@celestial-community/baileys 0.0.1-security → 1.0.0

package/lib/Utils/reconnect-throttle.js

@@ -0,0 +1,157 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.PostReconnectThrottle = void 0
+
+/**
+ * @file reconnect-throttle.js
+ * @description Throttle outbound messages after WA reconnection.
+ *   Inspired by whatsapp-rust's client/sessions.rs semaphore pattern.
+ *   On reconnect, gates outbound messages to a low rate then ramps
+ *   back to normal over 60s — prevents burst-floods that trigger WA limits.
+ *
+ *   Usage:
+ *     const throttle = new PostReconnectThrottle({ enabled: true })
+ *     // On connection.update where connection === 'open':
+ *     throttle.onReconnect()
+ *     // Before sending:
+ *     const decision = throttle.beforeSend()
+ *     if (!decision.allowed) await sleep(decision.retryAfterMs)
+ *
+ *   Ported from baileys-antiban to CJS for bilis.
+ * @author Denzy ZeroDay (port), Kobus Wentzel (original)
+ */
+
+const DEFAULT_CONFIG = {
+    enabled: false,
+    rampDurationMs: 60000, // 60s total ramp
+    initialRateMultiplier: 0.1, // 10% rate initially
+    rampSteps: 6, // 6 steps: 10%→25%→50%→75%→90%→100%
+    baselineRatePerMinute: null // Optional getter from RateLimiter
+}
+
+const WINDOW_DURATION_MS = 60000
+
+class PostReconnectThrottle {
+    constructor(config = {}) {
+        this.config = {
+            ...DEFAULT_CONFIG,
+            ...config,
+            baselineRatePerMinute: config.baselineRatePerMinute || null
+        }
+        this.throttledSince = null
+        this.throttledSendCount = 0
+        this.lifetimeReconnects = 0
+        this.rampTimer = null
+        this.currentStep = 0
+        this.sendsInCurrentWindow = 0
+        this.currentWindowStart = 0
+    }
+
+    /** Call when connection is re-established. Starts throttle ramp. */
+    onReconnect() {
+        if (!this.config.enabled) return
+        this.throttledSince = Date.now()
+        this.currentStep = 0
+        this.throttledSendCount = 0
+        this.lifetimeReconnects++
+        this.sendsInCurrentWindow = 0
+        this.currentWindowStart = Date.now()
+        if (this.rampTimer) clearTimeout(this.rampTimer)
+        this._scheduleNextRampStep()
+    }
+
+    /** Call when connection drops (optional). */
+    onDisconnect() {
+        // Keep throttle state — prevents rapid reconnect/disconnect from resetting too early
+    }
+
+    /** Get current rate multiplier (1.0 = no throttle). */
+    getCurrentMultiplier() {
+        if (!this.config.enabled || !this.throttledSince) return 1.0
+        const elapsed = Date.now() - this.throttledSince
+        if (elapsed >= this.config.rampDurationMs) return 1.0
+        const progress = this.currentStep / this.config.rampSteps
+        return Math.min(
+            1.0,
+            this.config.initialRateMultiplier + (1.0 - this.config.initialRateMultiplier) * progress
+        )
+    }
+
+    /** Check if a send is allowed. Returns { allowed, reason?, retryAfterMs? } */
+    beforeSend() {
+        if (!this.config.enabled || !this.throttledSince) return { allowed: true }
+
+        const now = Date.now()
+        const multiplier = this.getCurrentMultiplier()
+
+        if (multiplier >= 1.0) {
+            this.throttledSince = null
+            return { allowed: true }
+        }
+
+        if (now - this.currentWindowStart >= WINDOW_DURATION_MS) {
+            this.sendsInCurrentWindow = 0
+            this.currentWindowStart = now
+        }
+
+        const baselineRate = this.config.baselineRatePerMinute
+            ? this.config.baselineRatePerMinute()
+            : 8
+        const allowedInWindow = Math.max(1, Math.floor(baselineRate * multiplier))
+
+        if (this.sendsInCurrentWindow >= allowedInWindow) {
+            const windowRemaining = WINDOW_DURATION_MS - (now - this.currentWindowStart)
+            return {
+                allowed: false,
+                reason: `Post-reconnect throttle: ${Math.floor(multiplier * 100)}% rate (${this.sendsInCurrentWindow}/${allowedInWindow} sends in window)`,
+                retryAfterMs: windowRemaining
+            }
+        }
+
+        this.sendsInCurrentWindow++
+        this.throttledSendCount++
+        return { allowed: true }
+    }
+
+    /** Get current stats */
+    getStats() {
+        const multiplier = this.getCurrentMultiplier()
+        const isThrottled = this.throttledSince !== null && multiplier < 1.0
+        return {
+            isThrottled,
+            currentMultiplier: multiplier,
+            throttledSinceMs: this.throttledSince,
+            remainingMs:
+                isThrottled && this.throttledSince
+                    ? Math.max(0, this.config.rampDurationMs - (Date.now() - this.throttledSince))
+                    : 0,
+            throttledSendCount: this.throttledSendCount,
+            lifetimeReconnects: this.lifetimeReconnects
+        }
+    }
+
+    /** Cleanup timers */
+    destroy() {
+        if (this.rampTimer) {
+            clearTimeout(this.rampTimer)
+            this.rampTimer = null
+        }
+        this.throttledSince = null
+    }
+
+    _scheduleNextRampStep() {
+        if (this.currentStep >= this.config.rampSteps) {
+            this.throttledSince = null
+            this.rampTimer = null
+            return
+        }
+        const stepDuration = this.config.rampDurationMs / this.config.rampSteps
+        this.rampTimer = setTimeout(() => {
+            this.currentStep++
+            this._scheduleNextRampStep()
+        }, stepDuration)
+    }
+}
+
+exports.PostReconnectThrottle = PostReconnectThrottle
+module.exports = { PostReconnectThrottle }

package/lib/Utils/reply-ratio-guard.js

@@ -0,0 +1,137 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.reply_ratio_guard = void 0
+
+/**
+ * @file reply-ratio-guard.js
+ * @description Tracks sent vs received ratio per contact. If a bot sends
+ *   too many messages without getting replies (spam-like pattern), it
+ *   triggers a cooldown and can suggest human-like auto-replies to keep
+ *   the ratio healthy. Off by default.
+ * @author Denzy ZeroDay
+ */
+
+const default_config = {
+    enabled: false,
+    min_ratio: 0.1,
+    min_messages_before_enforce: 5,
+    inbound_auto_reply_probability: 0.25,
+    auto_reply_templates: ['👍', '👌', 'ok', 'noted', 'thanks', '🙏', 'got it'],
+    cooldown_hours_on_violation: 24,
+    scope: 'individual'
+}
+
+class reply_ratio_guard {
+    constructor(config = {}) {
+        this.config = { ...default_config, ...config }
+        this.contacts = new Map()
+    }
+
+    /** Check if message can be sent to this contact based on reply ratio. Call before sending. */
+    before_send(jid) {
+        if (!this.config.enabled) return { allowed: true }
+        if (this.is_group(jid) && this.config.scope === 'individual') return { allowed: true }
+
+        const record = this.contacts.get(jid)
+        if (!record) return { allowed: true }
+
+        if (record.cooledUntil && Date.now() < record.cooledUntil) {
+            const hours_left = Math.ceil((record.cooledUntil - Date.now()) / 3600000)
+            return {
+                allowed: false,
+                reason: `Reply ratio cooldown — ${record.sent} sent, ${record.received} received. Retry in ${hours_left}h`
+            }
+        }
+
+        if (record.sent >= this.config.min_messages_before_enforce) {
+            const ratio = record.sent === 0 ? 1 : record.received / record.sent
+            if (ratio < this.config.min_ratio) {
+                record.cooledUntil = Date.now() + this.config.cooldown_hours_on_violation * 3600000
+                return {
+                    allowed: false,
+                    reason: `Reply ratio too low (${(ratio * 100).toFixed(1)}% < ${(this.config.min_ratio * 100).toFixed(1)}%). Cooldown ${this.config.cooldown_hours_on_violation}h`
+                }
+            }
+        }
+
+        return { allowed: true }
+    }
+
+    /** Record an outbound message sent to this contact */
+    record_sent(jid) {
+        if (!this.config.enabled) return
+        const record = this.contacts.get(jid) || { sent: 0, received: 0 }
+        record.sent++
+        this.contacts.set(jid, record)
+    }
+
+    /** Record an inbound message received from this contact */
+    record_received(jid) {
+        if (!this.config.enabled) return
+        const record = this.contacts.get(jid) || { sent: 0, received: 0 }
+        record.received++
+        delete record.cooledUntil
+        this.contacts.set(jid, record)
+    }
+
+    /**
+     * Suggest whether to send an auto-reply to this incoming message.
+     * Returns { should_reply: true, suggested_text: '👍' } if probability check passes.
+     * Caller is responsible for actually sending the message.
+     */
+    suggest_reply(jid, _msg_text) {
+        if (!this.config.enabled) return { should_reply: false }
+        if (this.is_group(jid) && this.config.scope === 'individual') return { should_reply: false }
+
+        if (Math.random() < this.config.inbound_auto_reply_probability) {
+            const templates = this.config.auto_reply_templates
+            const suggested_text = templates[Math.floor(Math.random() * templates.length)]
+            return { should_reply: true, suggested_text }
+        }
+        return { should_reply: false }
+    }
+
+    /** Get statistics for all contacts and global metrics */
+    get_stats() {
+        const per_contact = Array.from(this.contacts.entries()).map(([jid, record]) => ({
+            jid,
+            sent: record.sent,
+            received: record.received,
+            ratio: record.sent === 0 ? 0 : record.received / record.sent,
+            cooledUntil: record.cooledUntil
+        }))
+        const global_sent = per_contact.reduce((sum, c) => sum + c.sent, 0)
+        const global_received = per_contact.reduce((sum, c) => sum + c.received, 0)
+        const global_ratio = global_sent === 0 ? 0 : global_received / global_sent
+        const contacts_on_cooldown = per_contact.filter(
+            (c) => c.cooledUntil && Date.now() < c.cooledUntil
+        ).length
+
+        return { per_contact, global_sent, global_received, global_ratio, contacts_on_cooldown }
+    }
+
+    /** Reset all counters */
+    reset() {
+        this.contacts.clear()
+    }
+
+    /** Export state for persistence */
+    export_state() {
+        return { contacts: Array.from(this.contacts.entries()) }
+    }
+
+    /** Restore state from persistence */
+    restore_state(state) {
+        if (state?.contacts && Array.isArray(state.contacts)) {
+            this.contacts = new Map(state.contacts)
+        }
+    }
+
+    /** Check if JID is a group */
+    is_group(jid) {
+        return jid.endsWith('@g.us')
+    }
+}
+
+exports.reply_ratio_guard = reply_ratio_guard
+module.exports = { reply_ratio_guard }

package/lib/Utils/reporting-utils.js

@@ -0,0 +1,307 @@
+const { createHmac } = require('crypto')
+const { proto } = require('../../WAProto')
+const { hkdf } = require('./crypto')
+const reportingFields = [
+    { f: 1 },
+    {
+        f: 3,
+        s: [
+            { f: 2 },
+            { f: 3 },
+            { f: 8 },
+            { f: 11 },
+            { f: 17, s: [{ f: 21 }, { f: 22 }] },
+            { f: 25 }
+        ]
+    },
+    { f: 4, s: [{ f: 1 }, { f: 16 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }] },
+    { f: 5, s: [{ f: 3 }, { f: 4 }, { f: 5 }, { f: 16 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }] },
+    { f: 6, s: [{ f: 1 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }, { f: 30 }] },
+    { f: 7, s: [{ f: 2 }, { f: 7 }, { f: 10 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }, { f: 20 }] },
+    { f: 8, s: [{ f: 2 }, { f: 7 }, { f: 9 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }, { f: 21 }] },
+    {
+        f: 9,
+        s: [
+            { f: 2 },
+            { f: 6 },
+            { f: 7 },
+            { f: 13 },
+            { f: 17, s: [{ f: 21 }, { f: 22 }] },
+            { f: 20 }
+        ]
+    },
+    { f: 12, s: [{ f: 1 }, { f: 2 }, { f: 14, m: true }, { f: 15 }] },
+    { f: 18, s: [{ f: 6 }, { f: 16 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }] },
+    { f: 26, s: [{ f: 4 }, { f: 5 }, { f: 8 }, { f: 13 }, { f: 17, s: [{ f: 21 }, { f: 22 }] }] },
+    {
+        f: 28,
+        s: [{ f: 1 }, { f: 2 }, { f: 4 }, { f: 5 }, { f: 6 }, { f: 7, s: [{ f: 21 }, { f: 22 }] }]
+    },
+    { f: 37, s: [{ f: 1, m: true }] },
+    {
+        f: 49,
+        s: [
+            { f: 2 },
+            { f: 3, s: [{ f: 1 }, { f: 2 }] },
+            { f: 5, s: [{ f: 21 }, { f: 22 }] },
+            { f: 8, s: [{ f: 1 }, { f: 2 }] }
+        ]
+    },
+    { f: 53, s: [{ f: 1, m: true }] },
+    { f: 55, s: [{ f: 1, m: true }] },
+    { f: 58, s: [{ f: 1, m: true }] },
+    { f: 59, s: [{ f: 1, m: true }] },
+    {
+        f: 60,
+        s: [
+            { f: 2 },
+            { f: 3, s: [{ f: 1 }, { f: 2 }] },
+            { f: 5, s: [{ f: 21 }, { f: 22 }] },
+            { f: 8, s: [{ f: 1 }, { f: 2 }] }
+        ]
+    },
+    {
+        f: 64,
+        s: [
+            { f: 2 },
+            { f: 3, s: [{ f: 1 }, { f: 2 }] },
+            { f: 5, s: [{ f: 21 }, { f: 22 }] },
+            { f: 8, s: [{ f: 1 }, { f: 2 }] }
+        ]
+    },
+    {
+        f: 66,
+        s: [
+            { f: 2 },
+            { f: 6 },
+            { f: 7 },
+            { f: 13 },
+            { f: 17, s: [{ f: 21 }, { f: 22 }] },
+            { f: 20 }
+        ]
+    },
+    { f: 74, s: [{ f: 1, m: true }] },
+    { f: 87, s: [{ f: 1, m: true }] },
+    { f: 88, s: [{ f: 1 }, { f: 2, s: [{ f: 1 }] }, { f: 3, s: [{ f: 21 }, { f: 22 }] }] },
+    { f: 92, s: [{ f: 1, m: true }] },
+    { f: 93, s: [{ f: 1, m: true }] },
+    { f: 94, s: [{ f: 1, m: true }] }
+]
+const compileReportingFields = (fields) => {
+    const map = new Map()
+    for (const f of fields) {
+        map.set(f.f, {
+            m: f.m,
+            children: f.s ? compileReportingFields(f.s) : undefined
+        })
+    }
+    return map
+}
+const compiledReportingFields = compileReportingFields(reportingFields)
+const EMPTY_MAP = new Map()
+const ENC_SECRET_REPORT_TOKEN = 'Report Token'
+const WIRE = {
+    VARINT: 0,
+    FIXED64: 1,
+    BYTES: 2,
+    FIXED32: 5
+}
+const shouldIncludeReportingToken = (message) =>
+    !message.reactionMessage &&
+    !message.encReactionMessage &&
+    !message.encEventResponseMessage &&
+    !message.pollUpdateMessage
+const generateMsgSecretKey = (
+    modificationType,
+    origMsgId,
+    origMsgSender,
+    modificationSender,
+    origMsgSecret
+) => {
+    const useCaseSecret = Buffer.concat([
+        Buffer.from(origMsgId, 'utf8'),
+        Buffer.from(origMsgSender, 'utf8'),
+        Buffer.from(modificationSender, 'utf8'),
+        Buffer.from(modificationType, 'utf8')
+    ])
+    return hkdf(origMsgSecret, 32, { info: useCaseSecret.toString('latin1') })
+}
+const extractReportingTokenContent = (data, cfg) => {
+    const out = []
+    let i = 0
+    while (i < data.length) {
+        const tag = decodeVarint(data, i)
+        if (!tag.ok) {
+            return null
+        }
+        const fieldNum = tag.value >> 3
+        const wireType = tag.value & 0x7
+        const fieldStart = i
+        i += tag.bytes
+        const fieldCfg = cfg.get(fieldNum)
+        const pushSlice = (end) => {
+            if (end > data.length) {
+                return false
+            }
+            out.push({ num: fieldNum, bytes: data.subarray(fieldStart, end) })
+            i = end
+            return true
+        }
+        const skip = (end) => {
+            if (end > data.length) {
+                return false
+            }
+            i = end
+            return true
+        }
+        if (wireType === WIRE.VARINT) {
+            const v = decodeVarint(data, i)
+            if (!v.ok) {
+                return null
+            }
+            const end = i + v.bytes
+            if (!fieldCfg) {
+                if (!skip(end)) {
+                    return null
+                }
+                continue
+            }
+            if (!pushSlice(end)) {
+                return null
+            }
+            continue
+        }
+        if (wireType === WIRE.FIXED64) {
+            const end = i + 8
+            if (!fieldCfg) {
+                if (!skip(end)) {
+                    return null
+                }
+                continue
+            }
+            if (!pushSlice(end)) {
+                return null
+            }
+            continue
+        }
+        if (wireType === WIRE.FIXED32) {
+            const end = i + 4
+            if (!fieldCfg) {
+                if (!skip(end)) {
+                    return null
+                }
+                continue
+            }
+            if (!pushSlice(end)) {
+                return null
+            }
+            continue
+        }
+        if (wireType === WIRE.BYTES) {
+            const len = decodeVarint(data, i)
+            if (!len.ok) {
+                return null
+            }
+            const valStart = i + len.bytes
+            const valEnd = valStart + len.value
+            if (valEnd > data.length) {
+                return null
+            }
+            if (!fieldCfg) {
+                i = valEnd
+                continue
+            }
+            if (fieldCfg.m || fieldCfg.children) {
+                const sub = extractReportingTokenContent(
+                    data.subarray(valStart, valEnd),
+                    fieldCfg.children ?? EMPTY_MAP
+                )
+                if (sub === null) {
+                    return null
+                }
+                if (sub.length > 0) {
+                    const newTag = encodeVarint(tag.value)
+                    const newLen = encodeVarint(sub.length)
+                    out.push({
+                        num: fieldNum,
+                        bytes: Buffer.concat([newTag, newLen, sub])
+                    })
+                }
+                i = valEnd
+                continue
+            }
+            out.push({ num: fieldNum, bytes: data.subarray(fieldStart, valEnd) })
+            i = valEnd
+            continue
+        }
+        return null
+    }
+    if (out.length === 0) {
+        return Buffer.alloc(0)
+    }
+    out.sort((a, b) => a.num - b.num)
+    return Buffer.concat(out.map((f) => f.bytes))
+}
+const decodeVarint = (buffer, offset) => {
+    let value = 0
+    let bytes = 0
+    let shift = 0
+    while (offset + bytes < buffer.length) {
+        const current = buffer[offset + bytes]
+        value |= (current & 0x7f) << shift
+        bytes++
+        if ((current & 0x80) === 0) {
+            return { value, bytes, ok: true }
+        }
+        shift += 7
+        if (shift > 35) {
+            return { value: 0, bytes: 0, ok: false }
+        }
+    }
+    return { value: 0, bytes: 0, ok: false }
+}
+const encodeVarint = (value) => {
+    const parts = []
+    let remaining = value >>> 0
+    while (remaining > 0x7f) {
+        parts.push((remaining & 0x7f) | 0x80)
+        remaining >>>= 7
+    }
+    parts.push(remaining)
+    return Buffer.from(parts)
+}
+const getMessageReportingToken = async (msgProtobuf, message, key) => {
+    const msgSecret = message.messageContextInfo?.messageSecret
+    if (!msgSecret || !key.id) {
+        return null
+    }
+    const from = key.fromMe ? key.remoteJid : key.participant || key.remoteJid
+    const to = key.fromMe ? key.participant || key.remoteJid : key.remoteJid
+    const reportingSecret = generateMsgSecretKey(
+        ENC_SECRET_REPORT_TOKEN,
+        key.id,
+        from,
+        to,
+        msgSecret
+    )
+    const content = extractReportingTokenContent(msgProtobuf, compiledReportingFields)
+    if (!content || content.length === 0) {
+        return null
+    }
+    const reportingToken = createHmac('sha256', reportingSecret)
+        .update(content)
+        .digest()
+        .subarray(0, 16)
+    return {
+        tag: 'reporting',
+        attrs: {},
+        content: [
+            {
+                tag: 'reporting_token',
+                attrs: { v: '2' },
+                content: reportingToken
+            }
+        ]
+    }
+}
+//# sourceMappingURL=reporting-utils.js.map