fix(whatsapp): share one business-account credential across its phone numbers (#1120)

Author: viethung0o0

apps/builder/__tests__/ads-account-switcher.test.tsx

@@ -73,12 +73,16 @@ const integrations = [
     name: "Primary",
     displayPhoneNumber: "+12025550101",
     hasCapiScope: true,
+    isCoexist: false,
   },
   {
     id: "iw-2",
     name: "Secondary",
     displayPhoneNumber: "+12025550102",
     hasCapiScope: true,
+    // A WhatsApp Business app number, so its reconnect must ask Meta for the
+    // coexistence screen — the only place such an account is listed.
+    isCoexist: true,
   },
 ]
 

apps/builder/__tests__/disconnect-whatsapp-action.test.ts

@@ -25,6 +25,7 @@ const mocks = vi.hoisted(() => {
     inboxDisconnect: vi.fn().mockResolvedValue(undefined),
     isRevokedTokenError: vi.fn(() => false),
     metaCapiDeleteByIntegration: vi.fn().mockResolvedValue(undefined),
+    deleteWabaIfOrphaned: vi.fn().mockResolvedValue(false),
     tx,
     txChain,
     whatsappDisconnect: vi.fn().mockResolvedValue(undefined),
@@ -38,7 +39,12 @@ const mocks = vi.hoisted(() => {
 // require booting the real business/database module graph).
 const integrationWhatsappServiceDisconnect = vi.fn(
   async (props: {
-    integrationWhatsapp: { id: string; inboxId: string; phoneNumberId: string }
+    integrationWhatsapp: {
+      id: string
+      inboxId: string
+      phoneNumberId: string
+      wabaId: string
+    }
     ownerId: string
     workspaceId: string
     tx: typeof mocks.tx
@@ -68,6 +74,11 @@ const integrationWhatsappServiceDisconnect = vi.fn(
       props.tx,
     )
     tx.delete({ id: "whatsappId" })
+    await mocks.deleteWabaIfOrphaned({
+      workspaceId: props.workspaceId,
+      wabaId: props.integrationWhatsapp.wabaId,
+      tx: props.tx,
+    })
     await mocks.inboxDisconnect({
       inboxId: props.integrationWhatsapp.inboxId,
       ownerId: props.ownerId,
@@ -83,6 +94,9 @@ vi.mock("@chatbotx.io/business", () => ({
     disconnect: integrationWhatsappServiceDisconnect,
   },
   workspaceService: { findById: mocks.workspaceFindById },
+  whatsappBusinessAccountService: {
+    deleteIfOrphaned: mocks.deleteWabaIfOrphaned,
+  },
 }))
 
 vi.mock("@chatbotx.io/database/client", () => ({
@@ -126,6 +140,7 @@ const integrationWhatsappRow = {
   auth: { clientId: "client-1" },
   inboxId: "inbox-1",
   phoneNumberId: "phone-1",
+  wabaId: "waba-1",
 }
 
 describe("disconnectWhatsappAction", () => {
@@ -164,6 +179,11 @@ describe("disconnectWhatsappAction", () => {
       reason: "manual",
       tx: mocks.tx,
     })
+    expect(mocks.deleteWabaIfOrphaned).toHaveBeenCalledWith({
+      workspaceId: "workspace-1",
+      wabaId: "waba-1",
+      tx: mocks.tx,
+    })
   })
 
   // A WhatsApp coexist run parked in `waiting` survived disconnect,

apps/builder/__tests__/whatsapp-automatic-events-card.test.tsx

@@ -32,6 +32,7 @@ const baseIntegration = {
   displayPhoneNumber: "84339426550",
   wabaId: "1303031825154214",
   hasCapiScope: true,
+  isCoexist: false,
 }
 
 const whatsappCredentialPublic: WhatsappCredentialPublic = {

apps/builder/__tests__/whatsapp-connect-action.direct.test.ts

@@ -75,6 +75,11 @@ vi.mock("@chatbotx.io/business", () => ({
   platformCredentialService: {
     resolveForOwner: mocks.platformCredentialResolveMock,
   },
+  whatsappBusinessAccountService: {
+    findByWaba: mocks.findWabaRecordMock,
+    markProvisioned: mocks.markWabaProvisionedMock,
+    upsertCurrentCredential: mocks.upsertWabaCredentialMock,
+  },
   workspaceMemberService: {
     isMember: mocks.isMemberMock,
   },
@@ -94,6 +99,10 @@ vi.mock("@chatbotx.io/integration-whatsapp/api/auth", () => ({
   appAccessToken: (settings: { clientId: string; clientSecret: string }) =>
     `${settings.clientId}|${settings.clientSecret}`,
   debugToken: mocks.debugTokenMock,
+  // `getWhatsappGrantedScopes` reads the grant through this one, and
+  // `persistConnectedWaba` swallows its own failures — leaving it off the mock
+  // silently skipped the WABA record write instead of failing the test.
+  debugTokenOrThrow: mocks.debugTokenMock,
   exchangeAccessToken: mocks.exchangeAccessTokenMock,
 }))
 
@@ -125,6 +134,7 @@ vi.mock("@chatbotx.io/integration-whatsapp/api/webhook", () => ({
 }))
 
 vi.mock("@chatbotx.io/redis", () => ({
+  distributedLock: { runExclusive: mocks.distributedLockRunExclusiveMock },
   invalidateCacheByTags: mocks.invalidateCacheByTagsMock,
 }))
 

apps/builder/__tests__/whatsapp-connect-action.follow-ups.test.ts

@@ -72,6 +72,11 @@ vi.mock("@chatbotx.io/business", () => ({
   platformCredentialService: {
     resolveForOwner: mocks.platformCredentialResolveMock,
   },
+  whatsappBusinessAccountService: {
+    findByWaba: mocks.findWabaRecordMock,
+    markProvisioned: mocks.markWabaProvisionedMock,
+    upsertCurrentCredential: mocks.upsertWabaCredentialMock,
+  },
   workspaceMemberService: {
     isMember: mocks.isMemberMock,
   },
@@ -91,6 +96,10 @@ vi.mock("@chatbotx.io/integration-whatsapp/api/auth", () => ({
   appAccessToken: (settings: { clientId: string; clientSecret: string }) =>
     `${settings.clientId}|${settings.clientSecret}`,
   debugToken: mocks.debugTokenMock,
+  // `getWhatsappGrantedScopes` reads the grant through this one, and
+  // `persistConnectedWaba` swallows its own failures — leaving it off the mock
+  // silently skipped the WABA record write instead of failing the test.
+  debugTokenOrThrow: mocks.debugTokenMock,
   exchangeAccessToken: mocks.exchangeAccessTokenMock,
 }))
 
@@ -118,6 +127,7 @@ vi.mock("@chatbotx.io/integration-whatsapp/api/webhook", () => ({
 }))
 
 vi.mock("@chatbotx.io/redis", () => ({
+  distributedLock: { runExclusive: mocks.distributedLockRunExclusiveMock },
   invalidateCacheByTags: mocks.invalidateCacheByTagsMock,
 }))
 
@@ -140,7 +150,89 @@ describe("connectWhatsappAction — follow-ups and unhandled failures", () => {
   })
 
   describe("WABA pre-work", () => {
-    test("runs before persist and is idempotent across two requests", async () => {
+    test("serializes concurrent first connects so WABA provisioning runs once", async () => {
+      const secondPhoneNumber = { ...selectedPhoneNumber, id: "phone-2" }
+      let waba: { provisionedAt: Date | null; revision: number } | null = null
+      let sessionWorkspaceId: string | null = null
+      let tail = Promise.resolve()
+      mocks.platformCredentialResolveMock.mockResolvedValue({
+        config: {
+          clientId: "client-1",
+          clientSecret: "secret-1",
+          configId: "config-1",
+          systemUserId: "system-user-1",
+          systemUserToken: "system-token-1",
+          businessName: "Business",
+          verifyToken: "verify-token",
+          version: "v23.0",
+          businessId: "credit-line-owner-1",
+        },
+      })
+      mocks.findActiveSignupSessionForUserMock.mockImplementation(async () => ({
+        ...defaultSession,
+        workspaceId: sessionWorkspaceId,
+        candidatePhoneNumberIds: [selectedPhoneNumber.id, secondPhoneNumber.id],
+      }))
+      mocks.connectPhoneNumberMock.mockImplementation(() => {
+        sessionWorkspaceId = "ws-1"
+        return {
+          workspaceId: "ws-1",
+          createdWorkspace: false,
+          integrationRow,
+          wasCreated: true,
+        }
+      })
+      mocks.findWabaRecordMock.mockImplementation(async () => waba)
+      mocks.upsertWabaCredentialMock.mockImplementation(() => {
+        waba ??= { provisionedAt: null, revision: 1 }
+        return waba
+      })
+      mocks.markWabaProvisionedMock.mockImplementation(() => {
+        waba = { provisionedAt: new Date(), revision: 2 }
+        return waba
+      })
+      mocks.distributedLockRunExclusiveMock.mockImplementation(
+        async ({ fn }: { fn: () => Promise<unknown> }) => {
+          const previous = tail
+          let release: (() => void) | undefined
+          tail = new Promise<void>((resolve) => {
+            release = resolve
+          })
+          await previous
+          try {
+            return await fn()
+          } finally {
+            release?.()
+          }
+        },
+      )
+
+      await Promise.all([
+        callConnectWhatsappAction({
+          ctx: { user: { id: "user-1" } },
+          parsedInput: {
+            ...BASE_INPUT,
+            phoneNumberId: selectedPhoneNumber.id,
+            signupSessionId: "signup-session-1",
+          },
+        }),
+        callConnectWhatsappAction({
+          ctx: { user: { id: "user-1" } },
+          parsedInput: {
+            ...BASE_INPUT,
+            phoneNumberId: secondPhoneNumber.id,
+            signupSessionId: "signup-session-1",
+          },
+        }),
+      ])
+
+      expect(mocks.addSystemUserMock).toHaveBeenCalledTimes(1)
+      expect(mocks.shareCreditLineMock).toHaveBeenCalledTimes(1)
+      expect(mocks.subscribeWebhookMock).toHaveBeenCalledTimes(1)
+      expect(mocks.markWabaProvisionedMock).toHaveBeenCalledTimes(1)
+    })
+
+    test("skips provisioning for a second number when the WABA is provisioned", async () => {
       const secondPhoneNumber = { ...selectedPhoneNumber, id: "phone-2" }
       mocks.findActiveSignupSessionForUserMock.mockResolvedValue({
         ...defaultSession,
@@ -187,6 +279,15 @@ describe("connectWhatsappAction — follow-ups and unhandled failures", () => {
 
       mocks.addSystemUserMock.mockClear()
       mocks.subscribeWebhookMock.mockClear()
+      mocks.findActiveSignupSessionForUserMock.mockResolvedValue({
+        ...defaultSession,
+        workspaceId: "ws-1",
+        candidatePhoneNumberIds: [selectedPhoneNumber.id, secondPhoneNumber.id],
+      })
+      mocks.findWabaRecordMock.mockResolvedValue({
+        id: "waba-row",
+        provisionedAt: new Date("2026-09-08T00:00:00.000Z"),
+      })
 
       await callConnectWhatsappAction({
         ctx: { user: { id: "user-1" } },
@@ -197,13 +298,12 @@ describe("connectWhatsappAction — follow-ups and unhandled failures", () => {
         },
       })
 
-      // Same request shape runs the same idempotent calls again — no
-      // state carried between requests that would skip them.
-      expect(mocks.addSystemUserMock).toHaveBeenCalledTimes(1)
-      // Plain subscribeWebhook now also runs once from the manual follow-up
-      // path on OTHER requests, but this is the non-manual pre-work call —
-      // exactly one per request here too.
-      expect(mocks.subscribeWebhookMock).toHaveBeenCalledTimes(1)
+      expect(mocks.addSystemUserMock).not.toHaveBeenCalled()
+      expect(mocks.subscribeWebhookMock).not.toHaveBeenCalled()
+      expect(mocks.findWabaRecordMock).toHaveBeenLastCalledWith({
+        workspaceId: "ws-1",
+        wabaId: "waba-1",
+      })
     })
 
     test("manual connect never runs WABA-level pre-work", async () => {

apps/builder/__tests__/whatsapp-connect-action.mocks.ts

@@ -46,6 +46,7 @@ export const mocks = {
   findActiveSignupSessionForUserMock: vi.fn(),
   createIdMock: vi.fn(),
   debugTokenMock: vi.fn(),
+  distributedLockRunExclusiveMock: vi.fn(),
   exchangeAccessTokenMock: vi.fn(),
   findConnectedPhoneNumberIdsMock: vi.fn(),
   findWabaMock: vi.fn(),
@@ -65,6 +66,9 @@ export const mocks = {
   resolveProviderOriginMock: vi.fn(),
   shareCreditLineMock: vi.fn(),
   subscribeWebhookMock: vi.fn(),
+  findWabaRecordMock: vi.fn(),
+  markWabaProvisionedMock: vi.fn(),
+  upsertWabaCredentialMock: vi.fn(),
   updateAuthMock: vi.fn(),
   updateWorkspaceLogoMock: vi.fn(),
   workspaceFindMock: vi.fn(),
@@ -204,9 +208,21 @@ export function resetWhatsappConnectActionMocks() {
   mocks.buildContextMock.mockResolvedValue({})
   mocks.updateWorkspaceLogoMock.mockResolvedValue(undefined)
   mocks.subscribeWebhookMock.mockResolvedValue(undefined)
+  mocks.findWabaRecordMock.mockResolvedValue(null)
+  mocks.upsertWabaCredentialMock.mockResolvedValue({
+    id: "waba-row",
+    revision: 1,
+  })
+  mocks.markWabaProvisionedMock.mockResolvedValue({
+    id: "waba-row",
+    revision: 2,
+  })
   mocks.updateAuthMock.mockResolvedValue(undefined)
   mocks.invalidateCacheByTagsMock.mockResolvedValue(undefined)
   mocks.debugTokenMock.mockResolvedValue({ app_id: "app-123", is_valid: true })
+  mocks.distributedLockRunExclusiveMock.mockImplementation(
+    async ({ fn }: { fn: () => Promise<unknown> }) => await fn(),
+  )
 
   mocks.connectPhoneNumberMock.mockResolvedValue({
     workspaceId: "ws-1",

apps/builder/__tests__/whatsapp-connect-action.session.test.ts

@@ -78,6 +78,11 @@ vi.mock("@chatbotx.io/business", () => ({
   platformCredentialService: {
     resolveForOwner: mocks.platformCredentialResolveMock,
   },
+  whatsappBusinessAccountService: {
+    findByWaba: mocks.findWabaRecordMock,
+    markProvisioned: mocks.markWabaProvisionedMock,
+    upsertCurrentCredential: mocks.upsertWabaCredentialMock,
+  },
   workspaceMemberService: {
     isMember: mocks.isMemberMock,
   },
@@ -97,6 +102,10 @@ vi.mock("@chatbotx.io/integration-whatsapp/api/auth", () => ({
   appAccessToken: (settings: { clientId: string; clientSecret: string }) =>
     `${settings.clientId}|${settings.clientSecret}`,
   debugToken: mocks.debugTokenMock,
+  // `getWhatsappGrantedScopes` reads the grant through this one, and
+  // `persistConnectedWaba` swallows its own failures — leaving it off the mock
+  // silently skipped the WABA record write instead of failing the test.
+  debugTokenOrThrow: mocks.debugTokenMock,
   exchangeAccessToken: mocks.exchangeAccessTokenMock,
 }))
 
@@ -124,6 +133,7 @@ vi.mock("@chatbotx.io/integration-whatsapp/api/webhook", () => ({
 }))
 
 vi.mock("@chatbotx.io/redis", () => ({
+  distributedLock: { runExclusive: mocks.distributedLockRunExclusiveMock },
   invalidateCacheByTags: mocks.invalidateCacheByTagsMock,
 }))