Merge branch 'main' into feat/chatwoot-multi-device

Keep main's ad_jid as migration 35 and renumber Chatwoot
per-device config migrations to 36-42 so upgrades from main
apply both schemas in order.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: aldinokemal

docs/webhook-payload.md

@@ -79,6 +79,45 @@ WHATSAPP_WEBHOOK_EVENTS=group.participants,group.joined,newsletter.joined,newsle
 - If configured, only the specified events are forwarded to webhooks
 - Event names are case-insensitive
 
+### Ignoring chats/JIDs
+
+In addition to filtering by **event type** above, you can skip events by **conversation or sender JID** —
+for example, to mute all group traffic from the webhook. This is independent of `WHATSAPP_WEBHOOK_EVENTS`
+(the two filters compose: an event is forwarded only if its type is allowed **and** its JID is not ignored).
+
+**Environment Variable:**
+
+```bash
+# Drop all group messages/receipts (any chat_id ending in @g.us)
+WHATSAPP_WEBHOOK_IGNORE_JIDS=@g.us
+
+# Drop all groups plus one specific 1:1 chat
+WHATSAPP_WEBHOOK_IGNORE_JIDS=@g.us,628123456789@s.whatsapp.net
+```
+
+**CLI Flag:**
+
+```bash
+./whatsapp rest --webhook="https://yourapp.com/webhook" --webhook-ignore-jids="@g.us"
+```
+
+**Behavior:**
+
+- Matches the event's `chat_id`, `from`, `chat_lid` or `from_lid` against the list (so an `@lid`
+  pattern matches LID-migrated events, whose `@lid` JID lives in the `*_lid` fields).
+- An `@`-prefixed entry is an address-space **wildcard** (`@g.us`, `@s.whatsapp.net`, `@lid`); any other
+  entry is an **exact** JID match.
+- Empty/unset (default) forwards everything.
+- Independent from the Chatwoot integration, which keeps its own `CHATWOOT_IGNORE_JIDS`.
+- `@g.us` is the recommended way to mute groups (it matches the group `chat_id`). The
+  `@s.whatsapp.net` wildcard matches the **sender** too, so it also suppresses group messages (whose
+  `from` is the participant's `@s.whatsapp.net` JID) — use exact JIDs if you only want to mute specific
+  1:1 chats.
+- Note: a few events carry the group JID elsewhere or omit `chat_id` — `call.offer` puts the group in
+  `group_jid` (not `chat_id`), `message.deleted` only includes `chat_id` when the original message is
+  found locally, and `group.participants`/`group.joined` have no `from`. The `@g.us` wildcard still
+  covers ordinary group messages and receipts (which is the common case for muting groups).
+
 ## Security
 
 ### HMAC Signature Verification

readme.md

@@ -155,6 +155,13 @@ Download:
   | `call.offer`         | Incoming call received                        |
 
   If not configured (empty), all events will be forwarded.
+- **Webhook JID Filtering**
+
+  You can skip events for specific chats or senders (e.g. mute all groups) before they are forwarded:
+  - `--webhook-ignore-jids="@g.us,628123456789@s.whatsapp.net"` (comma-separated list)
+  - Or environment variable: `WHATSAPP_WEBHOOK_IGNORE_JIDS=@g.us`
+  - Supports the `@g.us` / `@s.whatsapp.net` / `@lid` wildcards (match a whole address space) and exact JIDs.
+  - This filters by conversation/sender and is independent of `--webhook-events` (which filters by event type). The Chatwoot integration keeps its own `CHATWOOT_IGNORE_JIDS`.
 - **Webhook TLS Configuration**
 
   If you encounter TLS certificate verification errors when using webhooks (e.g., with Cloudflare tunnels or self-signed
@@ -222,8 +229,10 @@ To use environment variables:
 | `WHATSAPP_WEBHOOK_SECRET`               | Webhook secret for validation                                 | `secret`                                     | `WHATSAPP_WEBHOOK_SECRET=super-secret-key`    |
 | `WHATSAPP_WEBHOOK_INSECURE_SKIP_VERIFY` | Skip TLS verification for webhooks (insecure)                 | `false`                                      | `WHATSAPP_WEBHOOK_INSECURE_SKIP_VERIFY=true`  |
 | `WHATSAPP_WEBHOOK_EVENTS`               | Whitelist of events to forward (comma-separated, empty = all) | -                                            | `WHATSAPP_WEBHOOK_EVENTS=message,message.ack` |
+| `WHATSAPP_WEBHOOK_IGNORE_JIDS`          | JIDs/wildcards to skip when forwarding (comma-separated)      | -                                            | `WHATSAPP_WEBHOOK_IGNORE_JIDS=@g.us`          |
 | `WHATSAPP_ACCOUNT_VALIDATION`           | Enable account validation                                     | `true`                                       | `WHATSAPP_ACCOUNT_VALIDATION=false`           |
 | `WHATSAPP_PRESENCE_ON_CONNECT`          | Presence on connect: `available`, `unavailable`, or `none`    | `unavailable`                                | `WHATSAPP_PRESENCE_ON_CONNECT=unavailable`    |
+| `WHATSAPP_PROXY`                        | Outbound proxy for the WhatsApp WebSocket (socks5/http/https) | -                                            | `WHATSAPP_PROXY=socks5://user:pass@host:1080` |
 | `WHATSAPP_PRESENCE_PULSE_ENABLED`       | Enable daily available/unavailable presence pulse             | `true`                                       | `WHATSAPP_PRESENCE_PULSE_ENABLED=false`       |
 | `WHATSAPP_PRESENCE_PULSE_INTERVAL`      | Interval between presence pulses                              | `24h`                                        | `WHATSAPP_PRESENCE_PULSE_INTERVAL=24h`        |
 | `WHATSAPP_PRESENCE_PULSE_DURATION`      | Duration to stay available during each pulse                  | `5m`                                         | `WHATSAPP_PRESENCE_PULSE_DURATION=5m`         |
@@ -575,8 +584,8 @@ You can fork or edit this source code !
 | ✅       | Add Device                             | POST   | /devices                            |
 | ✅       | Get Device Info                        | GET    | /devices/:device_id                 |
 | ✅       | Remove Device                          | DELETE | /devices/:device_id                 |
-| ❌       | Login Device (QR, reserved)            | GET    | /devices/:device_id/login           |
-| ❌       | Login Device (Code, reserved)          | POST   | /devices/:device_id/login/code      |
+| ✅       | Login Device (QR)                      | GET    | /devices/:device_id/login           |
+| ✅       | Login Device (Code)                    | POST   | /devices/:device_id/login/code      |
 | ✅       | Logout Device                          | POST   | /devices/:device_id/logout          |
 | ✅       | Reconnect Device                       | POST   | /devices/:device_id/reconnect       |
 | ✅       | Get Device Status                      | GET    | /devices/:device_id/status          |
@@ -663,7 +672,6 @@ You can fork or edit this source code !
 
 - `*User My Groups`: Returns a maximum of 500 groups due to WhatsApp protocol limitation. This is enforced by WhatsApp servers, not this API. See [whatsmeow source](https://github.com/tulir/whatsmeow/blob/main/group.go) for details.
 - `/health` is public and always registered at the root path, even when `APP_BASE_PATH` is set.
-- Device-specific login routes are reserved by the router but not implemented by the current usecase. Use `/app/login` or `/app/login-with-code` with `X-Device-Id` or `device_id` to pair a specific slot.
 - Chatwoot routes are registered only when `CHATWOOT_ENABLED=true`.
 
 ## User Interface

src/.env.example

@@ -23,13 +23,22 @@ WHATSAPP_WEBHOOK=https://webhook.site/07b69616-5943-4c7f-a8be-db4819df699e,https
 WHATSAPP_WEBHOOK_SECRET=super-secret-key
 WHATSAPP_WEBHOOK_INSECURE_SKIP_VERIFY=false
 WHATSAPP_WEBHOOK_EVENTS=message,message.reaction,message.revoked,message.edited,message.ack,message.deleted,group.participants
+# Comma-separated WhatsApp JIDs (or "@g.us"/"@s.whatsapp.net"/"@lid" wildcards) to skip when forwarding to the webhook.
+# Example: "@g.us" drops all group traffic; add exact JIDs to mute specific chats/senders.
+WHATSAPP_WEBHOOK_IGNORE_JIDS=
 WHATSAPP_WEBHOOK_INCLUDE_OUTGOING=false
 WHATSAPP_ACCOUNT_VALIDATION=true
 WHATSAPP_PRESENCE_ON_CONNECT=unavailable
 WHATSAPP_PRESENCE_PULSE_ENABLED=true
 WHATSAPP_PRESENCE_PULSE_INTERVAL=24h
 WHATSAPP_PRESENCE_PULSE_DURATION=5m
 WHATSAPP_CHAT_STORAGE=true
+# Outbound proxy applied to whatsmeow's WebSocket dialer via SetProxyAddress.
+# Standard HTTP_PROXY env does not apply to the underlying ws connection.
+# Useful for self-hosted deploys behind DPI / network egress restrictions.
+# Supports SOCKS5/HTTP/HTTPS schemes. Empty = direct connection.
+# Example: WHATSAPP_PROXY=socks5://user:pass@proxy.example.com:1080
+WHATSAPP_PROXY=
 
 # Chatwoot Integration
 CHATWOOT_ENABLED=false

src/cmd/root.go

@@ -144,6 +144,16 @@ func initEnvConfig() {
 		events := strings.Split(envWebhookEvents, ",")
 		config.WhatsappWebhookEvents = events
 	}
+	if envWebhookIgnoreJids := viper.GetString("whatsapp_webhook_ignore_jids"); envWebhookIgnoreJids != "" {
+		parts := strings.Split(envWebhookIgnoreJids, ",")
+		jids := make([]string, 0, len(parts))
+		for _, p := range parts {
+			if trimmed := strings.TrimSpace(p); trimmed != "" {
+				jids = append(jids, trimmed)
+			}
+		}
+		config.WhatsappWebhookIgnoreJids = jids
+	}
 	if viper.IsSet("whatsapp_account_validation") {
 		config.WhatsappAccountValidation = viper.GetBool("whatsapp_account_validation")
 	}
@@ -153,6 +163,12 @@ func initEnvConfig() {
 	if envPresenceOnConnect := viper.GetString("whatsapp_presence_on_connect"); envPresenceOnConnect != "" {
 		config.WhatsappPresenceOnConnect = envPresenceOnConnect
 	}
+	// Outbound proxy for whatsmeow WebSocket. Standard HTTP_PROXY env does not
+	// apply to the underlying ws dialer; this binding plumbs the address into
+	// (*whatsmeow.Client).SetProxyAddress before Connect. See issue #581.
+	if envProxy := viper.GetString("whatsapp_proxy"); envProxy != "" {
+		config.WhatsappProxy = envProxy
+	}
 	if viper.IsSet("whatsapp_presence_pulse_enabled") {
 		config.WhatsappPresencePulseEnabled = viper.GetBool("whatsapp_presence_pulse_enabled")
 	}
@@ -354,6 +370,12 @@ func initFlags() {
 		config.WhatsappWebhookEvents,
 		`whitelist of events to forward to webhook (empty = all events) --webhook-events <string> | example: --webhook-events="message,message.ack,group.participants"`,
 	)
+	rootCmd.PersistentFlags().StringSliceVarP(
+		&config.WhatsappWebhookIgnoreJids,
+		"webhook-ignore-jids", "",
+		config.WhatsappWebhookIgnoreJids,
+		`comma-separated WhatsApp JIDs (or "@g.us"/"@s.whatsapp.net"/"@lid" wildcards) to skip when forwarding to webhooks --webhook-ignore-jids <list> | example: --webhook-ignore-jids="@g.us,628123456789@s.whatsapp.net"`,
+	)
 	rootCmd.PersistentFlags().BoolVarP(
 		&config.WhatsappAccountValidation,
 		"account-validation", "",
@@ -372,6 +394,12 @@ func initFlags() {
 		config.WhatsappPresenceOnConnect,
 		`presence to send on connect: "available", "unavailable", or "none" --presence-on-connect <string> | example: --presence-on-connect="unavailable"`,
 	)
+	rootCmd.PersistentFlags().StringVarP(
+		&config.WhatsappProxy,
+		"whatsapp-proxy", "",
+		config.WhatsappProxy,
+		`outbound proxy for the WhatsApp WebSocket dialer --whatsapp-proxy <string> | example: --whatsapp-proxy="socks5://user:pass@host:1080"`,
+	)
 	rootCmd.PersistentFlags().BoolVarP(
 		&config.WhatsappPresencePulseEnabled,
 		"presence-pulse-enabled", "",
@@ -591,7 +619,7 @@ func initApp() {
 	messageUsecase = usecase.NewMessageService(chatStorageRepo)
 	groupUsecase = usecase.NewGroupService()
 	newsletterUsecase = usecase.NewNewsletterService()
-	deviceUsecase = usecase.NewDeviceService(dm)
+	deviceUsecase = usecase.NewDeviceService(dm, appUsecase)
 }
 
 // Execute adds all child commands to the root command and sets flags appropriately.

src/config/settings.go

@@ -35,6 +35,7 @@ var (
 	WhatsappWebhookSecret             = "secret"
 	WhatsappWebhookInsecureSkipVerify = false          // Skip TLS certificate verification for webhooks (insecure)
 	WhatsappWebhookEvents             []string         // Whitelist of events to forward to webhook (empty = all events)
+	WhatsappWebhookIgnoreJids         []string         // JIDs (or "@g.us"/"@s.whatsapp.net"/"@lid" wildcards) to skip when forwarding to webhooks
 	WhatsappAutoRejectCall                     = false // Auto-reject incoming calls
 	WhatsappLogLevel                           = "ERROR"
 	WhatsappSettingMaxImageSize       int64    = 20000000  // 20MB
@@ -51,6 +52,14 @@ var (
 	WhatsappPresencePulseInterval              = 24 * time.Hour
 	WhatsappPresencePulseDuration              = 5 * time.Minute
 
+	// WhatsappProxy is forwarded to whatsmeow's *Client.SetProxyAddress before
+	// Connect. Accepts SOCKS5/HTTP/HTTPS schemes, e.g.
+	// "socks5://user:pass@host:1080" or "http://host:8080". Empty = direct
+	// (no proxy). Useful for self-hosted deployments behind DPI / network
+	// egress restrictions where standard HTTP_PROXY env vars do not apply
+	// to the WhatsApp WebSocket dialer.
+	WhatsappProxy = ""
+
 	ChatStorageURI               = "file:storages/chatstorage.db"
 	ChatStorageEnableForeignKeys = true
 	ChatStorageEnableWAL         = true

src/domains/chatstorage/chatstorage.go

@@ -124,24 +124,29 @@ type MediaInfo struct {
 }
 
 // DeviceRecord tracks a registered device for persistence purposes.
+// JID holds the bare-number (NonAD) form used for chat storage partitioning; ADJID
+// holds the full companion identity (number:NN@s.whatsapp.net) that pins the slot to
+// one specific whatsmeow session. ADJID is empty until the first connect after
+// pairing (the :NN suffix is only known once the socket authenticates).
 type DeviceRecord struct {
-	DeviceID                 string    `db:"device_id"`
-	DisplayName              string    `db:"display_name"`
-	JID                      string    `db:"jid"`
-	WebhookURL               *string   `db:"webhook_url"`
-	WebhookSecret            string    `db:"webhook_secret"`
-	WebhookEvents            string    `db:"webhook_events"`
+	DeviceID                  string    `db:"device_id"`
+	DisplayName               string    `db:"display_name"`
+	JID                       string    `db:"jid"`
+	ADJID                     string    `db:"ad_jid"`
+	WebhookURL                *string   `db:"webhook_url"`
+	WebhookSecret             string    `db:"webhook_secret"`
+	WebhookEvents             string    `db:"webhook_events"`
 	WebhookInsecureSkipVerify bool      `db:"webhook_insecure_skip_verify"`
-	CreatedAt                time.Time `db:"created_at"`
-	UpdatedAt                time.Time `db:"updated_at"`
+	CreatedAt                 time.Time `db:"created_at"`
+	UpdatedAt                 time.Time `db:"updated_at"`
 }
 
 // DeviceWebhookConfig holds the complete webhook configuration for a device.
 type DeviceWebhookConfig struct {
-	WebhookURL               *string `json:"webhook_url,omitempty"`
-	WebhookSecret           string  `json:"webhook_secret,omitempty"`
-	WebhookEvents           string  `json:"webhook_events,omitempty"`
-	WebhookInsecureSkipVerify bool   `json:"webhook_insecure_skip_verify,omitempty"`
+	WebhookURL                *string `json:"webhook_url,omitempty"`
+	WebhookSecret             string  `json:"webhook_secret,omitempty"`
+	WebhookEvents             string  `json:"webhook_events,omitempty"`
+	WebhookInsecureSkipVerify bool    `json:"webhook_insecure_skip_verify,omitempty"`
 }
 
 // MessageFilter represents query filters for messages

src/domains/chatstorage/interfaces.go

@@ -85,7 +85,9 @@ type IChatStorageRepository interface {
 	SaveDeviceRecord(record *DeviceRecord) error
 	ListDeviceRecords() ([]*DeviceRecord, error)
 	GetDeviceRecord(deviceID string) (*DeviceRecord, error)
-	// GetDeviceRecordByJID fetches a device record by its JID.
+	// GetDeviceRecordByJID fetches a device record by its JID. A full AD JID resolves
+	// the exact slot; a bare-number JID resolves only while unambiguous — when several
+	// slots share the number it returns nil rather than an arbitrary sibling's record.
 	GetDeviceRecordByJID(jid string) (*DeviceRecord, error)
 	DeleteDeviceRecord(deviceID string) error
 	// SetDeviceWebhookURL sets the webhook URL for a device.

src/domains/device/interfaces.go

@@ -3,6 +3,7 @@ package device
 import (
 	"context"
 
+	"github.com/aldinokemal/go-whatsapp-web-multidevice/domains/app"
 	"github.com/aldinokemal/go-whatsapp-web-multidevice/domains/chatstorage"
 )
 
@@ -14,7 +15,7 @@ type IDeviceUsecase interface {
 	// webhook configuration (url, secret, events, insecure_skip_verify) at creation time.
 	AddDevice(ctx context.Context, deviceID string, webhook *chatstorage.DeviceWebhookConfig) (*Device, error)
 	RemoveDevice(ctx context.Context, deviceID string) error
-	LoginDevice(ctx context.Context, deviceID string) error
+	LoginDevice(ctx context.Context, deviceID string) (app.LoginResponse, error)
 	LoginDeviceWithCode(ctx context.Context, deviceID string, phone string) (string, error)
 	LogoutDevice(ctx context.Context, deviceID string) error
 	ReconnectDevice(ctx context.Context, deviceID string) error

src/go.mod

@@ -22,7 +22,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/valyala/fasthttp v1.71.0
 	go.mau.fi/libsignal v0.2.2
-	go.mau.fi/whatsmeow v0.0.0-20260630180629-b572e5bcb92b
+	go.mau.fi/whatsmeow v0.0.0-20260709092057-73fe7355f59f
 	golang.org/x/image v0.41.0
 	google.golang.org/protobuf v1.36.11
 	modernc.org/sqlite v1.50.1
@@ -68,12 +68,12 @@ require (
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	go.mau.fi/util v0.9.10 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/exp v0.0.0-20260611194520-c48552f49976 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect