From 631d1ff8334c71bc906e52ae62df29972a5f0565 Mon Sep 17 00:00:00 2001 From: saketkintali Date: Sun, 15 Mar 2026 15:45:21 -0700 Subject: [PATCH] fix(whatsapp): record channel activity only after access control passes for reactions --- extensions/whatsapp/src/inbound/monitor.ts | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/extensions/whatsapp/src/inbound/monitor.ts b/extensions/whatsapp/src/inbound/monitor.ts index 391c723f9b7..fa408b3a92d 100644 --- a/extensions/whatsapp/src/inbound/monitor.ts +++ b/extensions/whatsapp/src/inbound/monitor.ts @@ -466,12 +466,6 @@ export async function monitorWebInbox(options: { if (!resolvedFrom) continue; const from = resolvedFrom; - recordChannelActivity({ - channel: "whatsapp", - accountId: options.accountId, - direction: "inbound", - }); - // Derive isFromMe from reactor identity, not key.fromMe. // key.fromMe on a reaction refers to whether the *reacted-to message* was from us, // not whether the reactor is us. Compare JIDs directly instead. @@ -497,6 +491,14 @@ export async function monitorWebInbox(options: { }); if (!access.allowed) continue; + // Only record activity for reactions that pass access control — consistent with + // handleMessagesUpsert and prevents blocked/self reactions from inflating inbound metrics. + recordChannelActivity({ + channel: "whatsapp", + accountId: options.accountId, + direction: "inbound", + }); + const reactedMessageId = key?.id ?? undefined; const chatJid = remoteJid;