How to approve join requests in Python with the Wapito WhatsApp API

"""Group Join Requests with the Wapito WhatsApp API.

Turn approval on, read the pending queue, approve the people you can identify, reject the rest and keep your own audit log.

Run it with:
    export WAPITO_TOKEN="wpt_..."
    python group-join-requests.py
"""
import os

import requests

BASE_URL = "https://api.wapito.com/v1"
TOKEN = os.environ["WAPITO_TOKEN"]

# --- Turn on approval for the group ---
url = BASE_URL + "/groups/120363041234567890@g.us/settings"

payload = {
    "messages_admin_only": False,
    "membership_approval": True
}
headers = {
    "Authorization": "Bearer " + TOKEN,
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())

# --- Read the pending queue ---
url = BASE_URL + "/groups/120363041234567890@g.us/applications"

headers = {"Authorization": "Bearer " + TOKEN}

response = requests.get(url, headers=headers)

print(response.json())

# --- Approve the ones you recognise ---
url = BASE_URL + "/groups/120363041234567890@g.us/applications/+15551234567/approve"

headers = {"Authorization": "Bearer " + TOKEN}

response = requests.post(url, headers=headers)

print(response.json())

# --- Reject the rest and record why ---
url = BASE_URL + "/groups/120363041234567890@g.us/applications/+15551234567"

headers = {"Authorization": "Bearer " + TOKEN}

response = requests.delete(url, headers=headers)

print(response.status_code)

import hashlib
import hmac
import os
import time

from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
SECRET = os.environ["WAPITO_WEBHOOK_SECRET"].encode()
EVENTS = ["groups.participants"]


def verify(raw: bytes, header: str | None) -> bool:
    """Checks the X-Wapito-Signature header: t=<ms>,v1=<hex hmac-sha256>."""
    if not header:
        return False
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    ts, sig = parts.get("t"), parts.get("v1")
    if not ts or not sig:
        return False
    if abs(time.time() * 1000 - int(ts)) > 300_000:  # 5 minute clock skew
        return False
    expected = hmac.new(SECRET, ts.encode() + b"." + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)


@app.post("/wapito")
async def wapito(request: Request, signature: str | None = Header(default=None, alias="X-Wapito-Signature")):
    raw = await request.body()
    if not verify(raw, signature):
        raise HTTPException(status_code=401, detail="bad signature")
    payload = await request.json()
    if payload["event"] in EVENTS:
        print(payload["event"], payload["data"])
    return {"ok": True}  # answer 2xx fast; do the real work in a queue