From dd0cd5dcda14cc5b3340f9c463af923477138b9e Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 6 Apr 2026 18:39:38 +0100
Subject: [PATCH] refactor: dedupe whatsapp security contract helpers

---
 extensions/whatsapp/src/shared.ts | 48 ++++---------------------------
 1 file changed, 5 insertions(+), 43 deletions(-)

diff --git a/extensions/whatsapp/src/shared.ts b/extensions/whatsapp/src/shared.ts
index ebe3b5e4c4b..b63fb476f0b 100644
--- a/extensions/whatsapp/src/shared.ts
+++ b/extensions/whatsapp/src/shared.ts
@@ -23,52 +23,14 @@ import { formatWhatsAppConfigAllowFromEntries } from "./config-accessors.js";
 import { WhatsAppChannelConfigSchema } from "./config-schema.js";
 import { whatsappDoctor } from "./doctor.js";
 import { resolveLegacyGroupSessionKey } from "./group-session-contract.js";
+import {
+  collectUnsupportedSecretRefConfigCandidates,
+  unsupportedSecretRefSurfacePatterns,
+} from "./security-contract.js";
 import { applyWhatsAppSecurityConfigFixes } from "./security-fix.js";
 import { canonicalizeLegacySessionKey, isLegacyGroupSessionKey } from "./session-contract.js";
 
 export const WHATSAPP_CHANNEL = "whatsapp" as const;
-const WHATSAPP_UNSUPPORTED_SECRET_REF_SURFACE_PATTERNS = [
-  "channels.whatsapp.creds.json",
-  "channels.whatsapp.accounts.*.creds.json",
-] as const;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null;
-}
-
-function collectUnsupportedSecretRefConfigCandidates(raw: unknown): Array<{
-  path: string;
-  value: unknown;
-}> {
-  if (!isRecord(raw) || !isRecord(raw.channels) || !isRecord(raw.channels.whatsapp)) {
-    return [];
-  }
-
-  const candidates: Array<{ path: string; value: unknown }> = [];
-  const whatsapp = raw.channels.whatsapp;
-  const creds = isRecord(whatsapp.creds) ? whatsapp.creds : null;
-  if (creds) {
-    candidates.push({
-      path: "channels.whatsapp.creds.json",
-      value: creds.json,
-    });
-  }
-
-  const accounts = isRecord(whatsapp.accounts) ? whatsapp.accounts : null;
-  if (!accounts) {
-    return candidates;
-  }
-  for (const [accountId, account] of Object.entries(accounts)) {
-    if (!isRecord(account) || !isRecord(account.creds)) {
-      continue;
-    }
-    candidates.push({
-      path: `channels.whatsapp.accounts.${accountId}.creds.json`,
-      value: account.creds.json,
-    });
-  }
-  return candidates;
-}
 
 export async function loadWhatsAppChannelRuntime() {
   return await import("./channel.runtime.js");
@@ -219,7 +181,7 @@ export function createWhatsAppPluginBase(params: {
         canonicalizeLegacySessionKey({ key: params.key, agentId: params.agentId }),
     },
     secrets: {
-      unsupportedSecretRefSurfacePatterns: WHATSAPP_UNSUPPORTED_SECRET_REF_SURFACE_PATTERNS,
+      unsupportedSecretRefSurfacePatterns,
       collectUnsupportedSecretRefConfigCandidates,
     },
     security: base.security!,