// CONTOH BACKEND WEBHOOK Koffi POS (Node.js / Express):
app.post(['/api/webhook/whatsapp', '/api/whatsapp/webhook'], async (req, res) => {
  const body = req.body || {};
  const sender = body.sender || body.from || body.phone || '';
  const message = (body.message || body.body || body.text || '').trim();

  const cleanPhone = normalizePhone(sender);
  const cleanMsg = message.toLowerCase().trim();

  // 1. Padankan Kata Kunci (Request OTP / Minta OTP / AHLI / OTP)
  const isOtpKeyword = cleanMsg.includes('request otp') || cleanMsg.includes('minta otp') || cleanMsg === 'otp' || cleanMsg.includes('ahli');

  if (!isOtpKeyword) {
    // KES 3: Kata kunci salah -> Panduan bersopan
    await sendWhatsApp(sender, '👋 Salam! Untuk meminta Kod PIN OTP, sila hantar mesej: 👉 *Request OTP*');
    return res.json({ status: 'guidance_sent' });
  }

  // 2. Semak Permintaan Aktif di Cache (Sah 3 Minit)
  const activeRequest = await cacheGet(`otp_request:${cleanPhone}`);

  if (activeRequest && activeRequest.otp) {
    // KES 1: Permintaan ditemui -> Hantar PIN OTP 4-Digit
    await sendWhatsApp(sender, `☕ *KOFFI KOPI*\n\n🔑 Kod PIN OTP anda: *${activeRequest.otp}*\n\n⏳ Sah 3 minit.`);
    return res.json({ status: 'sent', otp: activeRequest.otp });
  } else {
    // KES 2: Tiada permintaan aktif / Luput
    await sendWhatsApp(sender, `Salam! Nombor anda (*${cleanPhone}*) belum membuat permohonan OTP di web atau kod telah luput (sah 3 minit).`);
    return res.json({ status: 'no_request_found' });
  }
});