WATI WhatsApp-to-Asterisk SIP Gateway Development

## Brief: Multi-Tenant WebRTC-to-SIP Bridge for Asterisk Trunks

Build a SIP gateway service that bridges WATI WhatsApp Calls API WebRTC media/signalling to standard SIP trunks usable by Asterisk. The system must support multiple tenants, where each tenant can have one or more WATI WebRTC endpoints mapped to one or more SIP trunks on Asterisk.

The WATI integration uses SDP exchange over authenticated HTTPS APIs. WATI provides inbound call webhooks with `callId`, `sdp`, and `businessNumber`, and requires the bridge to generate a WebRTC SDP answer and POST it to `/calls/{callId}/accept`. Outbound calls require permission handling, SDP offer generation, and POST to `/calls/outbound-call/{waid}`. WATI requires Bearer-token authentication, Opus audio, complete ICE gathering without trickle ICE, and public webhooks that return HTTP 200 within 30 seconds.

### Required Architecture

**Core components**

1. **Tenant Manager**

* Stores tenant ID, WATI API base URL, WATI bearer token, webhook API key, business numbers, SIP trunk mappings, routing rules, and limits.
* Supports multiple WATI accounts and multiple business numbers per tenant.

2. **Webhook API**

* Public HTTPS endpoints for:

* New inbound call
* Terminate call
* New outbound call/connect
* Outbound call status
* Call permission reply
* Verifies WATI webhook `Authorization: Bearer {ApiKey}`.

3. **WebRTC Signalling Engine**

* Handles WATI SDP offer/answer exchange.
* Creates WebRTC peer connections.
* Forces audio-only Opus.
* Disables trickle ICE and sends complete SDP only.
* Normalises SDP fingerprints to uppercase where required.

4. **SIP Gateway**

* Presents each mapped WATI endpoint as a SIP trunk/peer to Asterisk.
* Supports SIP registration or static IP trunking.
* Converts SIP INVITE/200 OK/BYE to WATI call API actions.
* Bridges RTP/SRTP media between SIP/RTP and WebRTC/DTLS-SRTP.

5. **Media Relay**

* Transcodes only if required, but preferred codec path is Opus end-to-end.
* Supports RTP, SRTP, ICE, DTLS, NAT traversal, STUN/TURN.
* Maintains per-call media sessions.

6. **Routing Engine**

* Inbound: `businessNumber` or WATI tenant maps to SIP trunk, DID, extension, queue, or Asterisk context.
* Outbound: SIP trunk or caller ID maps to WATI tenant, business number, and WhatsApp destination `waid`.
* Allows one-to-one, many-to-one, and many-to-many mappings.

### Call Flows

**Inbound WhatsApp to Asterisk**

WhatsApp user calls business number → WATI sends inbound webhook → bridge identifies tenant and trunk → bridge creates WebRTC answer → bridge accepts call via WATI API → bridge sends SIP INVITE to Asterisk trunk → media flows between WebRTC and SIP RTP.

**Outbound Asterisk to WhatsApp**

Asterisk sends SIP INVITE to bridge trunk → bridge identifies tenant/trunk mapping → bridge checks WhatsApp call permission → bridge creates WebRTC SDP offer → bridge calls WATI outbound call API → WATI returns `callId` → bridge waits for outbound connect webhook with SDP answer → media session starts → SIP 200 OK returned to Asterisk.

### Multi-Tenant Requirements

Each tenant must have isolated:

* WATI credentials
* webhook API keys
* SIP trunk credentials
* routing rules
* call records
* call limits
* logs
* media sessions
* rate limits

The platform must allow:

* Multiple SIP trunks per tenant
* Multiple WATI business numbers per tenant
* Multiple WATI tenants on one server
* Per-trunk inbound and outbound routing
* Per-tenant authentication and call accounting

### Asterisk Trunk Requirement

Asterisk must be able to add each bridge endpoint as a normal SIP/PJSIP trunk, for example:

```ini
[wati-tenant-001]
type=endpoint
transport=transport-udp
context=from-wati
disallow=all
allow=opus,ulaw,alaw
aors=wati-tenant-001
auth=wati-tenant-001-auth
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
```

### Security Requirements

* HTTPS only for WATI webhooks
* SIP authentication per trunk
* IP allowlisting where possible
* Encrypted storage for WATI bearer tokens
* Webhook bearer validation
* Per-tenant rate limiting
* Full audit logging
* No token exposure in logs
* Optional TLS/SRTP for SIP side

### Deliverables

1. Multi-tenant WebRTC-to-SIP gateway
2. Admin configuration for tenants, trunks, WATI credentials, and routing
3. Public webhook endpoints for WATI
4. SIP trunk listener for Asterisk
5. Media relay between WebRTC and SIP RTP
6. Call permission management for outbound WhatsApp calls
7. CDR and call-status logging
8. Deployment scripts for Debian
9. Example Asterisk trunk configuration
10. Production hardening guide with DNS, SSL, firewall, and monitoring requirements