Move whatsapp channel source to channels-src/ for consistency

[bowenwang1996]

All WASM channel sources are now in channels-src/:

• slack/
• telegram/
• whatsapp/ (moved from channels/)

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The release profile is missing the codegen-units = 1 optimization that is present in both the Slack and Telegram channels. This optimization can improve code generation for size which is important for WASM components. Consider adding it for consistency and better optimization.

Suggested change

	lto = true
	codegen-units = 1

[Copilot]

The code logs a warning when the secret is not validated but continues to process the message anyway (line 307). The comment on line 304 mentions "Return 401" but there's no actual return statement. This could allow unauthorized webhook requests to be processed.

Consider adding a return statement here to reject requests with invalid tokens.

Suggested change

	// Return 401 but note that host should have already rejected these
	return json_response(
	401,
	serde_json::json!({"error": "Unauthorized"}),
	);

[Copilot]

The API version is hardcoded to "v18.0" in the URL, but the WhatsAppConfig struct has a configurable api_version field that is parsed from the configuration file (lines 232-234, 257-260). The config value is logged during startup (line 266) but never actually used when making API calls.

Either the api_version from config should be used here, or the api_version field should be removed from the config struct if it's not meant to be configurable.

Suggested change

	// Build WhatsApp API URL with placeholders
	// Host will replace {WHATSAPP_API_VERSION} in the URL and {WHATSAPP_ACCESS_TOKEN} in the Authorization header
	let api_url = format!(
	"https://graph.facebook.com/{WHATSAPP_API_VERSION}/{}/messages",

[Copilot]

The reply_to_message configuration field (defaulting to true) is defined but never used in the implementation. The WhatsAppMessageMetadata stores the original message_id which could be used to add a context field to the response payload for threading, but this is not implemented.

If reply context is intended to be supported, the on_respond function should conditionally add a context field to the payload based on this config. However, given the stateless nature of WASM components in this architecture, storing and accessing config after on_start may not be feasible. Consider either implementing this feature using the message_id from metadata, or removing the unused config field to avoid confusion.

Suggested change

	}
	fn default_api_version() -> String {
	"v18.0".to_string()
	}

[Copilot]

The validation regex for whatsapp_access_token may be too restrictive. WhatsApp Cloud API access tokens from Meta can contain additional characters beyond [A-Za-z0-9_-], including pipe characters (|) and other special characters. The current regex pattern may reject valid tokens.

Consider using a more permissive pattern or verifying the actual character set used by Meta access tokens.

Suggested change

	"validation": "^\\S+$"

[Copilot]

The webhook verification function doesn't check the secret_validated field from the request. While the comment on line 448 mentions that "Verify token is validated by host via secret_validated field", there's no actual verification of this field in the code. This could allow verification requests with invalid verify tokens to succeed if they have the correct mode and challenge parameters.

Consider adding a check for req.secret_validated similar to the one in on_http_request (line 299) to ensure the verify token was validated by the host before returning the challenge.

[Copilot]

The Cargo.toml is missing the license field that is present in the other channel implementations (slack and telegram both use "MIT OR Apache-2.0"). This should be added for consistency across the channels and proper licensing information.

Suggested change

	description = "WhatsApp Cloud API channel for IronClaw"
	license = "MIT OR Apache-2.0"

[ilblackdragon]

Thanks, I moved actually in another PR when was adding on_status change.