fix(meta): resolve race condition in Business API sender identification

[LeonardPeixoto]

The BusinessStartupService shared a mutable this.phoneNumber property across concurrent webhook requests. When two webhooks arrived near- simultaneously for the same phone_number_id, the second request could overwrite phoneNumber before the first finished processing, causing messages to be attributed to the wrong sender (wrong remoteJid).

Changes:

• Compute senderJid as a local variable before calling eventHandler
• Pass senderJid as parameter through eventHandler -> messageHandle
• Await eventHandler to prevent concurrent mutation
• Replace all this.phoneNumber reads inside messageHandle with the local senderJid parameter

Made-with: Cursor

📋 Description

🔗 Related Issue

Closes #(issue_number)

🧪 Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🔧 Refactoring (no functional changes)
• ⚡ Performance improvement
• 🧹 Code cleanup
• 🔒 Security fix

🧪 Testing

• Manual testing completed
• Functionality verified in development environment
• No breaking changes introduced
• Tested with different connection types (if applicable)

📸 Screenshots (if applicable)

✅ Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have manually tested my changes thoroughly
• I have verified the changes work with different scenarios
• Any dependent changes have been merged and published

📝 Additional Notes

Summary by Sourcery

Bug Fixes:

• Prevent race conditions between concurrent webhook requests by eliminating shared mutation of the phoneNumber property and using a request-scoped senderJid for message processing.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Refactors the Meta WhatsApp Business webhook flow to compute a per-request sender JID and thread it through the event handling pipeline, removing reliance on a mutable instance field and awaiting the handler to avoid race conditions between concurrent webhook requests.

Sequence diagram for updated Meta WhatsApp webhook sender identification

sequenceDiagram
  participant MetaWebhook as MetaWebhook
  participant BusinessStartupService as BusinessStartupService
  participant EventHandler as eventHandler
  participant MessageHandle as messageHandle

  MetaWebhook->>BusinessStartupService: inboundWebhook(content)
  BusinessStartupService->>BusinessStartupService: loadChatwoot()
  BusinessStartupService->>BusinessStartupService: senderJid = createJid(from or recipient_id)
  BusinessStartupService->>BusinessStartupService: phoneNumber = senderJid
  BusinessStartupService->>EventHandler: eventHandler(content, senderJid)
  activate EventHandler
  EventHandler->>EventHandler: database = get DATABASE
  EventHandler->>EventHandler: settings = findSettings()
  alt content has messages
    EventHandler->>MessageHandle: messageHandle(content, database, settings, senderJid)
  else content has statuses
    EventHandler->>MessageHandle: messageHandle(content, database, settings, senderJid)
  end
  deactivate EventHandler
  MessageHandle->>MessageHandle: key.remoteJid = senderJid
  MessageHandle->>MessageHandle: key.fromMe = (senderJid === metadata.phone_number_id)

Loading

Updated class diagram for BusinessStartupService event handling

classDiagram
  class ChannelStartupService

  class Database

  class BusinessStartupService {
    - phoneNumber string
    + eventHandler(content any, senderJid string) void
    + messageHandle(received any, database Database, settings any, senderJid string) void
  }

  BusinessStartupService --|> ChannelStartupService
  BusinessStartupService ..> Database

Loading

File-Level Changes

Change	Details	Files
Compute sender JID per request and avoid shared mutable state when handling incoming webhooks.	Derive senderJid from message.from or statuses[0].recipient_id before invoking the event handler. Assign this.phoneNumber to senderJid only after computing it (legacy usage retained but no longer read in handlers). Call eventHandler with senderJid and await its completion to serialize handling per request.	src/api/integrations/channel/meta/whatsapp.business.service.ts
Thread senderJid through event handling to message processing and replace reads of this.phoneNumber.	Extend eventHandler to accept senderJid and pass it down to messageHandle for both messages and status updates, awaiting each call. Update messageHandle signature to include senderJid and use it instead of this.phoneNumber when building message/status keys (remoteJid, fromMe). Remove remaining internal reads of this.phoneNumber in the message/status handling paths, relying exclusively on the senderJid parameter.	src/api/integrations/channel/meta/whatsapp.business.service.ts

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• If the goal is to eliminate shared mutable state causing race conditions, consider removing this.phoneNumber entirely and consistently passing senderJid through all call sites and usages rather than still assigning to the instance property.
• Now that eventHandler depends on a senderJid argument, it might be safer to encapsulate the JID derivation inside eventHandler itself (or validate the argument) so that future callers don’t accidentally pass an inconsistent value and reintroduce attribution issues.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- If the goal is to eliminate shared mutable state causing race conditions, consider removing `this.phoneNumber` entirely and consistently passing `senderJid` through all call sites and usages rather than still assigning to the instance property.
- Now that `eventHandler` depends on a `senderJid` argument, it might be safer to encapsulate the JID derivation inside `eventHandler` itself (or validate the argument) so that future callers don’t accidentally pass an inconsistent value and reintroduce attribution issues.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}