From 6b214b38dba85d1d41155526755775640baf7c94 Mon Sep 17 00:00:00 2001
From: Rodrigo Borba <rodrigobm10@me.com>
Date: Sat, 28 Feb 2026 12:48:17 -0300
Subject: [PATCH] =?UTF-8?q?feat:=20Adiciona=20configura=C3=A7=C3=A3o=20Act?=
 =?UTF-8?q?ive=20Storage=20proxy,=20refatora=20servi=C3=A7o=20de=20decript?=
 =?UTF-8?q?ografia=20WhatsApp=20para=20processar=20bytes=20diretamente=20e?=
 =?UTF-8?q?=20ajusta=20componentes=20de=20m=C3=ADdia.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Procfile.dev                                  |   2 +-
 .../components-next/message/bubbles/Image.vue |  16 +-
 .../components-next/message/chips/Audio.vue   |  24 +-
 .../widgets/conversation/MessagesView.vue     |   3 +
 app/javascript/dashboard/helper/URLHelper.js  |  14 +-
 app/models/attachment.rb                      |  21 +-
 app/services/whatsapp/decryption_service.rb   |  50 +---
 .../incoming_message_wuzapi_service.rb        |  56 +++--
 .../providers/wuzapi/payload_parser.rb        |  34 +++
 .../public/assets/administrate/bot/avatar.png | Bin 0 -> 2165 bytes
 .../assets/administrate/user/avatar.png       | Bin 0 -> 27270 bytes
 config/environments/development.rb            |   2 +
 .../media-audio-imagem-whatsapp.md            | 224 ++++++++++++++++++
 ...6-02-28_fix_media_audio_imagem_whatsapp.md | 224 ++++++++++++++++++
 vite.config.ts                                |   8 +
 15 files changed, 581 insertions(+), 97 deletions(-)
 create mode 100755 chatwoot_zero/chatwoot-main-1/public/assets/administrate/bot/avatar.png
 create mode 100755 chatwoot_zero/chatwoot-main-1/public/assets/administrate/user/avatar.png
 create mode 100644 docs/troubleshooting/media-audio-imagem-whatsapp.md
 create mode 100644 progresso/2026-02-28_fix_media_audio_imagem_whatsapp.md

diff --git a/Procfile.dev b/Procfile.dev
index e9e9a62cc..2119e7ac3 100644
--- a/Procfile.dev
+++ b/Procfile.dev
@@ -1,4 +1,4 @@
-backend: bin/rails s -p 3001
+backend: bin/rails s -p 3000
 # https://github.com/mperham/sidekiq/issues/3090#issuecomment-389748695
 worker: bundle exec sidekiq -C config/sidekiq.yml
 vite: bin/vite dev
diff --git a/app/javascript/dashboard/components-next/message/bubbles/Image.vue b/app/javascript/dashboard/components-next/message/bubbles/Image.vue
index 9a17846a7..176f38596 100644
--- a/app/javascript/dashboard/components-next/message/bubbles/Image.vue
+++ b/app/javascript/dashboard/components-next/message/bubbles/Image.vue
@@ -1,8 +1,7 @@
 <script setup>
-import { ref, computed, onMounted } from 'vue';
+import { ref, computed } from 'vue';
 import { useI18n } from 'vue-i18n';
 import { useAlert } from 'dashboard/composables';
-import { useLoadWithRetry } from 'dashboard/composables/loadWithRetry';
 import BaseBubble from './Base.vue';
 import Button from 'next/button/Button.vue';
 import Icon from 'next/icon/Icon.vue';
@@ -20,19 +19,11 @@ const attachment = computed(() => {
   return attachments.value[0];
 });
 
-const { isLoaded, hasError, loadWithRetry } = useLoadWithRetry({
-  type: 'image',
-});
+const hasError = ref(false);
 
 const showGallery = ref(false);
 const isDownloading = ref(false);
 
-onMounted(() => {
-  if (attachment.value?.dataUrl) {
-    loadWithRetry(attachment.value.dataUrl);
-  }
-});
-
 const downloadAttachment = async () => {
   const { fileType, dataUrl, extension } = attachment.value;
   try {
@@ -62,12 +53,13 @@ const handleImageError = () => {
         {{ $t('COMPONENTS.MEDIA.IMAGE_UNAVAILABLE') }}
       </p>
     </div>
-    <div v-else-if="isLoaded" class="relative group rounded-lg overflow-hidden">
+    <div v-else class="relative group rounded-lg overflow-hidden">
       <img
         class="skip-context-menu"
         :src="attachment.dataUrl"
         :width="attachment.width"
         :height="attachment.height"
+        @error="handleImageError"
       />
       <div
         class="inset-0 p-2 pointer-events-none absolute bg-gradient-to-tl from-n-slate-12/30 dark:from-n-slate-1/50 via-transparent to-transparent hidden group-hover:flex"
diff --git a/app/javascript/dashboard/components-next/message/chips/Audio.vue b/app/javascript/dashboard/components-next/message/chips/Audio.vue
index 1960c8a77..b22b59acf 100644
--- a/app/javascript/dashboard/components-next/message/chips/Audio.vue
+++ b/app/javascript/dashboard/components-next/message/chips/Audio.vue
@@ -1,13 +1,6 @@
 <script setup>
-import {
-  computed,
-  onMounted,
-  useTemplateRef,
-  ref,
-  getCurrentInstance,
-} from 'vue';
+import { computed, useTemplateRef, ref, getCurrentInstance } from 'vue';
 import { useI18n } from 'vue-i18n';
-import { useLoadWithRetry } from 'dashboard/composables/loadWithRetry';
 import Icon from 'next/icon/Icon.vue';
 import { timeStampAppendedURL } from 'dashboard/helper/URLHelper';
 import { downloadFile } from '@chatwoot/utils';
@@ -30,9 +23,7 @@ defineOptions({
 });
 
 const { t } = useI18n();
-const { isLoaded, hasError, loadWithRetry } = useLoadWithRetry({
-  type: 'audio',
-});
+const hasError = ref(false);
 
 const timeStampURL = computed(() => {
   return timeStampAppendedURL(attachment.dataUrl);
@@ -59,11 +50,9 @@ const playbackSpeedLabel = computed(() => {
   return `${playbackSpeed.value}x`;
 });
 
-onMounted(() => {
-  if (attachment.dataUrl) {
-    loadWithRetry(attachment.dataUrl);
-  }
-});
+const handleAudioError = () => {
+  hasError.value = true;
+};
 
 // Listen for global audio play events and pause if it's not this audio
 useEmitter('pause_playing_audio', currentPlayingId => {
@@ -143,7 +132,7 @@ const downloadAudio = async () => {
       {{ t('COMPONENTS.MEDIA.AUDIO_UNAVAILABLE') }}
     </p>
   </div>
-  <template v-else-if="isLoaded">
+  <template v-else>
     <audio
       ref="audioPlayer"
       controls
@@ -152,6 +141,7 @@ const downloadAudio = async () => {
       @loadedmetadata="onLoadedMetadata"
       @timeupdate="onTimeUpdate"
       @ended="onEnd"
+      @error="handleAudioError"
     >
       <source :src="timeStampURL" />
     </audio>
diff --git a/app/javascript/dashboard/components/widgets/conversation/MessagesView.vue b/app/javascript/dashboard/components/widgets/conversation/MessagesView.vue
index 3c7f1829a..f3ab7509b 100644
--- a/app/javascript/dashboard/components/widgets/conversation/MessagesView.vue
+++ b/app/javascript/dashboard/components/widgets/conversation/MessagesView.vue
@@ -366,6 +366,9 @@ export default {
       this.conversationPanel.removeEventListener('scroll', this.handleScroll);
     },
     scrollToBottom() {
+      if (!this.conversationPanel) {
+        return;
+      }
       this.isProgrammaticScroll = true;
       let relevantMessages = [];
 
diff --git a/app/javascript/dashboard/helper/URLHelper.js b/app/javascript/dashboard/helper/URLHelper.js
index a4b3f32b4..a12e8d3ca 100644
--- a/app/javascript/dashboard/helper/URLHelper.js
+++ b/app/javascript/dashboard/helper/URLHelper.js
@@ -110,12 +110,16 @@ export const hasValidAvatarUrl = avatarUrl => {
 };
 
 export const timeStampAppendedURL = dataUrl => {
-  const url = new URL(dataUrl);
-  if (!url.searchParams.has('t')) {
-    url.searchParams.append('t', Date.now());
+  try {
+    const url = new URL(dataUrl, window.location.origin);
+    if (!url.searchParams.has('t')) {
+      url.searchParams.append('t', Date.now());
+    }
+    return url.toString();
+  } catch (e) {
+    const connector = dataUrl.includes('?') ? '&' : '?';
+    return `${dataUrl}${connector}t=${Date.now()}`;
   }
-
-  return url.toString();
 };
 
 export const getHostNameFromURL = url => {
diff --git a/app/models/attachment.rb b/app/models/attachment.rb
index 5840b2def..ac937e88e 100644
--- a/app/models/attachment.rb
+++ b/app/models/attachment.rb
@@ -50,7 +50,13 @@ class Attachment < ApplicationRecord
 
   # NOTE: the URl returned does a 301 redirect to the actual file
   def file_url
-    file.attached? ? url_for(file) : ''
+    return '' unless file.attached?
+
+    if Rails.env.development?
+      rails_storage_proxy_url(file, **dev_url_options)
+    else
+      url_for(file)
+    end
   end
 
   # NOTE: for External services use this methods since redirect doesn't work effectively in a lot of cases
@@ -66,7 +72,12 @@ class Attachment < ApplicationRecord
     return '' unless file.attached? && image?
 
     begin
-      url_for(file.representation(resize_to_fill: [250, nil]))
+      representation = file.representation(resize_to_fill: [250, nil])
+      if Rails.env.development?
+        rails_storage_proxy_url(representation, **dev_url_options)
+      else
+        url_for(representation)
+      end
     rescue ActiveStorage::UnrepresentableError => e
       Rails.logger.warn "Unrepresentable image attachment: #{id} (#{file.filename}) - #{e.message}"
       ''
@@ -188,6 +199,12 @@ class Attachment < ApplicationRecord
     file_content_type.start_with?('image/', 'video/', 'audio/')
   end
 
+  def dev_url_options
+    uri = URI.parse(ENV.fetch('FRONTEND_URL', 'http://localhost:3000').chomp('/'))
+    host = [80, 443].include?(uri.port) ? uri.host : "#{uri.host}:#{uri.port}"
+    { host: host, protocol: uri.scheme }
+  end
+
   # Marcel gem may detect OGG/Opus files as audio/opus instead of audio/ogg.
   # Lazily normalize existing blobs so presigned URLs serve the correct Content-Type.
   # Only applies to .ogg files — .opus files legitimately use audio/opus.
diff --git a/app/services/whatsapp/decryption_service.rb b/app/services/whatsapp/decryption_service.rb
index 445a3d550..6f938ef91 100644
--- a/app/services/whatsapp/decryption_service.rb
+++ b/app/services/whatsapp/decryption_service.rb
@@ -1,7 +1,6 @@
 class Whatsapp::DecryptionService
   require 'openssl'
   require 'base64'
-  require 'net/http'
 
   # HKDF Info strings for different media types (WhatsApp protocol)
   INFO_STRINGS = {
@@ -12,55 +11,42 @@ class Whatsapp::DecryptionService
     sticker: 'WhatsApp Image Keys'
   }.freeze
 
-  def initialize(media_url, media_key, media_type)
-    @media_url = media_url
+  def initialize(media_key, media_type)
     @media_key = Base64.decode64(media_key)
     @media_type = media_type.to_sym
     @info = INFO_STRINGS[@media_type] || INFO_STRINGS[:document]
   end
 
-  def decrypt
-    return nil unless @media_url && @media_key
+  def decrypt_bytes(encrypted_bytes)
+    return nil unless @media_key && encrypted_bytes && encrypted_bytes.bytesize > 10
 
-    # 1. Download encrypted bytes
-    encrypted_bytes = download_content
-    return nil unless encrypted_bytes && encrypted_bytes.bytesize > 10
+    Rails.logger.info "WuzAPI Decrypt: Processing #{encrypted_bytes.bytesize} bytes"
 
-    Rails.logger.info "WuzAPI Decrypt: Downloaded #{encrypted_bytes.bytesize} bytes"
-
-    # 2. Derive keys using HKDF SHA-256 (112 bytes total)
+    # Derive keys using HKDF SHA-256 (112 bytes total)
     expanded_key = OpenSSL::KDF.hkdf(
       @media_key,
-      salt: ''.b,  # Empty binary string
+      salt: ''.b,
       info: @info,
       length: 112,
       hash: 'sha256'
     )
 
-    # 3. Split derived key
     iv = expanded_key[0...16]
     cipher_key = expanded_key[16...48]
-    # mac_key = expanded_key[48...80]  # For verification (optional)
-    # ref_key = expanded_key[80...112] # Not used
 
-    # 4. WhatsApp file structure: [Encrypted Content] + [MAC (10 bytes)]
-    # Remove the last 10 bytes (MAC)
+    # WhatsApp file structure: [Encrypted Content] + [MAC (10 bytes)]
     cipher_text = encrypted_bytes[0...-10]
 
-    # 5. Try AES-256-CBC first (older WhatsApp versions)
     decrypted = try_aes_cbc(cipher_key, iv, cipher_text)
-
-    # 6. If CBC fails, try CTR mode (some implementations use this)
     decrypted ||= try_aes_ctr(cipher_key, iv, cipher_text)
 
     return nil unless decrypted
 
-    # 7. Validate that we got a valid image (check magic bytes)
     if valid_media?(decrypted)
       Rails.logger.info 'WuzAPI Decrypt: SUCCESS - Valid media detected'
       StringIO.new(decrypted)
     else
-      Rails.logger.warn 'WuzAPI Decrypt: Decrypted but invalid media format'
+      Rails.logger.warn "WuzAPI Decrypt: Decrypted but invalid format (first bytes: #{decrypted.bytes[0..3].map { |b| format('%02X', b) }.join(' ')})"
       nil
     end
   rescue StandardError => e
@@ -77,7 +63,7 @@ class Whatsapp::DecryptionService
     decipher.iv = iv
     decipher.padding = 0  # WhatsApp doesn't use PKCS7 padding
 
-    decipher.update!(data) + decipher.final
+    decipher.update(data) + decipher.final
 
   rescue OpenSSL::Cipher::CipherError => e
     Rails.logger.debug { "AES-CBC failed: #{e.message}" }
@@ -90,7 +76,7 @@ class Whatsapp::DecryptionService
     decipher.key = key
     decipher.iv = iv
 
-    decipher.update!(data) + decipher.final
+    decipher.update(data) + decipher.final
 
   rescue OpenSSL::Cipher::CipherError => e
     Rails.logger.debug { "AES-CTR failed: #{e.message}" }
@@ -126,20 +112,4 @@ class Whatsapp::DecryptionService
     false
   end
 
-  def download_content
-    uri = URI.parse(@media_url)
-    http = Net::HTTP.new(uri.host, uri.port)
-    http.use_ssl = (uri.scheme == 'https')
-    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-    http.open_timeout = 10
-    http.read_timeout = 30
-
-    request = Net::HTTP::Get.new(uri.request_uri)
-    response = http.request(request)
-
-    response.is_a?(Net::HTTPSuccess) ? response.body.b : nil
-  rescue StandardError => e
-    Rails.logger.error "WuzAPI Decrypt Download Error: #{e.message}"
-    nil
-  end
 end
diff --git a/app/services/whatsapp/incoming_message_wuzapi_service.rb b/app/services/whatsapp/incoming_message_wuzapi_service.rb
index 8a19b7f77..402fcadcf 100644
--- a/app/services/whatsapp/incoming_message_wuzapi_service.rb
+++ b/app/services/whatsapp/incoming_message_wuzapi_service.rb
@@ -52,7 +52,7 @@ class Whatsapp::IncomingMessageWuzapiService < Whatsapp::IncomingMessageBaseServ
       @contact = find_or_create_contact(parser)
       return if @contact.nil? # If contact couldn't be determined, stop processing
 
-      @conversation = find_or_create_conversation(@contact)
+      @conversation = find_or_create_conversation(@contact, parser)
 
       # 5. Echo/AI Deduplication Logic
       # ------------------------------
@@ -124,7 +124,7 @@ class Whatsapp::IncomingMessageWuzapiService < Whatsapp::IncomingMessageBaseServ
     contact
   end
 
-  def find_or_create_conversation(contact)
+  def find_or_create_conversation(contact, parser = nil)
     # Find the LAST open conversation for this contact to append to
     conversation = inbox.conversations.where(contact_id: contact.id)
                         .where.not(status: :resolved)
@@ -136,12 +136,26 @@ class Whatsapp::IncomingMessageWuzapiService < Whatsapp::IncomingMessageBaseServ
     # Find the ContactInbox association to linking
     contact_inbox = ContactInbox.find_by(contact_id: contact.id, inbox_id: inbox.id)
 
+    # Build additional_attributes — include referral info from Click-to-WhatsApp ads if present
+    extra_attrs = {}
+    if parser
+      referral = parser.referral_info
+      if referral.present?
+        # "referer" is the field Chatwoot automations use for "Link de origem" condition
+        extra_attrs['referer'] = referral[:source_url].presence || 'meta_ads'
+        extra_attrs['source_type'] = referral[:source_type] if referral[:source_type].present?
+        extra_attrs['ctwa_clid'] = referral[:ctwa_clid] if referral[:ctwa_clid].present?
+        Rails.logger.info "WuzAPI: Setting conversation referer='#{extra_attrs['referer']}' from ad referral"
+      end
+    end
+
     # If no open conversation, create a new one
     inbox.conversations.create!(
       contact: contact,
       contact_inbox: contact_inbox, # Explicitly required by Chatwoot validation
       status: :open,
-      account_id: inbox.account_id
+      account_id: inbox.account_id,
+      additional_attributes: extra_attrs
     )
   end
 
@@ -261,28 +275,30 @@ class Whatsapp::IncomingMessageWuzapiService < Whatsapp::IncomingMessageBaseServ
       Rails.logger.warn "WuzAPI: Endpoint download failed - #{e.message}"
     end
 
-    # METHOD 2: Try local decryption if we have mediaKey
-    if attachment_data[:media_key].present?
-      Rails.logger.info 'WuzAPI: Attempting local decryption (mediaKey present)...'
-      decrypted = Whatsapp::DecryptionService.new(
-        media_url,
-        attachment_data[:media_key],
-        file_content_type(message_type)
-      ).decrypt
-
-      return decrypted if decrypted
-
-      Rails.logger.warn 'WuzAPI: Local decryption failed...'
-    end
-
-    # METHOD 3: Direct download (only works for non-encrypted or already-decrypted URLs)
-    Rails.logger.info "WuzAPI: Direct download from #{media_url}"
-    Down.download(
+    # METHOD 2+3: Download from CDN (follows redirects) then decrypt if mediaKey available
+    Rails.logger.info "WuzAPI: Downloading from CDN #{media_url}"
+    encrypted_tempfile = Down.download(
       media_url,
       open_timeout: 10,
       read_timeout: 30,
       ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE
     )
+    encrypted_bytes = encrypted_tempfile.read.b
+    Rails.logger.info "WuzAPI: Downloaded #{encrypted_bytes.bytesize} bytes from CDN"
+
+    if attachment_data[:media_key].present?
+      Rails.logger.info 'WuzAPI: Attempting local decryption (mediaKey present)...'
+      decrypted = Whatsapp::DecryptionService.new(
+        attachment_data[:media_key],
+        file_content_type(message_type)
+      ).decrypt_bytes(encrypted_bytes)
+
+      return decrypted if decrypted
+
+      Rails.logger.warn 'WuzAPI: Local decryption failed, returning raw bytes'
+    end
+
+    StringIO.new(encrypted_bytes)
   rescue StandardError => e
     Rails.logger.error "WuzAPI: All download methods failed - #{e.message}"
     nil
diff --git a/app/services/whatsapp/providers/wuzapi/payload_parser.rb b/app/services/whatsapp/providers/wuzapi/payload_parser.rb
index 5e272a98f..273abc50d 100644
--- a/app/services/whatsapp/providers/wuzapi/payload_parser.rb
+++ b/app/services/whatsapp/providers/wuzapi/payload_parser.rb
@@ -166,6 +166,40 @@ class Whatsapp::Providers::Wuzapi::PayloadParser
     }
   end
 
+  # Returns referral/ad tracking info for Click-to-WhatsApp Meta Ads messages.
+  # WuzAPI/whatsmeow may include this in extendedTextMessage.contextInfo.externalAdReply
+  # or via Info.Category = "business". Returns nil if no referral data found.
+  def referral_info
+    msg = unwrap_ephemeral_message(params.dig(:event, :Message))
+
+    # Check externalAdReply in extendedTextMessage (Click-to-WhatsApp ad flow)
+    if msg.is_a?(Hash)
+      ad_reply = msg.dig(:extendedTextMessage, :contextInfo, :externalAdReply)
+      ad_reply ||= msg.dig('extendedTextMessage', 'contextInfo', 'externalAdReply')
+
+      if ad_reply.is_a?(Hash) && ad_reply.present?
+        Rails.logger.info "WuzAPI: Click-to-WhatsApp referral detected: #{ad_reply.inspect}"
+        return {
+          source_url: ad_reply['sourceUrl'] || ad_reply[:sourceUrl],
+          source_id: ad_reply['sourceId'] || ad_reply[:sourceId],
+          source_type: 'ad',
+          ctwa_clid: ad_reply['ctwaClid'] || ad_reply[:ctwaClid],
+          headline: ad_reply['title'] || ad_reply[:title],
+          body: ad_reply['body'] || ad_reply[:body]
+        }
+      end
+    end
+
+    # Check Info.Category — some WuzAPI versions mark business-initiated as "business"
+    category = params.dig(:event, :Info, :Category).to_s.downcase
+    if category == 'business'
+      Rails.logger.info 'WuzAPI: Business category message detected (possible CTWA ad)'
+      return { source_type: 'ad', source_url: nil }
+    end
+
+    nil
+  end
+
   def sender_phone_number
     jid = extract_jid
 
diff --git a/chatwoot_zero/chatwoot-main-1/public/assets/administrate/bot/avatar.png b/chatwoot_zero/chatwoot-main-1/public/assets/administrate/bot/avatar.png
new file mode 100755
index 0000000000000000000000000000000000000000..4b5a2d686e7f86f29e4fac5142bffac3afaecb0a
GIT binary patch
literal 2165
zcmV-*2#WWKP)<h;3K|Lk000e1NJLTq001)p001)x1^@s6I-xKs00001b5ch_0Itp)
z=>Px#L}ge>W=%~1DgXcg2mk?xX#fNO00031000^Q000001E2u_0{{R30RRC20H6W@
z1ONa40RR91GoS+i1ONa40RR91GXMYp0M89gSO5SA-$_J4RA>dw8e41>RrK81M|VpL
z6jBAH3RI{xJfb0}5ik&Ax`s-8&@M_*5;S~if>DD3T|+SR#~A-4#G0V6R1gt@B`PRr
zC4_*Y;blQu-cS@MbRXTF>p8QXb#``U=iZ@EPtwkPoO>SkaUS<BgFb>+_HkdwiTFc2
z4bvHeYT&#I7z_u_O7S~@bBHs>y8zfF4*VE?k1)nsOIgvbFY4I!z7T`m3=vY`)bT_O
zSJnBz*pr;|VrhDer5J}@IBt!<II!{S*$fqS2d<QfaIWlWjyK?JFUJ+AaK}1-6a#jR
z12p<e0v~RvW!?E0g<GVR2}R=}&efI3bYfxBH`RMqQCOse1wO$om=>iZtjtrJ`JKsF
z{4?B2kBbt&X*|Xb`@l1IYuNvr2rVIHLK~6~sHybkzT8qG!ewyS4aSuDE#aasoyI6m
z2sP2}IXspAsecq9>G%K+>V{A>_73iff|Fmc6BT)b18YP@3gS6UNT2mHw)T<wKtqHv
z)rzL=%4jQc8x--`N?;)_=g;q1A75e7qcvI1IGqvNS|Wa<$OABMycep5D)8$C6{3ey
zprWaBf*}Eb$n+u@J4As~*Hnn?PQsZkfq_U^VQk(v;o#?H9(nUZR*Me1h$2Mn#fd(c
zGtLJS@9@C<2|jqb%4_CfS+B45X^K#1#XtoXARSS_$yz<DIXT6QpQj9&Uzx*RIXHK5
z&2=+Fz3#^qHG<T310G1FQyXiy<VGAh%48g(oFCcI{+~}%F(mlGP&W!|E;k=eL02Mk
zj=Os}toftIj8d?U8*)TXcYLuCDXUBbLlpAt#!iv)_7iD1jeDM;<#-DAp0hMGd8E!=
z=WwVqb4GsbNJHB{V&^4?5QjHI&AeQ1%WiNj)^Zu5#8Me@mt#6vfT2Nv%E1Z@2{IT|
z#Got5;c|?_$*UYL+{g&7i;oNH3h-Q)f*M<fgI^^AnlcpqwztKXyP{|q<i&M<?tU*!
zzsCb($}nuiT)+xWUQuE9sWf=4yRC-UwxJ7LRI@JjLCf6WNllrK6N!+_p|_(vd#o3V
zea;e&#1*5zRId%U(b<lTsh#^cV+*kH-OQOus|_X$;VN07VFNM>h$vzt>{T-3CJ$F|
z5{x}^Wz2`>QK-YT46!YKMbxht*^nZQGyG6pZnCpRB*Aj~RTW<UE&<o&j9QjD^LZvI
zTB_?NLqsx*r}+9r5t8WMK?=P6s2{z1Rz9f$OYxZs<?K?UdXZ~Jdtk=MtTA*$B5%xt
z!#ohKc1IH<>uDI~;N^oPP&`JV%dLRAab76HxJ?%D$W$w6#j0cn){gON{zG=02z~(V
zHN|=^pi)79b(icw@*`Go@S+MkF`W4e9b+NrMCVFj&o5_Gu)>^HVNJgfO-$l^I1j7@
z@39Kw8G6aHlS4E^0z<U7b|!J5ISemRplMc-86{g^bs!15FoYra=!pPE&$;x<i<!pb
zPstERp$ob!7l8tWC{~`G{2wVo(BqKM^knqVaCOJ2RSf?s%Q7y|(BxS3BL6sI2`fag
zmK6li2)%?k$;ECC<I4*R@+^itWk@H8`@&9WJ3dyt^)@eEnW93%%23c~2cl+`lyy>g
zZ~;Dc{Ba7|CA&_mc8Y#)2gvflv#+8xqf2aYpfLV+fHWTl9k|ok5j?uW^0hmdU7gSY
zyxdr_Goe?r-=$NFVCsm%XNr(1?~wsKDn~E^V68HP&SPRl`G^zHZB41gzQ4P~{><q#
zuf#bV?sVp%<M)1B6?z{*Ticr}n!0VOlvp`IF|PSC3>-(HDfeLXI1m-1o19Um3lJ+h
zt*6rxdnH3bQTPsRnlMxQ9?#B9E5cT7B^Yfq)drx{?>x&^;|sO*q&Y0ymdK{og>dyg
zl%n(DVL{A_GO$MP5cyKhL6?2E0=BfJr4%6<@bWksnZZ(;GW23a4?Qx%Z91BQednCF
zn+(lkf2;86K{wf%w~6>@%Fxpr+KxsU#uTx<-<kx<5c>i;F>-iscLI`<^MhM#)Aq1`
zKgpnPGoYt8te=$;tQ#khQr-RMB_%L1p%r=U+c;iDnL3=RWVk%a5*;n)1c%ngURG7U
zO79f?QmRX#3?){SkB9;tb~+=pwPaU>c%WPPxFsB1r1Q(+Jg1p^uBq|gG5j5;BglLy
zL!`ut@(~K-?ST9UncwwzMXO&3+Tq%_vl|{y;J$5j?7WVX$8lCPIjM)Ie?}W29DM4;
zj9<!mC?cllmx4y)jV3unIsa~?oGD|vKer`Z95wdjDMOt#(Zn<K^oA>B*>5D!FJ;D7
zY!3&Qnt5jpfU$!fL$M=bZ2RAo8GO}JA6RB3kEJq%xUD|098cI<t3mzMhFfd@Kqc6K
z2j6m++A2c>=rI((EBj0M9KN_BrAqLzLcg;SIurP8{Q^44)o2vZUiAau8KJFZw<5Yk
zLdp;_y&=-m8?NsNeekXS(hnN=LbKJf<7>Ok%mcR8`S<!tf>lgmG()a`d1R(*S*Kq*
zp+h7;BB}_{5ndT1Q+j&i_+mv5J-GE;T|XM>8OtcpCJIqn>H<fN?ILAY%IJhK4;qP{
zXo2=V0(`XI?&5nHr*$1Z<TdF*qYE1DR>sVT9(qC>lN0D!fo|jJ5*u+UtyYb0QIKl~
r<?M*lN*Q8BWpMAR$;?gcpCih@6jIHZ%*42700000NkvXXu0mjf=-S|S

literal 0
HcmV?d00001

diff --git a/chatwoot_zero/chatwoot-main-1/public/assets/administrate/user/avatar.png b/chatwoot_zero/chatwoot-main-1/public/assets/administrate/user/avatar.png
new file mode 100755
index 0000000000000000000000000000000000000000..269eab83a29c545bc81a6263c283e4b184bb0cce
GIT binary patch
literal 27270
zcmeI51ys~q*YN*COSgoih$1n}AU$+Si=dQ94Iwc|moP|3NsCCQNQ0zOBa%w1q!J=X
zgLLza-iz1A=ic|_{oeJgZ+&YqOWeabd+&43@9cfzzs50GLrsAQpAH`Y0HUjkvYG$@
zLcaw8csOWb;PA{GEza00>N)}d0mb(p5Ri~W0|3%eR$4kvI;tunrU+XeV>5&aoX5@9
z9<2=kFbOw%V^eFm6SE22!pcsJb-AX2mD$QnjP)kJDzB=&4BXO6(Zd0L-9t^w)Wh0T
z*o;*|93SQ;f_7jFcQR&nv$e5v6mb({{oz*x{r-C~n3eg5ij%b%tJL=fnRQe(m}L+S
zaAtlU0d7-X$Q5QmVIBy-fS|A-7c&(7JD67p4CUqK6&B&=6XAt2|M_AS$49?|IhdJ?
zXv)g}*&O;eF;+__Cwmbv*wxjQ$CZx<;a~xV2n!2?d7)q^lpC$V?dWdjWbDRm=Xm}P
zC&zwd;f|&bR`yO-2s`HQevM5K&Q4;itlt~@`TBEQw)Q_8vUB{C9hxH8&Db6c;o$}U
zospU8PaAt@2b&*VGcyIlZQ!<WJ10l99prEA&`4EPf13VnbGEjBYw74D=Yk%=pG5xF
z(oxIZ9uC%oJ0hGNOyP1a=$@SayUsg0X~O@4djeNz^}lswZ;5b1I9ek90pQQ-f5hly
zW&RHx`CjvnW^gyFe=z%A^M~1wnEGR?VQA_iG7fNKC%7#7M;slB{M---Hx!};;TM4l
zqyOl^z`rT|6)8W=RS{-Z=I;M$4%LG2id^9nfkHWX`9=76|M2mP=I=hxSz~7GWPBno
zzv}+x=f_YG4q6C=jrbp#r*S+H%rY`RGL89?s<Ek+-S^qy_+@B+8vWwW%v8i2;b3d*
zByMGEYyk(`+gZTCe--|s`6F~i6s;Vc5DxCY&_y%;k-FF6cmK8YxWdNjM+({-J2=9>
zN2nO<aftrR*`F!--R4K6ix``JPhN3Tgq;iA!3k~#1OH3;Umg2t`==qg9b@$R1b1*0
zH+MkTGXESGvlD{Z*xug8%GCI~Yp{!**`L||Gf<Bk`NhZY4Z*<Q*ApA7|G-!sja~i+
z<FvAKbTYOxg<q8wM^6opm6e%@yr7IUl%J1}j~~h_AOwL3L7`HzGJ^a95Wy?5f>Hv<
z!~4bb_u>6D0j`#CyT4Kes)b&)(XoDo|2WqFn2sM>|Lnxn(%8-dZYB;sZu+?3ca#4h
z*3%IBnIgw;{!Eo$;^1cp37v+}cS`@d3jMD$6T*814&^oF<%SwVpxjpkh4{FQArSN_
zNk~`_A^;IE5f%_SPLW?`<@YT4t7E@s=kGhwiL%oXVeaH=>;RXtKpz!Oww3(h_g@YF
zxtGV;{{MIS|2Lb)_kHE(CUZQA|8I5>Gq{7*|6~vOrI$ZfN#-BB=Knuq{$J;&prARw
z@D(V88)AAzfcuJ&IXX9aP5HP5cunDOV?J|Je#mKV{@aP?j}7}@4}CvQnyRXQb4dJt
zhDKM&{t=(@-_K>=k5TCO`)|&K=ye!<`w;nMO+4PIPP(N2X8tdW)t}zY5T?%G?`?k`
zrOZxvl=|-Z7t_D<jBv0*U%8EKWdHA5_!}30wRBAU7qGt^OpmGm)%YJbcyy=HL;QK_
z6@d#v%#7it!rW#MULo|&NKlAdn4kX&`VP;}i#|%42$=Ihezx?NvtPRL$MjzP_ao`a
zlI!2h|IM}f{|4kA?*GQcFU|Z#Lk3}ka6sSU;NpBR@ZS~xV)gx+DuQ;54xS&E3UM^2
ze=GZ4U+4S%$Hw``{YDVVi++J2-~ay8^w;X&O?Cfk(_gE9H~q^}+s?{K9QtQ#zZL&t
z_5Cg_@&m?o^z$RQxBx#tA3qHId-3lU8dh#_8y#6IbV50PzrjKI(f5uYM!(nmt)=ci
zTK-b=r{y1O&@az=e#HJCrRXO~=!aO~pHH!VNsHrC@P9!5HKhN5^JAB%jU1CWkvzq9
zB233hr?`$uoJgMHIuWL0rBhtTBu*qxah(X$vC=87V-hElr?^gp=~(F$*D;9`$x~b>
z!gQ>3itCufiR3A+6Ja`5I>mKN;zaTk*NHG4E1lvxCUGKpit9v}j+IVv9g{ebJjHb)
zOvg&6xQ<DjNS@+45vF6MQ(VU+P9#rpoe0yh(kZTE5+{<UxK4!WSm_kkF^Ln&Q(Py)
zbgXoW>zKre<SDKbVLDbi#dS>LMDi5Zi7*{2o#HwsaUyw&>qMB2l}>RTlQ@w)#dRV~
z$4aNTj!B$Ip5i(Yremd3T*o9%Bu{aj2-C6BDXwD@CzAgqF8sf~7XogF{xS$x^tV2I
z+g4IVe`5r*siG!YdRzbiq#pq69HHeb066mkz?=~Ph{OZHSw!^hW_bX(*l<-=O3Q6{
zA=x!vd+J5ia>d(qV!n0udjK{SWl7q7JeReoCY_Alq*&A8;8vYpwtmx&t>&07YtM4;
zEYMN)42t68vDS6*27sP+FO2r@m~tD%50zPLRlIe)J@C>pQP=ut^y@)km3Xnkx7U}Y
z^<r?t-W9W;n2k!jiRSK3ftrzWNB6voQzx+ukR&txK4UoLo7D*$w@H8sl;MG+bb<-l
znZEm8M)<r`@lS7VmhSR%g>MPj;6EbUZ(#pKc*mE{DBs(5Kvj+ulaw`$RERbnvjf8%
zBL;8`5ntv#NEn%4K0xt|D;tTG;OO8EW(PF`{+Wc>U4Ys^u@$W*k9pk(DE9W#LsxMl
zf|V%md(T`iV)<#95i-wG0t868U4HJj8-w_@XKJx)Nrc#Bn*iv;C{)0%GxacYQqS45
zD~u}%-uyvqCcx|)n(=uQ9L0fTjh6Mt_ad&vg5fSuTx|k0lkvwL4iYXt5-&1e;aDm6
zt_Vi!b7ZEE7Bm?8jC>7YJJVcPh0i!pLqLv#7?GdJFu$}yP@Y@lx?WYUb=VY>Z+#G6
zbO2s|PTB-SH>!-ENh7Xiq5((Kw7As~&aFeAa6|`z*z%tEh!1Ohz!_IUU4EWLc%x25
zU<Qu<cOr+ZIHWnKm(+uV1psvj8%MWvU4g(n{GvQJ4ykr?1LNSCecET#SNp>6)GfHo
z!8zoaaY*ABZvrF8)*gWoyxC5jI<Bf&I41;*LmIo*BTxhjCR~8CPHsFu&;(mc5dz3F
zsQF!fnJ;Z_=IfW1ubKcu%Csx=<)5rp<=eWb$JoVi-ZTNvaj~~~hFPOiF@-hHK94&m
zhT}2|Ne=><3B>foMTm#QL6u2+Oee0DFSf;?A(If;a}EPNPso?0C6Yik?@gOoaUyAx
zu)IJYWyWOV@Ao9a#BS6}DtEHuM7AIfZeyf^T9pk5$Q)oLdJ!z4G?Kd;8#giEM%6x$
zwgE>?d2p#xV=9u=Cv$fSvREaB#r1CML6GmW@ocjPZf}ecNY_rzcYB0U1%tAvuOllg
zt?RH^q72eohqcgJ<MSTADp7-!(c6u>nXM@_NU3<=J)}ieJDBGE1vi}P$M3}|I82Gs
zXxyl(Y1{W%X&zvF%xE<!rIB=?A@aiDdbCZU>7VVP5{~Wy*TqZ*YL*d~04>u%#>9)E
zAhtj>(p5!#OBQX~yw(|V2y)wjYFPI!bns%9h}>>GO4|hZHlctTi@Z=Ly=&BKy4h+1
zl-{LZ;f3~rvzYK#M8yJ|fsApx19E>S_UuU^ZKCl*Emt+Epppxo4K$K&`}m6}1*tYR
z@ATG68cDo3OjpGMJlZ!59$}#%tO=a*1<w1C?fc}m=E{U=xHr=tZW2fftcYrw&3jy?
zLAhH7Q=8?fw^37yO@ljJFom$)$b^$*+Qc1tDk)N<3vqbKZQIR!o9;(uQ>Jm>WqM+Z
zqk&(5k;jJP&y}NDOprZf0<e!Sx5XJs33U*TpCN4HGV=$0JY&EH=fP{WXTd2TQ`{u3
zA&3kRzpJp}dADMr`IDYsO(C&*tG8G9joQi^TB-C6BQ9UcLWV*(asWp)(DXi(YX`1_
z&sjpPZNi<~s0YKcZr3OX@RJNaY6|Nf4XnF+esdRm_llj_b|XCpjrcA6Ym>y~SXG?R
zUVuGqO6&1#eY~|7(0a%{xLMd->ciJ1BYN#%w4}3fd7)`}!N2RNw?s}nw@&EgQc83S
zMSVpXN(FL$kh8JI?VPV-_5ItULrp3fcYM67h%mgpy41YF1!`~M-mMZGw;Kx0ufR#I
z+lb#Qx82X7kt7+~5OIK(h{h160d7Oje8W|8*DH64oR-{h^%v>(i<YpeE_=C&B(C`L
z2D=&M-}0Mt%+ztn4&ztyeT=*gQg}*(%0v!&QM%c7mLv48wpRK~lvTk$ZV_yMtk&C%
zmT=0W+`MK!<2?OFg%@cZN#V)b;%s@Adp;%IdO0Tz2fADHa%8Rv*mb~O5g5MaYGn<?
z_#VYQCuI8SyLhG8oqVLeLU%3MlUNhKb;YwhCfGGA6Qt8SEpQ>qf(G3!%fkhP(~=jH
zM%i4=15xCY0LnRMOYw14LCk7~cy73m#)_w<?iLsKZCGLj)hn~k7|EH`A&*-x`H~5Z
zi0$)ZZ&@x7(OY>eySj<cmFeL+7F{979lv38Vc0i|0|5x5CKc(H565=J1#u+~2yE$(
zo;Y_Nq~U02@JK=I#SZxF$;ZR3=Q%+np7hVV8g73qtXR0Wi8Cxv&-LhbtDcaeEKR&s
zu%&kE2=FvBIqou6y6H&bd)SugM_Xssz;Khw$m;@{{&*4kL2DifZUXP9#(jF^j{;Iu
z50R;uOovgMs+_W6hF@-~%0rY9kdH0VhOKI$H`gF3+{k5&wXCr4=H<DkOCLtER<~r@
zv#?pE%{t!A>nS;d-b7ya+8r;e(AevHI5;mDM022VMczClbKI`3D?1FtrSR5<b*6e`
zKG%K1qFUctE{ybju}*kSrj&nBn9}E1QD#OQUTp512K(yOst={h*+)$y_Y|A(Wb*5}
z595~-x@E)Ks-=oO1L;wSNZ$ri&ZD=26OQGfG{)pBgSofwp6yJP0OhGX3=GyrE776c
zQ9GK{bcXtT&cz>DA4y!+N*I7${S-2V1#^iy59`9EriY`GP>KVSsG%(89{7|0KtHQV
z6SB~Sh#$OvuDDRQ39kX$4%!G5Nk)5FF7q@*yrg>j&1vZ@<a6)CJB8`fFH*<v3~`ze
zb~u@|Rgo2fbfWxV5k2dpN3Y$DYVgPuyf$xa)~%-sB~*scV6G`=oO=-357ZNdQG80j
zx27agS$9F2Ekl2*^4iuL?&skqMlG|>P!1d;smk3usvjyvh`qLh@S-F!49{+GE;Wso
zTx-JXER-!Rm!QL}RvJAV-aTv)WRl$QWLqb<#Sj<V;EbEJ9A-7~x5G9_w#3vx(#u&}
z?ybrhbk@iPu~lNt8P;LCT0acxm5{jD=qSj_k972%v$;8Bfyi|4yiRV{E&z&1et8q|
zIJf^Ww}0NUk#L;7mnLCATn;r)&O(T?wodnMPJSj{6-1VlNC5}RkY#1JZmBDrXV4#w
z<mDs1xn`FzdQ^u;mW1tb>tPLOU!^=?x;s^pXj>M~Z+38#eKGN72<fYx2se5Z>3Cw_
z79!JnOM%>wqw!S))1$(sS35YoS5k27xt~u)Y<6-^Ev8Ci)$-7ddGJm~sD)y14o7+2
zg#g&qJR?-v2jat31<^f9kR;s7ce_(>S!Hh*oe$%9Wlv}X;$<26Q2xOuDk^8q9HY}Z
zC6;^e-V;e0zs(66l&hTb%;;KhP-NaMP=uc!lLWgo76QA;4Dds~eQqevk1U*aJd;ED
z)bVRg^~h#0X{*B%!v~oH$YRVFLq!>;N7P<j#AkA11*{&SM@GpIe&J^E>udC=Dp{Gr
zBXE}Zts05w>yPg@G-X1O5X-O87GmKCiE{qymN-52v;0vLI$g|72}li`k}y11YWSU_
zF=zW6|7!_7r3c&?hB<h5Z5VD-KLmNHmSehlVuFU;q6M&EYPyBAQi5p`m^5dSSYNX2
zb-%mIWi)`x+E|LtI;TM#`}8YE{4j>-S;0>w13tlHAGoE@>34&}nt(2<PAAMrtud<y
zbSuWiF;5Z=xrhe<2V_9T<G}9G%dA<ZoN3=U$<V!GX-h~k!r^7QL|%usz?QsgJdvBp
z%b`S0B>5a~D?^cqfTjnC3%Q~2O|(YVpN7^@w+(@SJ(L)&L_Yugg^O#WT(C_@@^%+V
zD?lBpCPs*wBqcNXqOZ(utVyYs$RB2LWDU9A`sm_RJ=E{r14mpak_AQBJ9{Z_jFYvg
zZ;7j9wIX0LV&7d>n@oMwmFFy2h-YHUrJ`R6bnY#oM<M=#EnpEMUq>WKd>9m9&6A*X
z*SHJf^Vpi-u{%O-D%>YgHT*+tiKnLsT{e16m%oH5B(qNTSx#FHG*)k^)Npk8u$f}#
zZ80^}OhZa~X*p&M^Zs3Pw3aGbs~KD*7PbGer}aZJuN5zN-~5c@Q<C7lgF0vceb~+c
ztt8p7?&N(^zOPBpkmfb{2OC4H(FTnA-U0&#ut#oPlu8LDX(~CbSA5hlg~)hA#ia{k
zsi*8)8#=>hj^aD<1r5bQA9#DyVY|mw!yYW)6Y}u$ipGOF$ZY*}u2EJWU0kCvh&%h?
zNWyi=GR1uy*7ERD@Q$ulLzeyWgP2`w5T3NkzR?h&n#5f<6^Y5}s0*+IlnHf;$mL3E
zWWmHt1ce_himO*HD4@(d;>+IK&wOE8v52XoQ8y8Z8V7dv>*bi3d6Y`_<{JV?FQbeZ
zR@t}TC~&`xcTYEK==!-{EUGC_P<Wgw=YF*)=$r)mobzE2NJR<<2)OhFT9l+<ClOj}
zpe*fun9CQq`qA$z<X$5)nW%XDhKNrSkS7;2Q~hmZ=#ygt<Swbt%lUIkAr9mosm6W;
zJA0o(bt*0IW8LzK?|%n84QA}U+bMT_XZ8`_wdcG(eG67HZu?zj9IEzH5-Q;znv%y-
zUl$)8P&yR$89j`eOTpnaTn|c_2NzC1mJqs7bTFp%wXZB<(q~C1w9zXcw8hv>vBhQL
z22aPjy&kq~1wa9s^N*AH#5r;DJIn(T8yv|S4!5pTyo|Cy4Ge7Kr+BWw&eYC4xx|eW
za&#-1%gWWJ-8qma=J;IPpx5^3tGZh7*Q+-iqErx|SkQ$G1uq(b>d1!uxpUqgQz{OQ
z(416{cHP!*jWWvd{MnlL!hDxNZ@5sFy{z@|D)<Ap^*UcTD%{=5oZogby*}*yxb$`C
zi^bic4l(0rls40lVT>?x2J)<>9uvk}-qcJ8%g=&7`rS*rUFGhZ85o=cw=_HX&#E`y
zfm}5<XV2vF7ZTD4BFX8bYpH#r>~8HW7Exavz)+D}qguh--B=Z;@_AS}FGis5B29}1
z1Zn0>KpB9JOUI>;y<U~Gz>!Wx3`xBu8>!;MjX7;9Y%kMqSaIA5l5$ollseS3l8<I0
zVU*a@j1sXgT1lof5@QC$pBXnls94CG=WU8rdjj!)+eO=*@glP%K07xRuB8Xi_VX_k
zCU!eNzTx;O`@{RC<<E=V^g4B=!5bq9-*z$1ys#+x&~f#Hc9NI{8-Y3l)kgh27DvJ~
z6(`=5($~t>hkbX78p`Q%Mp~yo71|7rHul%qE<Cf%`IeT9q;q#QM(6zXmPdTHUf35^
z=sG&u{rK*9Xa)s4K#-Jd5(ACsNQoC)w9HVc8t6WhahW3-o|$oYH@es|yE@@yt&0d*
zE!5#+R|<8YF-YlNc_STole&ewE-o@ERu^f~%d*j4kw7b$!N!yO97`&v&A$MH(%&Zg
zJyzSLNM<vu*L~8Fe6It>3G>@b+ZQG}o*2Bk`#R(jI4%GxU$*NSDm1v1k=xlmoNQZL
zZ!V!~%R|NvTjfHAkrSbMR$<;=?QC%!jB(nYhwpsv8}LmAQbX-5S=RD!*D^!dS9gcm
z84tgz5toOO5h9y06mJBOCW+TY;}%KyO4F*U6R5BUtf|v>J!!ppcP&+b^?_eNmPVX+
zfYG&PdB($uV9lL(kr`eDBu6W<)Hl2?nE2np2*P^xL|5xIzs%TcGmYmG#bA`<(QtEK
z#1?}tJM69s?b&4EaP;h@I*6{<)&t=Bx(5T|1;zv72kr`wOV`UGUiZGq%A^dKX;!<;
z)RcRK4)uts-50@o(@c`@;2{mZTp+-B?#LCtV+kZ-T~rXXcR*4hyggCJR8q&jUG$1$
z^3Bd<A;Gh}HuW=g#1+Cj6LrfZE43Dy+GIzjsDn;hOz)P7?kR~a1J%ST#rri?S1}yC
zHNiZ^yFvwTQt@D;fJAl9(HoMIx~IwXOGiM2pi%V=Mg)?6iD}#2$3Eh2x4w~!<4$A*
zTgje@Ajq(H;*wwCrw;B<#)Ai`KGv=}I~bKqR+BqbF7!nM1c+tx`4r!=M$tPX?i03?
zDXw<yYB>5e7f=z+7U*lHOoSxICtqF2Qs>LL%wc~ofolc(B?2s|4+YIH7(FY^xx_=k
z9Fr{;Z>VE2b5ONpOR!fqa%Y%ufHV5*!!Kn|bSgQ5MzEZMi4|xcJr?I{osC1io_P}L
zba{lW*9s%c^t~Tz*}I-Sb%vXan-&+tdH4*96;oUrpJ~dZRt%0mSCz71Pm^&H3h5=d
z_c%pdV81&>pvAtfE8>g$`R#&8N|7eOqj!qW#qQqF3yQ|!H3{_Oz3t*Zl&yk)RWs|0
z_tj^el#eZ0_;^P5RwajG%^6E-hVZ@_flb0)gZwAoSLI-q%O9E`aG1jghD`Ug==U}B
zsKNFXs@ro<H!yX^+G*%1bLTXN@{-6IA^q~6OI5@1*C-DyOLKV-5s#u9&+&-u3E@2Y
z(hFbffp3{q#K#NN-(N;=Xf@vU_!l^0%Nm}c-VAins>@yF`Q!q=B|vf`G&r~Qk>jTe
zAGnT2ll&PH@<bY!2O37i{TRZ@$iFD)rW@>+crdI~Tc%&LTKw!9a~LM=#+gM?N~wdF
zY9EJz`RvlZ*;iM~O(l#1Mgs%}aS*ZCu<R)L4OcaC7HHUq<QVjIVhVZY*;$70sae0A
zNqil-Ai`HvC9CVN-pK{kzenH7)0_1>GWX81jIh09qH?o2V%4jS-WS1hW=~_#C8Eh{
z7kYA$m`hSl6Pb;ey6N^Ag(1F}#AULcO>mC^KpFOCf{UxVKBvDVxQoNKWASo=@XLzE
zr-0f~5#=VlF2<f!5U@Zgc7IK7%gt{19)GHfT3o**9jOKt+DnIOP4RT-(l=JcqlNpK
z9IrNm7}Hy^4r`1#)R|z(JJ}<-JOvhJcAVMNxDIbpO1HHslIt<(KKc#bVQQW$x_WLk
zHiXx>5+J5W-RM0JJMWea7bq_85MOoe);>`6heUE#9m>iEg%^s|04Biw$XhnER=|ia
z(vlT#sMoP?exD4}o*C0uI$?sS4NoO@0V7F_2r%-SAs6OpI9F&y$p}GO?yRmLJm^p!
zy%!vk#C6XbC2c-85LK$jGY70?AGgh}zL}kqH{NQ0)qm~zQwhwKAc3gf=_oF~jC&p%
zNgi~P-NXgT2)YichmBt&`RW9oZ0irFH@q9C#9kYB=oK&1RgcI7Jif;6YOM!{$t!pi
zid=UnxOR|enF{ghTO)a@ade4LCAkh(m@=RhPx49)b|cn5OORsm-CIDM`W|a$|BVzw
zcgzm+j;RZmUI-_UUBXwgBc5I*=gsLZPsqExP!<eox&zc*EKT%PMIQ}0VCU-3%`Hxa
z@z|(yQt&>?+PXGG6t1}d#ir*-^p#210{}#bT2yIarjo28R9`d@eNkE~7QfZV%%pcg
zM6TuL;%hmqUKoQ8RXE5CV^B7~?f$j6Y<3a^s$+W7m{rzn5D(hM)B$`%iDul~u0Eg^
zXs7204iqKKxg7^mXshw~#MlGe-=y;I@p4-cB4fGg#igh4n*P<{a|uj0A~sGJwgPL~
zfX>AIirKu@2UY2q-Sq+(pO*Z`z&(pCWyM4Y8Qi?q$NMe?f{*#RGcSy@atYL_J+K9c
z+NRTj_Oh256c1;s4h3-Y21r0uw?m0OBv&itzPz`sXG5xSt<HPjmRLqlFB+HGMEt||
zGd{4AF+)vTEU4C8OqVD;I8dP7v)v%0wP-;fbX(gk^KKrN-WS-|n1nwR`8A84l$N_l
zTHKm3@x5n)QpBzLe2;@|V&~SXFIp=MbNzaBV!V$pxX!Lvbeak?(<3vi4i(_QUSu68
zO5b+z%vD?L_|?MrkciH!r1l=)7#2d*m6_8%iw?@6X2mL3AAd>zask0MT6`IHQ}j9p
zSBN1+59LD;06V`c*W#_f!Nj1l<VzVRg?;HooH+aVr?KF<)t2{Px0aR{uJ5Ss+~}YR
zxOx!2d_^^*oh4^a{*@!kZDwN{r2dt#u$--w_>WH7A@`jXAxhyd)Ll^{?*od5`g3*|
zpMUl|*iNub@Lk{aQ3|J3)`qmh*xIM6R=gI^kn2QE5`Wl7Up@4EAIrA3S#Et<YpiF(
zEg155*5N>}f~&~Rhv*qXTt9oLb`kXW><6YEa=&Mn^CTouQ_W)&P3Tst(*2Ny#mkAS
z1v(EN-RF3LnS4}`D3xP&6dd>%85ddD%In=WiJHoQn-$!7X6~&`)Jj#wzWkIO`)v>T
zzOBptt)hB_%j2^?v9~ZBtr(|QrK9h`ObQF{-<*4@EGgHTibMDW?ZFde*9(R2=QT1_
zrpE0HTVr?l;g=F~%C!fJ!Cyq1z7i?WnqT8=@9$}1s_JenPGC!8wICT@9g8QDBx=3t
zU;lpOt(!yl)xeMX?PW#`*FxZmcYEw!A$_APnxR=V^Ff-iFw-va?bcC>+zM?)X1Uf$
ze+cb4yY@q>Z7OC_Ue+%gEx9V(qHVd4_6T1z<TB%4mm<!SK;GFRwcpba^IpN#*szjr
z&O#3PN1L|9T1#<sNI~fL`frUu6R0-cu^}^F=M3n6h6A`r3tvvTkv4a;R#@O!C)xyl
zMM$EC(yHQv7AL>DFbSJfaDGq5SKYcU;{E$U;|~sRI6WkO0DiDnucw%!Kuks(#Dicw
zs@SnP7rn$u&4^zUK=X>^6Hp5tmRHEHL3#>u$D)XR-yx=aRll}5j19V_;&ttWmCLy`
z%+QPRfAXu|$`7cXlI#_)-ltyLyTelR5+{_V^qV9bQ}}ye6st0%rMIjsKf0ztkB!#W
zvu<Y@turEe;l-UWn+uI*;!$)+x~oUhcwOOLmzQ=ON(<~TMPNH0D<)u-&Ps7(LK_Dk
zWa$9Zm@i$gh`{F1<!boBj_$o`IrPv*`oY=q)4P*>udz~s)+OXj0r7FeUQri4gMg2v
z#vG}F5$!LR>tDKaRTbV=D$7^IU=ja_D_h&8|6+UMnYn%;ir6S=hLNd@zBD<%rTF!o
zRg3klb)1fU)8$}vV8yu~Zr2~=q%j;MuTTRo-+knG*%~28mt#M_yOul482jSdo&51>
zFpp8T)}foD#g#`AanvZ|wL!eL8-+q9H?(-pRXjQ3b2%?e+ec@=!(D6O3M=kcjd>{c
z&4SM!LvOA)3q36IFPBRFd4;;Ws9Nv6s?DQ|y>dW&d1W^JF05jU4LuIcXTip24!-QG
z2ZDeCtT-iMw!q$iMFSBR&b9nIlB%iHuUa;*!RofKHqGrHvt#R=F(7?Q5~Sd{@KqMF
zd&!@j6i^T>7`xTA+qI*U<3;57;hRyr>Zb=cRN|Fdjgsv_OqD5}3CVu;PS#^`L86A^
zEjm7mu>LGN+(Ter>kV5Adl^14{a_6WK5$4_@`X)<YbX9eN27tTpJXfJKKF>mr{vsg
z%Z?!sZIvc1aZq!#&zC2uUJ83WAsFrf8ajm7&BLhy@jHHoTPB<}LQWvy4Ki6WJ68Ei
zb&}CCmZ#vey3shQ=9SI5SC=1#xDJS74R57=`6BszYZ({gnH|Z~)o(f%Q)HH%r1J1X
z5f7%j#2;eeho+ZMu9~r!m0!V(L56Etg3=_~7*OXm1&r$#F^%T$FS)D)#-pByl{N@I
z#dr$C5WpRmERBD4N3K*)qkx+C$>-Y>b>dpZB(;WGsRE3~bg>F02F4*6Wfx!NRY=vl
z=D6rOrd6K{QMzJE+BhBVhMrvXJei_CpkN%Shu`+nYGi6KjKgL-@f>p>&8_)$N6f)s
zFHQSYUfJ|N--}lr9^+u=&PS-<>@CC0yibQ`ne5^N@TXZ2ukK{dwcU(ZvIbh6OvHLz
zNJaG0s#R(_o?mldM(-<hx#j?9+!N)&=B(2bGB%V~xAPv)<Cba0C+4$wX&xBJff6}E
z)7KxzC|0b8ohqcRal{gnpP%XG^IfKxO7h|T{Ap!4><i%x#mB|Yp6Z*P^Z8``EfA|(
z85bx2^U`^FR`09N4wD27NWXzHVhJ>_;j(9ZbtWmfFu%8*w<&M^G5;V>euu6|aq^2$
zuXs(K^i9u&VK|L`5BXa39L_jSy<ep@FX!E1W1qs!=?G`yT3#)>S6cDv1m6e)AWtO;
zv91tp4ctjEcO=m)zP{wd3n2N;CgO}6nDi3HH88hfSD$&BPnO{ac;FzC5>~_`o?0o#
z2*gDPe9Rx<=xYXmC7gb9<ugMyMm`TWtqpvNIAy2aLcH(QMPKh(ZV)y&(^GweUa^z4
zAJm}so<uzh<ktHXoA2c}>J^za@5RN~AgTPyCDKR5sBIhR^py0sQ8ab>B$f#lub9&r
zszb1ND%96kLl;p*PxM519&E}xI9*&~+#?RSRQp+pmsaSu`E#SoOFju1MZ$NhT%4?j
zYtGTy0)nIurt0PC080f*v1F?Y?>^w*&QpwCB!UC+T=8!e=$`t%@G?`x%oB?r+}pdS
zN9$AxH=8=bHD+9XG=~G&iw)EHt|L})(_UPoPgcW8#8GUx!w78_!lW4=9hr+>JIBze
z_r$EH=yfN`HKs2}x$mq4@EBwz<~6z2=qqB|YWQ5IhI1WO{o)R}lHDqW_2n0G@%ii<
zd&_zF)-LSJ?&kywZM<e1Aa&P^Im1<;0P@x@QeKZ|-oB<BSbG`cIaX;mc!Mbqt5c_?
z>*`C!xKc-y+0xcn)xg%LGx3(Sc7<Udi^>c4^9&VSF3bnEkNR!Uok{9bq*U{C*xfrQ
zy@PDmdb=_Sp}M$iM0CBKl<Rc_$<C930ou$D6L)>D+!9*1t_zRM#Q}yLTBv3<S&0+-
z8?=ZPZWkF4ENQ6f%duDtlPk6~GAk1ce^8bw0-QW2D)?Jwv*#wS1Sch5m4(D0v+Hv$
z0q=38&$YQMWP>&9ZxHr5*{^Ym3mDVX4K>ud%GbziV1s7tuDjTmu;DBcn{VzcJ|VJI
z&L7tEbpv-OktQNJ*I!0`!?AZuo5U#ZV9(u|Uhb#f%EFI0A~=T`CJ~PtanWKIn`Ljh
zS0N-IY4)pW9^So>sMm#J)_FaBv8&v^=Ht?Ybj*TK66NH>=IeGG58lP;Jz^>cRVdtM
z+IF0NbLLCezMg>vPHe4-gStVW`^q**VsCK1ooSz-6)UMSwqT#Qj(CA@4iu)=v@UG_
zf=o5_&|Wz01qXjsn)n8z4FWGy<E?z8=-10!uX9@aFKAG5y|#!H-BVJzAcMQVy@}(t
zTKE2)s&)lbwR8y7z_^!6zeD={q6pOsVz9JGyoJ${;ybZ{O7}3u-IpfQFkU3Cp3!Qf
zHNq}2sWf7QF*;6Rt+;C>FHY1Xw1>U814Y9wAxsS?m-k?-A@JVzv{dgD<bI~dnU;15
zB9_&b8fcCD`p`Sl4UQd-D}li%P~fnWp35UV;$}M4LAx@tEFZUZedEQM@_tgw;)_Ps
z^3E>lyX8{Y&C#LJx9{gZBfma$NyV=<UDp0kk{LMqM&nh&u~AX>1y#};n21sj3)|4*
z2ar=J@WbkF>4EDBqJ}OaA9o+VcZ>5(4frad#I(3dkp8Bco6?n*YBF~id!`-NGFYiw
zaawgG@tyh089e>@v}_8sL~{d^G)Z8|9mjB6sIGj?y<$|ud-Wa1N7azzyyQFR6F6fe
zNm5)`qOfg`OHjF)zSzQ@_bSX6+iUJK*i}yzV-{<wXn#~|>wMS6u1HP-RAna+=X#ub
z-D%k_M-eiXbK$X~#poV>{f4Al8Rj<=i}MB>%(XR;x(aKt$nvRATQiVkhb$9<ao**O
z3)Etw*90wxNEijJ)N?QmZxPusCE1_TA-{r}+H5?ZKi+jQtwQv``MP%Dey9?KN22Ju
zw}c50wMN!MoTQMHgJ;X2H#e)olGYd~wleoML4!g8$*(3qzKRM>MXCA(MpRjDy`l6n
zTqKSDSi8MPu)<evaLA#Y*NL&-`T><1^zN#>cWNApFD9aphx0zcG^#Jg_|3C6TzqZq
zk-nNc3<Wx-`@@I+n|`XiUIqs0=T|`kARqOO<rE$qpoG$mI>`N@HTpj(iSeN6OfwO3
zC-0ykm<((TlF~55!rs+tcwNXnZe`<};8&7M-M`ooX6{{0NhviIw0(ug7Xjq=O?c+S
zfPkd1%11(Toy%%90$;&+b-8r3YwyRU$}0}6_ynWv9zcsR)mVlLoAO+ylbEqG4@gVD
z<PT#dDJ3KaM1|)(U&fqPc-J(y^uB+OK$^FfanZi-l1_H3neEGa7S|Kvv<2<ShChdt
z!1T2%&OgIup-hfqkk6ZgxJ5C>pg%A|B7v?%WDwQ*yM%=oh}~2RVteLgT!mp{IpU6B
z52!4&hyk6O7QSa-<oT@1=Vl^S6)EGbLd;5x%K3u>i+2Y#3DB&LN{lk!ocjlvb;_fM
z(pZInPg|$4`fO?C1&aE74!<{@fpIqLqIES`tD9$8?XcG$($+BQ-wb>=MTyB9-jG&!
zRtI;uwjpevAnNnRxfmvsWX9`0?d8i>Z+ccoKpmLgw)3)dN77EJZ-~7tA2@fMf0eTy
z0%Aio9eBry+IC>pN83}ge&NhX-tm@r3qm~gZdVZi&fQAOEBKIzr~>f>TN?ugs6|wJ
z-WxiFo8~@4VFJKjZ#J#rxS<jIN_tau4++y8#G!kls=iL2keU12UU|8?R0|F@Fovne
zHj150Eyhkg198Br;w#IE<m(5dZML+16?}tHGRO`xGccnV4*MJ=U7kkS1jtpQQIK*5
z1m{%i1+#d}7!W|&I?YTFBo6%vpflP;!~4q-wkYz0VYUs{$)S&#wN-&@Odq@6!!D~4
zrZu=EbLKhSM$8oY<|FGg)uG{a9z!XlR-s_h9up-(W>tGRpHX|jjXWO1Ai~8wJ#zH@
z3|v?aJR%uwimsmJMh;%T=h+(_sV1*~RHr?6ZMak$Tyxb!x1~H@K@YI%#}1+}EZ-P=
z=SzUB$~Me~A?D%yx4<>kDxcwvJ7l`XfOkXOyja&Wl#&tIaND;Svz67JD^2;2+qvq(
zZjdXxG%#=1>e-+_9wT&BXmn4x{8d)3<&e>);sIZn7>e6N*C6|`sz_@bjbumh{V!B~
zpmHyJ3f}+}A5wqLtnu!=9{7Dl!)<V=N=RXraeF!Vi?a7?1MJb>Vkt}a&pf!(<X<N{
zp3_k25Wxy>9>#G6b3>3<IJ0hyZ|(9^>);p!#+7MwFs~{d39pc^z&Iiu&~rtknC_dP
zSMJBcge9Mm9bQjr`}%6i`{lH1<d*NidcL8FG9fc7M(zv8e9(5LHx-6O`okMwjHl-A
z*<(1h*|(R|r$%E2$uWbTM{15`FIs-3FX}mhX)%H0BjP;f%uosGk3JE2fxI$q=U?pu
zQp$nn%|PFB+cGBV?Jjm?aUv?$a&4He_eR;1cZGsD3$lp`BY;<6oWZ*%MWxv|O@M#X
zB$jv|*dxACD^2gn`P?w`q);8UF&l2L!0`Kw!kV$bN<vqCk(-+~QhLCwDgOLMzTl1+
zq4A|*Ewk)H>u%1om*n*KuJz^1O^nab1rnE&xd{#z$am-K9&JcQ;HUCGf>D^x```lf
YH^a_D&8eX1kNp8x<<w-0q>b+XA1cEx+W-In

literal 0
HcmV?d00001

diff --git a/config/environments/development.rb b/config/environments/development.rb
index 723278963..33b2837ff 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -32,6 +32,8 @@ Rails.application.configure do
   # Store uploaded files on the local file system (see config/storage.yml for options).
   config.active_storage.service = ENV.fetch('ACTIVE_STORAGE_SERVICE', 'local').to_sym
 
+  config.active_storage.resolve_model_to_route = :rails_storage_proxy
+
   config.active_job.queue_adapter = :sidekiq
 
   Rails.application.routes.default_url_options = { host: ENV['FRONTEND_URL'].to_s.chomp('/') }
diff --git a/docs/troubleshooting/media-audio-imagem-whatsapp.md b/docs/troubleshooting/media-audio-imagem-whatsapp.md
new file mode 100644
index 000000000..11a66c710
--- /dev/null
+++ b/docs/troubleshooting/media-audio-imagem-whatsapp.md
@@ -0,0 +1,224 @@
+# Troubleshooting: Áudio e Imagem não aparecem no Chatwoot (WhatsApp via WuzAPI)
+
+**Data:** 2026-02-28
+**Branch:** fix-media-audio-v2
+**Canal:** WhatsApp via WuzAPI
+
+---
+
+## Sintomas
+
+- Áudio exibe `00:00 / 00:00` e não toca
+- Imagem exibe "Esta imagem não está mais disponível"
+- Mensagens de texto chegam normalmente
+
+---
+
+## Diagnóstico — Root Causes
+
+Havia **três bugs independentes**, todos precisavam ser corrigidos.
+
+---
+
+### Bug 1 — URL de mídia apontando para `localhost` (invisível via ngrok)
+
+**Arquivo:** `app/models/attachment.rb`
+
+**Problema:**
+`file_url` e `thumb_url` geravam URLs hardcoded com `localhost:3000`. O browser acessando via ngrok não consegue resolver `localhost:3000` diretamente, então `<img>` e `<audio>` falhavam silenciosamente.
+
+```ruby
+# ANTES (quebrado):
+rails_storage_proxy_url(file, host: 'localhost:3000', protocol: 'http')
+
+# DEPOIS (correto):
+rails_storage_proxy_url(file, **dev_url_options)
+
+def dev_url_options
+  uri = URI.parse(ENV.fetch('FRONTEND_URL', 'http://localhost:3000').chomp('/'))
+  host = [80, 443].include?(uri.port) ? uri.host : "#{uri.host}:#{uri.port}"
+  { host: host, protocol: uri.scheme }
+end
+```
+
+**Efeito visual:**
+- Imagem → `@error` → `hasError = true` → "Esta imagem não está mais disponível"
+- Áudio → `onLoadedMetadata` nunca disparado → `duration = 0` → "00:00 / 00:00"
+
+---
+
+### Bug 2 — Arquivo de mídia salvo criptografado (sem descriptografar)
+
+**Arquivo:** `app/services/whatsapp/incoming_message_wuzapi_service.rb` + `decryption_service.rb`
+
+**Problema:**
+O fluxo de download tinha 3 métodos em cascata:
+
+| Método | O que faz | Status |
+|--------|-----------|--------|
+| Method 1 | WuzAPI `/chat/downloadimage` endpoint | ❌ Sempre falhava com `502 Bad Gateway` |
+| Method 2 | `DecryptionService` com `Net::HTTP` | ❌ `Net::HTTP` não segue redirects — CDN do WhatsApp redireciona → `nil` silencioso |
+| Method 3 | `Down.download` direto do CDN | ⚠️ Baixava mas salvava bytes **encriptados** |
+
+O WhatsApp entrega mídia encriptada (AES-256-CBC) no CDN com URLs `.enc`. O Method 3 baixava os bytes encriptados corretamente mas os salvava sem descriptografar. O arquivo no disco era inválido.
+
+Diagnóstico confirmado via `xxd`:
+```
+# JPEG começa com FF D8 FF
+# Arquivo salvo começava com:
+00000000: 3188 d20c 46ae 98f3 03bd...  ← bytes encriptados
+```
+
+**Correção:**
+Unificar Methods 2+3: usar `Down.download` (que segue redirects) para baixar os bytes, depois descriptografar em memória antes de salvar.
+
+```ruby
+# DEPOIS:
+encrypted_tempfile = Down.download(media_url, ...)
+encrypted_bytes = encrypted_tempfile.read.b
+
+if attachment_data[:media_key].present?
+  decrypted = Whatsapp::DecryptionService.new(
+    attachment_data[:media_key],
+    file_content_type(message_type)
+  ).decrypt_bytes(encrypted_bytes)
+  return decrypted if decrypted
+end
+
+StringIO.new(encrypted_bytes)  # fallback
+```
+
+---
+
+### Bug 3 — `OpenSSL::Cipher#update!` não existe em Ruby
+
+**Arquivo:** `app/services/whatsapp/decryption_service.rb`
+
+**Problema:**
+O método de descriptografia usava `decipher.update!(data)` mas Ruby só tem `decipher.update(data)` (sem `!`). Causava `NoMethodError` em todo attempt de descriptografia.
+
+```ruby
+# ANTES (quebrado):
+decipher.update!(data) + decipher.final
+
+# DEPOIS (correto):
+decipher.update(data) + decipher.final
+```
+
+---
+
+## Estado correto após os fixes
+
+### `app/models/attachment.rb`
+- `file_url` e `thumb_url` usam `dev_url_options` que lê `FRONTEND_URL` do `.env`
+- Em produção (`else`): comportamento inalterado com `url_for(file)`
+
+### `app/services/whatsapp/incoming_message_wuzapi_service.rb`
+- Method 1: WuzAPI endpoint (funciona quando disponível)
+- Method 2+3 unificados: `Down.download` → decrypt com `mediaKey` → fallback raw
+
+### `app/services/whatsapp/decryption_service.rb`
+- Constructor aceita `(media_key, media_type)` — sem URL (download separado)
+- Método principal: `decrypt_bytes(encrypted_bytes)` — recebe bytes já baixados
+- Algoritmo: HKDF SHA-256 → AES-256-CBC → fallback AES-256-CTR
+- Loga os primeiros bytes se o formato não for reconhecido (facilita debug futuro)
+
+---
+
+## Checklist de diagnóstico (quando áudio/imagem não funcionar)
+
+### 1. Verificar URLs geradas
+
+```bash
+grep "data_url" log/development.log | tail -3
+```
+
+Deve aparecer: `https://SEU-NGROK.ngrok-free.dev/rails/active_storage/...`
+❌ Se aparecer `http://localhost:3000/...` → Bug 1 voltou (checar `FRONTEND_URL` no `.env`)
+
+---
+
+### 2. Verificar se o arquivo está encriptado
+
+```bash
+# Pegar o blob key do arquivo (via Rails console ou log)
+xxd storage/XX/XX/BLOB_KEY | head -2
+```
+
+- `FF D8 FF` → JPEG válido ✅
+- `89 50 4E 47` → PNG válido ✅
+- `4F 67 67 53` (OggS) → OGG válido ✅
+- Qualquer outra coisa → encriptado ❌
+
+---
+
+### 3. Verificar logs de descriptografia
+
+```bash
+grep -E "WuzAPI Decrypt|SUCCESS|invalid format|first bytes" log/development.log | tail -10
+```
+
+- `WuzAPI Decrypt: SUCCESS - Valid media detected` ✅
+- `WuzAPI Decrypt: Decrypted but invalid format (first bytes: XX XX XX XX)` → algoritmo errado — os bytes revelam o tipo real
+- `WuzAPI Decrypt Error: NoMethodError` → bug no Ruby (checar `update` vs `update!`)
+- Nada aparece após "Attempting local decryption" → mediaKey ausente no payload do WuzAPI
+
+---
+
+### 4. Verificar se o Sidekiq está rodando e processando
+
+```bash
+ps aux | grep sidekiq | grep -v grep
+```
+
+Deve aparecer **somente uma linha** com `[N of 12 busy]` **sem** `stopping`.
+
+Se aparecer `stopping` ou dois processos:
+```bash
+pkill -f sidekiq
+rm -f .overmind.sock
+pnpm run dev
+```
+
+---
+
+### 5. Verificar se o arquivo existe no disco
+
+```bash
+# No Rails console:
+Attachment.last.file.attached?  # deve ser true
+Attachment.last.file.blob.service.exist?(Attachment.last.file.blob.key)  # deve ser true
+```
+
+`ActiveStorage::FileNotFoundError` no log = blob existe no banco mas arquivo não está no disco = o upload falhou silenciosamente.
+
+---
+
+### 6. Verificar status do WuzAPI endpoint de download
+
+```bash
+grep "WuzAPI: Endpoint download failed" log/development.log | tail -3
+```
+
+Se aparece `502 Bad Gateway` sistematicamente → WuzAPI `/chat/downloadimage` está down.
+Isso é esperado e o sistema cai automaticamente para Method 2+3 (download direto + decrypt).
+
+---
+
+## Dependências críticas
+
+| Variável | Onde | Valor esperado em dev com ngrok |
+|----------|------|---------------------------------|
+| `FRONTEND_URL` | `.env` | `https://SEU-URL.ngrok-free.dev` |
+| `ACTIVE_STORAGE_SERVICE` | `.env` | `local` |
+| `mediaKey` | Payload WuzAPI | Obrigatório para descriptografia |
+
+---
+
+## Notas de arquitetura
+
+- O WhatsApp **sempre** encripta mídia no CDN (arquivos `.enc`)
+- A chave (`mediaKey`) é entregue no payload do webhook junto com a URL
+- Sem `mediaKey` não é possível descriptografar — o arquivo vai aparecer corrompido
+- O WuzAPI endpoint `/chat/downloadimage` deveria retornar mídia já descriptografada (Method 1), mas está com instabilidade (502). O fallback via HKDF+AES é a solução robusta.
+- Em **produção** (sem ngrok), o Bug 1 não existe pois `url_for(file)` usa `default_url_options` configurado corretamente.
diff --git a/progresso/2026-02-28_fix_media_audio_imagem_whatsapp.md b/progresso/2026-02-28_fix_media_audio_imagem_whatsapp.md
new file mode 100644
index 000000000..11a66c710
--- /dev/null
+++ b/progresso/2026-02-28_fix_media_audio_imagem_whatsapp.md
@@ -0,0 +1,224 @@
+# Troubleshooting: Áudio e Imagem não aparecem no Chatwoot (WhatsApp via WuzAPI)
+
+**Data:** 2026-02-28
+**Branch:** fix-media-audio-v2
+**Canal:** WhatsApp via WuzAPI
+
+---
+
+## Sintomas
+
+- Áudio exibe `00:00 / 00:00` e não toca
+- Imagem exibe "Esta imagem não está mais disponível"
+- Mensagens de texto chegam normalmente
+
+---
+
+## Diagnóstico — Root Causes
+
+Havia **três bugs independentes**, todos precisavam ser corrigidos.
+
+---
+
+### Bug 1 — URL de mídia apontando para `localhost` (invisível via ngrok)
+
+**Arquivo:** `app/models/attachment.rb`
+
+**Problema:**
+`file_url` e `thumb_url` geravam URLs hardcoded com `localhost:3000`. O browser acessando via ngrok não consegue resolver `localhost:3000` diretamente, então `<img>` e `<audio>` falhavam silenciosamente.
+
+```ruby
+# ANTES (quebrado):
+rails_storage_proxy_url(file, host: 'localhost:3000', protocol: 'http')
+
+# DEPOIS (correto):
+rails_storage_proxy_url(file, **dev_url_options)
+
+def dev_url_options
+  uri = URI.parse(ENV.fetch('FRONTEND_URL', 'http://localhost:3000').chomp('/'))
+  host = [80, 443].include?(uri.port) ? uri.host : "#{uri.host}:#{uri.port}"
+  { host: host, protocol: uri.scheme }
+end
+```
+
+**Efeito visual:**
+- Imagem → `@error` → `hasError = true` → "Esta imagem não está mais disponível"
+- Áudio → `onLoadedMetadata` nunca disparado → `duration = 0` → "00:00 / 00:00"
+
+---
+
+### Bug 2 — Arquivo de mídia salvo criptografado (sem descriptografar)
+
+**Arquivo:** `app/services/whatsapp/incoming_message_wuzapi_service.rb` + `decryption_service.rb`
+
+**Problema:**
+O fluxo de download tinha 3 métodos em cascata:
+
+| Método | O que faz | Status |
+|--------|-----------|--------|
+| Method 1 | WuzAPI `/chat/downloadimage` endpoint | ❌ Sempre falhava com `502 Bad Gateway` |
+| Method 2 | `DecryptionService` com `Net::HTTP` | ❌ `Net::HTTP` não segue redirects — CDN do WhatsApp redireciona → `nil` silencioso |
+| Method 3 | `Down.download` direto do CDN | ⚠️ Baixava mas salvava bytes **encriptados** |
+
+O WhatsApp entrega mídia encriptada (AES-256-CBC) no CDN com URLs `.enc`. O Method 3 baixava os bytes encriptados corretamente mas os salvava sem descriptografar. O arquivo no disco era inválido.
+
+Diagnóstico confirmado via `xxd`:
+```
+# JPEG começa com FF D8 FF
+# Arquivo salvo começava com:
+00000000: 3188 d20c 46ae 98f3 03bd...  ← bytes encriptados
+```
+
+**Correção:**
+Unificar Methods 2+3: usar `Down.download` (que segue redirects) para baixar os bytes, depois descriptografar em memória antes de salvar.
+
+```ruby
+# DEPOIS:
+encrypted_tempfile = Down.download(media_url, ...)
+encrypted_bytes = encrypted_tempfile.read.b
+
+if attachment_data[:media_key].present?
+  decrypted = Whatsapp::DecryptionService.new(
+    attachment_data[:media_key],
+    file_content_type(message_type)
+  ).decrypt_bytes(encrypted_bytes)
+  return decrypted if decrypted
+end
+
+StringIO.new(encrypted_bytes)  # fallback
+```
+
+---
+
+### Bug 3 — `OpenSSL::Cipher#update!` não existe em Ruby
+
+**Arquivo:** `app/services/whatsapp/decryption_service.rb`
+
+**Problema:**
+O método de descriptografia usava `decipher.update!(data)` mas Ruby só tem `decipher.update(data)` (sem `!`). Causava `NoMethodError` em todo attempt de descriptografia.
+
+```ruby
+# ANTES (quebrado):
+decipher.update!(data) + decipher.final
+
+# DEPOIS (correto):
+decipher.update(data) + decipher.final
+```
+
+---
+
+## Estado correto após os fixes
+
+### `app/models/attachment.rb`
+- `file_url` e `thumb_url` usam `dev_url_options` que lê `FRONTEND_URL` do `.env`
+- Em produção (`else`): comportamento inalterado com `url_for(file)`
+
+### `app/services/whatsapp/incoming_message_wuzapi_service.rb`
+- Method 1: WuzAPI endpoint (funciona quando disponível)
+- Method 2+3 unificados: `Down.download` → decrypt com `mediaKey` → fallback raw
+
+### `app/services/whatsapp/decryption_service.rb`
+- Constructor aceita `(media_key, media_type)` — sem URL (download separado)
+- Método principal: `decrypt_bytes(encrypted_bytes)` — recebe bytes já baixados
+- Algoritmo: HKDF SHA-256 → AES-256-CBC → fallback AES-256-CTR
+- Loga os primeiros bytes se o formato não for reconhecido (facilita debug futuro)
+
+---
+
+## Checklist de diagnóstico (quando áudio/imagem não funcionar)
+
+### 1. Verificar URLs geradas
+
+```bash
+grep "data_url" log/development.log | tail -3
+```
+
+Deve aparecer: `https://SEU-NGROK.ngrok-free.dev/rails/active_storage/...`
+❌ Se aparecer `http://localhost:3000/...` → Bug 1 voltou (checar `FRONTEND_URL` no `.env`)
+
+---
+
+### 2. Verificar se o arquivo está encriptado
+
+```bash
+# Pegar o blob key do arquivo (via Rails console ou log)
+xxd storage/XX/XX/BLOB_KEY | head -2
+```
+
+- `FF D8 FF` → JPEG válido ✅
+- `89 50 4E 47` → PNG válido ✅
+- `4F 67 67 53` (OggS) → OGG válido ✅
+- Qualquer outra coisa → encriptado ❌
+
+---
+
+### 3. Verificar logs de descriptografia
+
+```bash
+grep -E "WuzAPI Decrypt|SUCCESS|invalid format|first bytes" log/development.log | tail -10
+```
+
+- `WuzAPI Decrypt: SUCCESS - Valid media detected` ✅
+- `WuzAPI Decrypt: Decrypted but invalid format (first bytes: XX XX XX XX)` → algoritmo errado — os bytes revelam o tipo real
+- `WuzAPI Decrypt Error: NoMethodError` → bug no Ruby (checar `update` vs `update!`)
+- Nada aparece após "Attempting local decryption" → mediaKey ausente no payload do WuzAPI
+
+---
+
+### 4. Verificar se o Sidekiq está rodando e processando
+
+```bash
+ps aux | grep sidekiq | grep -v grep
+```
+
+Deve aparecer **somente uma linha** com `[N of 12 busy]` **sem** `stopping`.
+
+Se aparecer `stopping` ou dois processos:
+```bash
+pkill -f sidekiq
+rm -f .overmind.sock
+pnpm run dev
+```
+
+---
+
+### 5. Verificar se o arquivo existe no disco
+
+```bash
+# No Rails console:
+Attachment.last.file.attached?  # deve ser true
+Attachment.last.file.blob.service.exist?(Attachment.last.file.blob.key)  # deve ser true
+```
+
+`ActiveStorage::FileNotFoundError` no log = blob existe no banco mas arquivo não está no disco = o upload falhou silenciosamente.
+
+---
+
+### 6. Verificar status do WuzAPI endpoint de download
+
+```bash
+grep "WuzAPI: Endpoint download failed" log/development.log | tail -3
+```
+
+Se aparece `502 Bad Gateway` sistematicamente → WuzAPI `/chat/downloadimage` está down.
+Isso é esperado e o sistema cai automaticamente para Method 2+3 (download direto + decrypt).
+
+---
+
+## Dependências críticas
+
+| Variável | Onde | Valor esperado em dev com ngrok |
+|----------|------|---------------------------------|
+| `FRONTEND_URL` | `.env` | `https://SEU-URL.ngrok-free.dev` |
+| `ACTIVE_STORAGE_SERVICE` | `.env` | `local` |
+| `mediaKey` | Payload WuzAPI | Obrigatório para descriptografia |
+
+---
+
+## Notas de arquitetura
+
+- O WhatsApp **sempre** encripta mídia no CDN (arquivos `.enc`)
+- A chave (`mediaKey`) é entregue no payload do webhook junto com a URL
+- Sem `mediaKey` não é possível descriptografar — o arquivo vai aparecer corrompido
+- O WuzAPI endpoint `/chat/downloadimage` deveria retornar mídia já descriptografada (Method 1), mas está com instabilidade (502). O fallback via HKDF+AES é a solução robusta.
+- Em **produção** (sem ngrok), o Bug 1 não existe pois `url_for(file)` usa `default_url_options` configurado corretamente.
diff --git a/vite.config.ts b/vite.config.ts
index e06b0f1fb..4868a1451 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -114,4 +114,12 @@ export default defineConfig({
     mockReset: true,
     clearMocks: true,
   },
+  server: {
+    proxy: {
+      '/rails': {
+        target: 'http://127.0.0.1:3000',
+        changeOrigin: true,
+      },
+    },
+  },
 });