fix(security): bind WhatsApp bridge to localhost + optional token auth

2026-02-13 05:37:56 +00:00
parent 32c9431191
commit fd7e477b18
6 changed files with 68 additions and 32 deletions
--- a/nanobot/config/schema.py
+++ b/nanobot/config/schema.py
@@ -9,6 +9,7 @@ class WhatsAppConfig(BaseModel):
    """WhatsApp channel configuration."""
    enabled: bool = False
    bridge_url: str = "ws://localhost:3001"
+    bridge_token: str = ""  # Shared token for bridge auth (optional, recommended)
    allow_from: list[str] = Field(default_factory=list)  # Allowed phone numbers