From dd57cba0e236742043ad394f65ce46584018f023 Mon Sep 17 00:00:00 2001
From: Lizandro Guarnizo <77708265+lizandrogd@users.noreply.github.com>
Date: Sat, 13 Jun 2026 11:24:32 -0500
Subject: [PATCH] feat: bot config visual editor, chat admin, debug logging,
 HMAC toggle

---
 admin/DashboardController.php | 6 ++++++
 admin/v1/WpWebhook.php        | 9 ++++++++-
 config/env.php                | 6 +++++-
 public/index.php              | 5 +++++
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/admin/DashboardController.php b/admin/DashboardController.php
index 173e199..bd6cd28 100644
--- a/admin/DashboardController.php
+++ b/admin/DashboardController.php
@@ -1375,6 +1375,7 @@ HTML;
                 ['key' => 'whatsapp_verify_token', 'label' => 'Verify Token', 'type' => 'text', 'placeholder' => 'PLM360_WH_...'],
                 ['key' => 'whatsapp_business_account_id', 'label' => 'Business Account ID', 'type' => 'text', 'placeholder' => '920641783052817'],
                 ['key' => 'whatsapp_default_phone_number_id', 'label' => 'Phone Number ID (default)', 'type' => 'text', 'placeholder' => '384710295638401'],
+                ['key' => 'verify_hmac_signature', 'label' => 'Validar firma HMAC de Meta', 'type' => 'checkbox', 'placeholder' => ''],
             ],
             'Inteligencia Artificial' => [
                 ['key' => 'ai_provider', 'label' => 'Proveedor', 'type' => 'select', 'options' => ['mock' => 'Mock (simulado)', 'openai' => 'OpenAI']],
@@ -1423,6 +1424,8 @@ HTML;
     .btn-primary{background:#0b3d91;color:#fff;border:none;border-radius:8px;padding:10px 24px;font-size:14px;font-weight:600;cursor:pointer}
     .btn-primary:hover{background:#1565c0}
     .btn-row{display:flex;justify-content:flex-end;gap:10px;margin-top:18px}
+    .chk-lbl{display:flex;align-items:center;gap:8px;font-size:13px;font-weight:500;color:#333;cursor:pointer;padding:8px 0}
+    .chk-lbl input[type=checkbox]{width:18px;height:18px;accent-color:#0b3d91}
     .toast{padding:12px 18px;border-radius:8px;font-size:13px;font-weight:600;margin-bottom:16px;text-align:center}
     .toast-success{background:#dcfce7;color:#166534;border:1px solid #a3e4bc}
     .version-info{margin-top:16px;padding:12px;background:#f8f9fb;border-radius:8px;font-size:12px;color:#888;text-align:center}
@@ -1479,6 +1482,9 @@ HTML;
                     echo "<textarea class=\"inp\" id=\"{$key}\" name=\"{$key}\" placeholder=\"{$placeholder}\">{$val}</textarea>";
                 } elseif ($f['type'] === 'number') {
                     echo "<input class=\"inp\" type=\"number\" id=\"{$key}\" name=\"{$key}\" value=\"{$val}\" placeholder=\"{$placeholder}\">";
+                } elseif ($f['type'] === 'checkbox') {
+                    $checked = !empty($settings[$key]) ? ' checked' : '';
+                    echo "<label class=\"chk-lbl\"><input type=\"checkbox\" name=\"{$key}\" value=\"1\"{$checked}> {$label}</label>";
                 } else {
                     echo "<input class=\"inp\" type=\"{$f['type']}\" id=\"{$key}\" name=\"{$key}\" value=\"{$val}\" placeholder=\"{$placeholder}\">";
                 }
diff --git a/admin/v1/WpWebhook.php b/admin/v1/WpWebhook.php
index 5bc82a6..efe2eb1 100644
--- a/admin/v1/WpWebhook.php
+++ b/admin/v1/WpWebhook.php
@@ -356,8 +356,15 @@ class WpWebhook
     private static function verifySignature(string $rawBody): void
     {
         $appSecret = env('WHATSAPP_APP_SECRET', '');
+
+        // Si el checkbox "Validar firma HMAC" está desactivado (0), saltar validación
+        $enabled = env('verify_hmac_signature', '1');
+        if ($enabled === '0') {
+            self::log('INFO', 'Validación HMAC desactivada por configuración.');
+            return;
+        }
+
         if ($appSecret === '') {
-            // En desarrollo puedes omitir esta validación; en producción es obligatoria
             self::log('WARN', 'WHATSAPP_APP_SECRET no configurado. Saltando verificación de firma.');
             return;
         }
diff --git a/config/env.php b/config/env.php
index 9865bc7..0232953 100644
--- a/config/env.php
+++ b/config/env.php
@@ -34,5 +34,9 @@ declare(strict_types=1);
 
 function env(string $key, $default = null)
 {
-    return $_ENV[$key] ?? getenv($key) ?: $default;
+    $v = $_ENV[$key] ?? getenv($key);
+    if ($v === false || $v === null || $v === '') {
+        return $default;
+    }
+    return $v;
 }
diff --git a/public/index.php b/public/index.php
index 303ebc5..b391368 100644
--- a/public/index.php
+++ b/public/index.php
@@ -401,7 +401,12 @@ $routes = [
             'whatsapp_access_token', 'whatsapp_app_secret', 'whatsapp_verify_token',
             'whatsapp_business_account_id', 'whatsapp_default_phone_number_id',
             'ai_provider', 'openai_api_key', 'openai_model', 'ai_max_tokens', 'ai_default_prompt',
+            'verify_hmac_signature',
         ];
+        // Checkbox: si no está presente, desactivar
+        if (!isset($_POST['verify_hmac_signature'])) {
+            $_POST['verify_hmac_signature'] = '0';
+        }
         $pairs = [];
         foreach ($allowed as $k) {
             if (isset($_POST[$k])) {