From ffc84d086316353faed7e513a18c78e7fad03e41 Mon Sep 17 00:00:00 2001
From: Bennett <bennybenester@gmail.com>
Date: Thu, 10 Sep 2026 15:25:13 +0300
Subject: [PATCH 1/2] release: Mask tokens

---
 .../entities/whatsapp/WhatsAppWebhookConfig.java    |  2 ++
 .../services/WhatsAppWebhookConfigService.java      | 13 ++++++++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/flexcodelabs/flextuma/core/entities/whatsapp/WhatsAppWebhookConfig.java b/src/main/java/com/flexcodelabs/flextuma/core/entities/whatsapp/WhatsAppWebhookConfig.java
index c754d46..cc34755 100644
--- a/src/main/java/com/flexcodelabs/flextuma/core/entities/whatsapp/WhatsAppWebhookConfig.java
+++ b/src/main/java/com/flexcodelabs/flextuma/core/entities/whatsapp/WhatsAppWebhookConfig.java
@@ -50,6 +50,7 @@ public class WhatsAppWebhookConfig extends Owner {
     private String callbackUrl;
 
     @NotBlank
+    @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
     @Column(name = "verify_token", nullable = false)
     @jakarta.persistence.Convert(converter = EncryptedStringConverter.class)
     private String verifyToken;
@@ -81,6 +82,7 @@ public class WhatsAppWebhookConfig extends Owner {
     @Column(name = "last_event_at")
     private LocalDateTime lastEventAt;
 
+    @JsonProperty("verifyToken") public String getMaskedVerifyToken() { return MaskingUtil.mask(verifyToken); }
     @JsonProperty("signingSecret") public String getMaskedSigningSecret() { return MaskingUtil.mask(signingSecret); }
     @JsonProperty("appSecret") public String getMaskedAppSecret() { return MaskingUtil.mask(appSecret); }
 }
diff --git a/src/main/java/com/flexcodelabs/flextuma/modules/whatsapp/services/WhatsAppWebhookConfigService.java b/src/main/java/com/flexcodelabs/flextuma/modules/whatsapp/services/WhatsAppWebhookConfigService.java
index 9f1fb01..a08ecae 100644
--- a/src/main/java/com/flexcodelabs/flextuma/modules/whatsapp/services/WhatsAppWebhookConfigService.java
+++ b/src/main/java/com/flexcodelabs/flextuma/modules/whatsapp/services/WhatsAppWebhookConfigService.java
@@ -60,19 +60,26 @@ public class WhatsAppWebhookConfigService extends BaseService<WhatsAppWebhookCon
 
     @Override protected void onPreSave(WhatsAppWebhookConfig entity) { provisionMetaCallback(entity); validate(entity); }
     @Override protected WhatsAppWebhookConfig onPreUpdate(WhatsAppWebhookConfig entity, WhatsAppWebhookConfig old) {
-        // Meta-facing values are owned by Flextuma, rather than being supplied or overwritten by a client update.
-        entity.setVerifyToken(old.getVerifyToken());
+        // Meta-facing values other than verifyToken are owned by Flextuma, rather than being
+        // supplied or overwritten by a client update. verifyToken is a shared secret the caller
+        // also configures on Meta's side, so -- like appSecret/signingSecret -- it can be rotated
+        // by submitting a new value; submitting back the masked "****" placeholder is a no-op.
         entity.setCallbackToken(old.getCallbackToken());
         entity.setMetaCallbackUrl(old.getMetaCallbackUrl());
         entity.setLastVerifiedAt(old.getLastVerifiedAt());
         entity.setLastEventAt(old.getLastEventAt());
+        if (entity.getVerifyToken() != null && entity.getVerifyToken().contains("****")) entity.setVerifyToken(old.getVerifyToken());
         if (entity.getSigningSecret() != null && entity.getSigningSecret().contains("****")) entity.setSigningSecret(old.getSigningSecret());
         if (entity.getAppSecret() != null && entity.getAppSecret().contains("****")) entity.setAppSecret(old.getAppSecret());
         WhatsAppWebhookConfig merged = super.onPreUpdate(entity, old); validate(merged); return merged;
     }
     private void provisionMetaCallback(WhatsAppWebhookConfig entity) {
         if (publicBaseUrl == null || publicBaseUrl.isBlank()) throw new IllegalStateException("FLEXTUMA_PUBLIC_BASE_URL must be configured before WhatsApp webhooks can be created");
-        entity.setVerifyToken(TokenGenerator.generateSecureToken(32));
+        // A caller may supply their own verifyToken (so they know the value to paste into Meta);
+        // otherwise Flextuma generates one, which is only ever readable in full via a future rotation.
+        if (entity.getVerifyToken() == null || entity.getVerifyToken().isBlank()) {
+            entity.setVerifyToken(TokenGenerator.generateSecureToken(32));
+        }
         entity.setCallbackToken(UUID.randomUUID().toString().replace("-", ""));
         entity.setMetaCallbackUrl(publicBaseUrl.replaceAll("/+$", "") + "/api/webhooks/whatsapp/" + entity.getCallbackToken());
     }

From d5d06ac4162b3fb6bbea838148e8dc720d497936 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 12:25:54 +0000
Subject: [PATCH 2/2] Release v0.0.66 [skip ci]

---
 build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle b/build.gradle
index 55a4d32..71e54e1 100644
--- a/build.gradle
+++ b/build.gradle
@@ -8,7 +8,7 @@ plugins {
 }
 
 group = 'com.flexcodelabs'
-version = '0.0.65'
+version = '0.0.66'
 description = 'Flextuma App'
 
 java {