WA Bot

WA Bot is a private WhatsApp automation project for managing chats and groups from one connected account. It combines chat commands, group controls, scheduled messages, a browser dashboard, and an API for sending text.

The problem

A single WhatsApp account can accumulate routine group moderation, repeated messages, and media requests. Handling each action manually makes the account difficult to operate. WA Bot routes inbound events to commands and services, while giving the operator a dashboard for pairing and settings.

Key features

• Connect to WhatsApp through Baileys with authentication state stored in MongoDB.
• Moderate groups with anti-link, anti-spam, warning, and blacklist commands.
• Schedule messages and recurring reminders with node-cron.
• Use Gemini-based AI chat and configurable model routing in bot commands.
• Bridge selected messages with Telegram through a dedicated service.
• Generate stickers and handle voice transcription or text-to-speech commands.
• Track personal or group debts in MongoDB records.
• View pairing QR codes and system information through an EJS dashboard.
• Send text through an API route protected by an API key.

Technical architecture

The Node.js process opens a Baileys socket and sends incoming events through middleware and a command router. Mongoose stores bot records and WhatsApp authentication data in MongoDB. Express serves the dashboard and send API; Socket.IO updates the pairing view. EJS renders server pages. Scheduled jobs use node-cron, while Telegram and AI services are called from their respective modules. The API is a separate authenticated entry point for sending text.

Engineering highlights

• The Baileys auth adapter serializes credentials and signal keys into MongoDB instead of relying on local session files.
• API authentication hashes the configured key and candidate, then compares fixed-length digests with timingSafeEqual.
• A message-edit utility decrypts supported encrypted edit envelopes with HKDF and AES-GCM.
• The scheduler restores jobs and reports failed scheduled sends through its logging path.
• Telegram alerts for rejected API requests are throttled in the authentication middleware.