Channels & Messaging

Channels & Messaging

Dewee integrates natively with 7 messaging platforms (internal/channels/):

• Telegram: Powered by telego with inline buttons, HTML sanitization, and Markdown formatting.
• WhatsApp: Native multi-device connection via whatsmeow.
• Zalo: Official Account (OA) with OAuth consent flows (/v1/channels/instances/{id}/zalo-oa/consent) and Personal bot integration.
• Discord: Bot integration with thread mapping and slash commands.
• Slack: Socket mode and Events API webhooks.
• Feishu / Lark: Enterprise bot webhook integration.

Channel access gate

A channel instance can serve only senders that an external service says are entitled to it, for example paying subscribers. Add an access_gate object to the instance config. Before a message reaches the agent, dewee asks your verifier, through an MCP tool or a signed HTTPS endpoint, and gets back allow, deny or link_required. Instances without access_gate behave as before.

{
  "access_gate": {
    "verifier": { "http_url": "https://example.com/api/v1/channel-access/check" },
    "on_error": "deny",
    "link": { "url_template": "https://example.com/connect?token={token}" }
  }
}

• What is checked: direct messages always. Group messages only when the bot is mentioned or replied to. Set "scope": "dm_only" to skip groups.
• Errors: a verifier failure denies by default (on_error: "deny"). Set "allow" to fail open; every fail-open is logged.
• Caching: decisions are cached per sender, 300 s for allow and 30 s for deny by default.
• Replies: a denied sender gets at most one reply every 10 minutes. In groups the reply can be turned off with "group_reply": "silent".
• Account linking: with link set, direct chats get a signed link token (HMAC-SHA256, at most 24 h) bound to the tenant, the channel instance and the sender. Groups never receive a token.
• Secrets: store them in the instance credentials, which are encrypted and never returned:
  • access_gate_link_secret
  • access_gate_verifier_token (sent as a bearer token)
  • access_gate_verifier_hmac_secret (signs requests with X-Dewee-Timestamp / X-Dewee-Signature: v1=…, 5-minute replay window)
• Status and invalidation:
  • GET /v1/channels/instances/{id}/access reports status and counters.
  • POST /v1/channels/instances/{id}/access/invalidate with {"sender_id": "…"} or {"all": true} drops cached decisions, for example right after a user subscribes. It needs a tenant admin API key or the gateway token.
  • The CLI equivalents are dewee channels access status <id> and dewee channels access invalidate <id> --sender <id> | --all.
  • The cache is per gateway process: with several replicas, other replicas see the change when their TTL expires.
• Tracing: each decision is recorded as a channel_access.decision trace span.

The full verifier contract, with a reference verifier, is in docs/channel-access-gate.md in the repository.