyPath);
+
+    this.logger.info('HTTPS Cert Path:', this.certPath);
+    const cert = fs.readFileSync(this.certPath);
+
+    this.logger.info('HTTPS CA Path:', this.caPath);
+    const ca = this.caPath ? fs.readFileSync(this.caPath) : undefined;
+
+    this.logger.info('HTTPS certificates read successfully');
+    return { key: key, cert: cert, ca: ca };
+  }
+
+  /**
+   * https://stackoverflow.com/a/74076392
+   */
+  watchCertChanges(httpd) {
+    let waitForCertAndFullChainToGetUpdatedTooTimeout: any;
+    const paths = [this.keyPath, this.certPath, this.caPath].filter(
+      (path) => !!path,
+    );
+    const watcher = chokidar.watch(paths, {
+      followSymlinks: false,
+      persistent: true,
+      ignoreInitial: true,
+      disableGlobbing: true,
+    });
+    // IDK why, but it has few bugs:
+    // 1. It issues 'add' event at the start, even tho ignoreInitial is set to true
+    // 2. It issues additional 'add' for the same file, but without full path
+    watcher.on('all', (eventName, path, stats) => {
+      this.logger.info(`HTTPS file '${path}' has been '${eventName}'...`);
+      clearTimeout(waitForCertAndFullChainToGetUpdatedTooTimeout);
+      waitForCertAndFullChainToGetUpdatedTooTimeout = setTimeout(() => {
+        this.logger.info('Updating HTTPS configuration...');
+        httpd.setSecureContext(this.readSync());
+      }, 1000);
+    });
+    process.on('SIGTERM', () => {
+      this.logger.info('SIGTERM received, closing HTTP file watchers');
+      clearTimeout(waitForCertAndFullChainToGetUpdatedTooTimeout);
+      watcher.close();
+    });
+  }
+}

src/structures/enums.dto.ts

@@ -8,6 +8,7 @@ export enum WAHAEvents {
   MESSAGE_ACK = 'message.ack',
   MESSAGE_WAITING = 'message.waiting',
   MESSAGE_REVOKED = 'message.revoked',
+  MESSAGE_EDITED = 'message.edited',
   STATE_CHANGE = 'state.change',
   GROUP_JOIN = 'group.join',
   GROUP_LEAVE = 'group.leave',

src/structures/server.debug.dto.ts

@@ -0,0 +1,25 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { Transform, Type } from 'class-transformer';
+import { IsArray, IsNumber, IsOptional, IsString } from 'class-validator';
+
+export class BrowserTraceQuery {
+  @Type(() => Number)
+  @IsNumber()
+  @ApiProperty({
+    description: 'How many seconds to trace',
+    example: 30,
+    required: true,
+  })
+  seconds: number = 30;
+
+  @IsArray()
+  @IsString({ each: true })
+  @Transform(({ value }) => (Array.isArray(value) ? value : [value]))
+  @IsOptional()
+  @ApiProperty({
+    description: 'Categories to trace (all by default)',
+    example: ['*'],
+    required: true,
+  })
+  categories: string[] = ['*'];
+}

src/structures/webhooks.dto.ts

@@ -93,9 +93,24 @@ export class PollVotePayload {
 export class WAMessageRevokedBody {
   after?: WAMessage;
   before?: WAMessage;
+
+  @ApiProperty({
+    description: 'ID of the message that was revoked',
+    example: 'A06CA7BB5DD8C8F705628CDB7E3A33C9',
+  })
+  revokedMessageId?: string;
+
   _data?: any;
 }
 
+export class WAMessageEditedBody extends WAMessage {
+  @ApiProperty({
+    description: 'ID of the original message that was edited',
+    example: 'A06CA7BB5DD8C8F705628CDB7E3A33C9',
+  })
+  editedMessageId?: string;
+}
+
 export class WASessionStatusBody {
   @ApiProperty({
     example: 'default',
@@ -206,6 +221,16 @@ export class WAHAWebhookMessageRevoked extends WAHAWebhook {
   payload: WAMessageRevokedBody;
 }
 
+export class WAHAWebhookMessageEdited extends WAHAWebhook {
+  @ApiProperty({
+    description:
+      'The event is triggered when a user edits a previously sent message.',
+  })
+  event = WAHAEvents.MESSAGE_EDITED;
+
+  payload: WAMessageEditedBody;
+}
+
 export class WAHAWebhookStateChange extends WAHAWebhook {
   @ApiProperty({
     description: 'It’s an internal engine’s state, not session status.',

src/structures/webhooks.ts

@@ -21,6 +21,7 @@ import {
   WAHAWebhookMessage,
   WAHAWebhookMessageAck,
   WAHAWebhookMessageAny,
+  WAHAWebhookMessageEdited,
   WAHAWebhookMessageReaction,
   WAHAWebhookMessageRevoked,
   WAHAWebhookPollVote,
@@ -37,6 +38,7 @@ const WAHA_WEBHOOKS = [
   WAHAWebhookMessageAny,
   WAHAWebhookMessageAck,
   WAHAWebhookMessageRevoked,
+  WAHAWebhookMessageEdited,
   WebhookGroupV2Join,
   WebhookGroupV2Leave,
   WebhookGroupV2Update,

src/utils/tmpdir.ts

@@ -0,0 +1,47 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+import { Logger } from 'pino';
+
+function sanitize(input: string) {
+  return input.replace(/[^a-zA-Z0-9-_]/g, '_');
+}
+
+export class TmpDir {
+  private readonly prefix: string;
+  constructor(
+    private logger: Logger,
+    prefix: string,
+    private cleanupTimeout = 10_000,
+  ) {
+    this.prefix = sanitize(prefix);
+    if (this.prefix.length > 249) {
+      this.prefix = this.prefix.slice(0, 249);
+    }
+  }
+
+  /**
+   * Creates a temporary directory and passes it to the callback.
+   * The directory is automatically cleaned up after the callback returns.
+   * @param callback Function that receives the temporary directory path
+   * @returns The result of the callback
+   */
+  public async use<T>(callback: (dir: string) => Promise<T>): Promise<T> {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), this.prefix));
+    try {
+      return await callback(dir);
+    } finally {
+      setTimeout(async () => {
+        fs.rm(dir, { recursive: true, force: true })
+          .then(() => {
+            this.logger.trace(`Cleaned up temporary directory '${dir}'`);
+          })
+          .catch((err) => {
+            this.logger.warn(
+              `Failed to clean up temporary directory '${dir}': ${err.message}`,
+            );
+          });
+      }, this.cleanupTimeout);
+    }
+  }
+}

src/version.ts

@@ -33,7 +33,7 @@ export function getEngineName(): string {
 }
 
 export const VERSION: WAHAEnvironment = {
-  version: '2025.6.2',
+  version: '2025.7.3',
   engine: getEngineName(),
   tier: getWAHAVersion(),
   browser:

tests/smoke/goss.yaml

@@ -4,4 +4,4 @@ http:
     allow-insecure: true
     no-follow-redirects: true
     timeout: 5000
-    body: ['version']
+    body: ['version']

waha.config.json

@@ -2,11 +2,11 @@
   "waha": {
     "gows": {
       "repo": "devlikeapro/gows",
-      "ref": "v1.0.8"
+      "ref": "v1.0.9"
     },
     "dashboard": {
       "repo": "devlikeapro/dashboard",
-      "ref": "3fb6694d849ca0b567679dd59311a50b9d727f2f"
+      "ref": "fd8594d89ef369ed669c8b8b529ab29058c0d13c"
     }
   }
 }