# WhatsApp Marketing & Operations Module

## Scope

This module adds a provider-agnostic WhatsApp operations layer for ECOLE ECOIN with a working free-first `Outbox + wa.me` mode today and an API-ready abstraction for future providers.

## Admin Routes

- `/admin/messaging/whatsapp`
- `/admin/messaging/whatsapp/templates`
- `/admin/messaging/whatsapp/flows`
- `/admin/messaging/whatsapp/outbox`
- `/admin/messaging/whatsapp/logs`
- `/admin/messaging/whatsapp/settings`

Legacy aliases under `/admin/whatsapp/*` remain available for backward compatibility.

## Core Tables

- `whatsapp_templates`
- `whatsapp_flows`
- `whatsapp_flow_steps`
- `whatsapp_outbox_messages`
- `whatsapp_message_logs`
- `whatsapp_jobs`

## Operating Model

- Templates are stored per `key + locale`.
- Flows connect triggers such as `enrollment.created` or `event.registered` to one or more steps.
- Immediate and delayed steps create outbox rows through the same business layer.
- The scheduler prepares reminders every 5 minutes and dispatches due outbox jobs every minute:

```bash
php artisan whatsapp:plan-reminders
php artisan whatsapp:dispatch-jobs --limit=100
```

## Current Trigger Coverage

- `enrollment.created`
- `payment.method_selected`
- `payment.transfer_uploaded`
- `payment.pending`
- `payment.approved`
- `payment.rejected`
- `attendance.confirmed`
- `session.first_attended`
- `event.registered`
- `event.join_clicked`
- `event.offer_clicked`
- `no_show.detected`

## Security Notes

- Phones use normalized `phone_e164` values.
- Logs mask phone numbers unless the user is `super_admin`.
- Links inside logs are sanitized as `[signed-link]`; raw signed URLs remain only in the protected outbox where staff actually operate the send.
- RBAC permissions:
  - `whatsapp.view`
  - `whatsapp.manage_templates`
  - `whatsapp.manage_flows`
  - `whatsapp.send_outbox`
  - `whatsapp.view_logs`
  - `whatsapp.manage_settings`

## Seeders

- `WhatsAppPermissionsSeeder`
- `WhatsAppTemplatesSeeder`
- `WhatsAppFlowsSeeder`
- `WhatsAppDemoSeeder`