@celestial-community/baileys 0.0.1-security → 1.0.0

package/lib/Utils/timelock-guard.js

@@ -0,0 +1,162 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.timelock_guard = void 0
+
+/**
+ * @file timelock-guard.js
+ * @description Tracks WA reachout timelock (463 errors) — blocks new-contact
+ *   messages during timelock window, keeps known chats sending normally.
+ *   Auto-schedules resume based on expiry + buffer. Fixes race condition
+ *   on rapid state changes via timer generation tracking.
+ * @author Denzy ZeroDay
+ */
+
+const default_config = {
+    resume_buffer_ms: 10000
+}
+
+class timelock_guard {
+    constructor(config = {}) {
+        this.config = { ...default_config, ...config }
+        this.state = { is_active: false, error_count: 0 }
+        this.known_chats = new Set()
+        this.resume_timer = null
+        this.timer_generation = 0
+    }
+
+    /** Update timelock state from Baileys connection.update event */
+    on_timelock_update(data) {
+        const was_active = this.state.is_active
+        this.state.is_active = !!data.isActive
+        this.state.enforcement_type = data.enforcementType
+        this.state.expires_at = data.timeEnforcementEnds
+
+        if (this.state.is_active && !was_active) {
+            this.state.detected_at = new Date()
+            this.state.error_count = 0
+            this.config.onTimelockDetected?.(this.get_state())
+            this.schedule_resume()
+        } else if (this.state.is_active && was_active) {
+            this.schedule_resume()
+        }
+
+        if (!this.state.is_active && was_active) {
+            this.clear_resume_timer()
+            this.config.onTimelockLifted?.(this.get_state())
+        }
+    }
+
+    /** Record a 463 error from a failed send */
+    record_463_error() {
+        this.state.error_count++
+        if (!this.state.is_active) {
+            this.state.is_active = true
+            this.state.detected_at = new Date()
+            this.state.expires_at = new Date(Date.now() + 60000)
+            this.config.onTimelockDetected?.(this.get_state())
+            this.schedule_resume()
+        }
+    }
+
+    /** Register a JID as a known/existing chat (has tctoken / prior history) */
+    register_known_chat(jid) {
+        this.known_chats.add(jid)
+    }
+
+    /** Register multiple known chats at once (e.g. from chat list on connect) */
+    register_known_chats(jids) {
+        for (const jid of jids) this.known_chats.add(jid)
+    }
+
+    /** Check if a message to this recipient should be allowed */
+    can_send(jid) {
+        if (!this.state.is_active) return { allowed: true }
+
+        if (this.state.expires_at) {
+            const expiry_with_buffer =
+                this.state.expires_at.getTime() + this.config.resume_buffer_ms
+            if (Date.now() >= expiry_with_buffer) {
+                this.lift()
+                return { allowed: true }
+            }
+        }
+
+        if (jid.endsWith('@g.us') || jid.endsWith('@newsletter')) return { allowed: true }
+        if (this.known_chats.has(jid)) return { allowed: true }
+
+        const expires_in = this.state.expires_at
+            ? Math.max(0, this.state.expires_at.getTime() - Date.now())
+            : 60000
+
+        return {
+            allowed: false,
+            reason: `Reachout timelocked (${this.state.enforcement_type || 'unknown'}). New contacts blocked. Expires in ${Math.ceil(expires_in / 1000)}s.`
+        }
+    }
+
+    /** Get current timelock state */
+    get_state() {
+        return { ...this.state }
+    }
+
+    /** Check if currently timelocked */
+    is_timelocked() {
+        if (!this.state.is_active) return false
+        if (this.state.expires_at) {
+            const expiry_with_buffer =
+                this.state.expires_at.getTime() + this.config.resume_buffer_ms
+            if (Date.now() >= expiry_with_buffer) {
+                this.lift()
+                return false
+            }
+        }
+        return true
+    }
+
+    /** Get the set of known chat JIDs */
+    get_known_chats() {
+        return new Set(this.known_chats)
+    }
+
+    /** Manually lift the timelock */
+    lift() {
+        if (this.state.is_active) {
+            this.state.is_active = false
+            this.clear_resume_timer()
+            this.config.onTimelockLifted?.(this.get_state())
+        }
+    }
+
+    /** Reset all state */
+    reset() {
+        this.state = { is_active: false, error_count: 0 }
+        this.known_chats.clear()
+        this.clear_resume_timer()
+    }
+
+    schedule_resume() {
+        this.clear_resume_timer()
+        if (this.state.expires_at) {
+            const delay =
+                this.state.expires_at.getTime() - Date.now() + this.config.resume_buffer_ms
+            if (delay > 0) {
+                this.timer_generation++
+                const current_generation = this.timer_generation
+                this.resume_timer = setTimeout(() => {
+                    if (current_generation === this.timer_generation) this.lift()
+                }, delay)
+            }
+        }
+    }
+
+    clear_resume_timer() {
+        if (this.resume_timer) {
+            clearTimeout(this.resume_timer)
+            this.resume_timer = null
+            this.timer_generation++
+        }
+    }
+}
+
+exports.timelock_guard = timelock_guard
+module.exports = { timelock_guard }

package/lib/Utils/use-mongo-file-auth-state.d.ts

@@ -0,0 +1,6 @@
+import { AuthenticationState } from '../Types'
+
+export declare const useMongoFileAuthState: (collection: string) => Promise<{
+    state: AuthenticationState
+    saveCreds: () => Promise<void>
+}>

package/lib/Utils/use-mongo-file-auth-state.js

@@ -0,0 +1,81 @@
+'use strict'
+
+Object.defineProperty(exports, '__esModule', { value: true })
+
+const WAProto_1 = require('../../WAProto')
+const auth_utils_1 = require('./auth-utils')
+const generics_1 = require('./generics')
+
+/*
+code from amiruldev readjusted by @irull2nd, don't delete WM!
+*/
+const useMongoFileAuthState = async (collection) => {
+    const writeData = (data, id) => {
+        const informationToStore = JSON.parse(JSON.stringify(data, generics_1.BufferJSON.replacer))
+        const update = {
+            $set: {
+                ...informationToStore
+            }
+        }
+
+        return collection.updateOne({ _id: id }, update, { upsert: true })
+    }
+
+    const readData = async (id) => {
+        try {
+            const data = JSON.stringify(await collection.findOne({ _id: id }))
+            return JSON.parse(data, generics_1.BufferJSON.reviver)
+        } catch (err) {
+            console.log(err)
+        }
+    }
+
+    const removeData = async (id) => {
+        try {
+            await collection.deleteOne({ _id: id })
+        } catch (err) {
+            console.log('error', err)
+        }
+    }
+
+    const creds = (await readData('creds')) || auth_utils_1.initAuthCreds()
+
+    return {
+        state: {
+            creds,
+            keys: {
+                get: async (type, ids) => {
+                    const data = {}
+                    await Promise.all(
+                        ids.map(async (id) => {
+                            let value = await readData(`${type}-${id}`)
+                            if (type === 'app-state-sync-key') {
+                                value = WAProto_1.proto.Message.AppStateSyncKeyData.fromObject(data)
+                            }
+                            data[id] = value
+                        })
+                    )
+                    return data
+                },
+                set: async (data) => {
+                    const tasks = []
+                    for (const category of Object.keys(data)) {
+                        for (const id of Object.keys(data[category])) {
+                            const value = data[category][id]
+                            const key = `${category}-${id}`
+                            tasks.push(value ? writeData(value, key) : removeData(key))
+                        }
+                    }
+                    await Promise.all(tasks)
+                }
+            }
+        },
+        saveCreds: () => {
+            return writeData(creds, 'creds')
+        }
+    }
+}
+
+module.exports = {
+    useMongoFileAuthState
+}

package/lib/Utils/use-multi-file-auth-state.js

@@ -0,0 +1,125 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.useMultiFileAuthState = void 0
+const async_mutex_1 = require('async-mutex')
+const promises_1 = require('fs/promises')
+const path_1 = require('path')
+const WAProto_1 = require('../../WAProto')
+const auth_utils_1 = require('./auth-utils')
+const generics_1 = require('./generics')
+const fileLocks = new Map()
+const getFileLock = (path) => {
+    let mutex = fileLocks.get(path)
+    if (!mutex) {
+        mutex = new async_mutex_1.Mutex()
+        fileLocks.set(path, mutex)
+    }
+    return mutex
+}
+/**
+ * stores the full authentication state in a single folder.
+ * Far more efficient than singlefileauthstate
+ *
+ * Again, I wouldn't endorse this for any production level use other than perhaps a bot.
+ * Would recommend writing an auth state for use with a proper SQL or No-SQL DB
+ * */
+const useMultiFileAuthState = async (folder) => {
+    const writeData = async (data, file) => {
+        const filePath = (0, path_1.join)(folder, fixFileName(file))
+        const mutex = getFileLock(filePath)
+        return mutex.acquire().then(async (release) => {
+            try {
+                await (0, promises_1.writeFile)(
+                    filePath,
+                    JSON.stringify(data, generics_1.BufferJSON.replacer)
+                )
+            } finally {
+                release()
+            }
+        })
+    }
+    const readData = async (file) => {
+        try {
+            const filePath = (0, path_1.join)(folder, fixFileName(file))
+            const mutex = getFileLock(filePath)
+            return await mutex.acquire().then(async (release) => {
+                try {
+                    const data = await (0, promises_1.readFile)(filePath, { encoding: 'utf-8' })
+                    return JSON.parse(data, generics_1.BufferJSON.reviver)
+                } finally {
+                    release()
+                }
+            })
+        } catch (error) {
+            return null
+        }
+    }
+    const removeData = async (file) => {
+        try {
+            const filePath = (0, path_1.join)(folder, fixFileName(file))
+            const mutex = getFileLock(filePath)
+            return mutex.acquire().then(async (release) => {
+                try {
+                    await (0, promises_1.unlink)(filePath)
+                } catch (_a) {
+                } finally {
+                    release()
+                }
+            })
+        } catch (_a) {}
+    }
+    const folderInfo = await (0, promises_1.stat)(folder).catch(() => {})
+    if (folderInfo) {
+        if (!folderInfo.isDirectory()) {
+            throw new Error(
+                `found something that is not a directory at ${folder}, either delete it or specify a different location`
+            )
+        }
+    } else {
+        await (0, promises_1.mkdir)(folder, { recursive: true })
+    }
+    const fixFileName = (file) => {
+        var _a
+        return (_a = file === null || file === void 0 ? void 0 : file.replace(/\//g, '__')) ===
+            null || _a === void 0
+            ? void 0
+            : _a.replace(/:/g, '-')
+    }
+    const creds = (await readData('creds.json')) || (0, auth_utils_1.initAuthCreds)()
+    return {
+        state: {
+            creds,
+            keys: {
+                get: async (type, ids) => {
+                    const data = {}
+                    await Promise.all(
+                        ids.map(async (id) => {
+                            let value = await readData(`${type}-${id}.json`)
+                            if (type === 'app-state-sync-key' && value) {
+                                value =
+                                    WAProto_1.proto.Message.AppStateSyncKeyData.fromObject(value)
+                            }
+                            data[id] = value
+                        })
+                    )
+                    return data
+                },
+                set: async (data) => {
+                    const tasks = []
+                    for (const category in data) {
+                        for (const id in data[category]) {
+                            const value = data[category][id]
+                            const file = `${category}-${id}.json`
+                            tasks.push(value ? writeData(value, file) : removeData(file))
+                        }
+                    }
+                    await Promise.all(tasks)
+                }
+            }
+        },
+        saveCreds: async () => {
+            return writeData(creds, 'creds.json')
+        }
+    }
+}
+exports.useMultiFileAuthState = useMultiFileAuthState

package/lib/Utils/use-single-file-auth-state.d.ts

@@ -0,0 +1,13 @@
+import { ILogger } from './logger'
+import type { AuthenticationState } from '../Types'
+
+/**
+ * @deprecated use multi file auth state instead please
+ * stores the full authentication state in a single JSON file
+ *
+ * DO NOT USE IN A PROD ENVIRONMENT, only meant to serve as an example
+ * */
+export declare const useSingleFileAuthState: (filename: string, logger?: ILogger) => {
+    state: AuthenticationState
+    saveState: () => void
+}

package/lib/Utils/use-single-file-auth-state.js

@@ -0,0 +1,86 @@
+'use strict'
+
+Object.defineProperty(exports, '__esModule', { value: true })
+
+const WAProto_1 = require('../../WAProto')
+const auth_utils_1 = require('./auth-utils')
+const generics_1 = require('./generics')
+
+// useless key map only there to maintain backwards compatibility
+// do not use in your own systems please
+const KEY_MAP = {
+    'pre-key': 'preKeys',
+    session: 'sessions',
+    'sender-key': 'senderKeys',
+    'app-state-sync-key': 'appStateSyncKeys',
+    'app-state-sync-version': 'appStateVersions',
+    'sender-key-memory': 'senderKeyMemory',
+    'lid-mapping': 'lidMappings'
+}
+
+/**
+ * @deprecated use multi file auth state instead please
+ * stores the full authentication state in a single JSON file
+ *
+ * DO NOT USE IN A PROD ENVIRONMENT, only meant to serve as an example
+ * */
+const useSingleFileAuthState = (filename, logger) => {
+    // require fs here so that in case "fs" is not available -- the app does not crash
+    const { readFileSync, writeFileSync, existsSync } = require('fs')
+    let creds
+    let keys = {}
+    // save the authentication state to a file
+    const saveState = () => {
+        logger && logger.trace('saving auth state')
+        writeFileSync(
+            filename,
+            // BufferJSON replacer utility saves buffers nicely
+            JSON.stringify({ creds, keys }, generics_1.BufferJSON.replacer, 2)
+        )
+    }
+    if (existsSync(filename)) {
+        const result = JSON.parse(
+            readFileSync(filename, { encoding: 'utf-8' }),
+            generics_1.BufferJSON.reviver
+        )
+        creds = result.creds
+        keys = result.keys
+    } else {
+        creds = auth_utils_1.initAuthCreds()
+        keys = {}
+    }
+    return {
+        state: {
+            creds,
+            keys: {
+                get: (type, ids) => {
+                    const key = KEY_MAP[type]
+                    return ids.reduce((dict, id) => {
+                        let value = keys[key]?.[id]
+                        if (value) {
+                            if (type === 'app-state-sync-key') {
+                                value =
+                                    WAProto_1.proto.Message.AppStateSyncKeyData.fromObject(value)
+                            }
+                            dict[id] = value
+                        }
+                        return dict
+                    }, {})
+                },
+                set: (data) => {
+                    for (const _key in data) {
+                        const key = KEY_MAP[_key]
+                        keys[key] = keys[key] || {}
+                        Object.assign(keys[key], data[_key])
+                    }
+                    saveState()
+                }
+            }
+        },
+        saveState
+    }
+}
+
+module.exports = {
+    useSingleFileAuthState
+}

package/lib/Utils/use-sqlite-auth-state.js

@@ -0,0 +1,187 @@
+"use strict"
+Object.defineProperty(exports, "__esModule", { value: true })
+exports.use_sqlite_auth_state = void 0
+
+/**
+ * @file use-sqlite-auth-state.js
+ * @description Auth state persisted in a local SQLite database (using
+ *   Node's built-in `node:sqlite` — no external DB driver needed).
+ *   Much faster and more robust than one-file-per-key JSON storage for
+ *   bots with heavy session key churn. Requires Node.js 22.5+.
+ *   Can auto-migrate an existing folder-based (useMultiFileAuthState)
+ *   session into the new SQLite db on first run.
+ * @author Denzy ZeroDay
+ */
+
+const { mkdir, readdir, readFile } = require('fs/promises')
+const { dirname, join } = require('path')
+const { proto } = require('../../WAProto')
+const { initAuthCreds } = require('./auth-utils')
+
+/**
+ * @param {string} path_or_folder - full .db/.sqlite path, or a folder (fileName is appended)
+ * @param {object} options
+ * @param {string} options.fileName - db file name when path_or_folder is a folder (default 'auth.db')
+ * @param {string} options.migrateFromFolder - optional legacy useMultiFileAuthState folder to import from on first run
+ * @param {object} options.logger - optional logger with .warn/.info
+ * @returns {Promise<{ state, saveCreds, db, close }>}
+ */
+const use_sqlite_auth_state = async (path_or_folder, options = {}) => {
+    const { fileName = 'auth.db', migrateFromFolder: migrate_from_folder, logger } = options
+    const db_path = /\.(db|sqlite|sqlite3)$/i.test(path_or_folder) ? path_or_folder : join(path_or_folder, fileName)
+
+    const buf_replacer = (_, value) => {
+        if (Buffer.isBuffer(value) || value instanceof Uint8Array || value?.type === 'Buffer') {
+            return { type: 'Buffer', data: Buffer.from(value?.data || value).toString('base64') }
+        }
+        return value
+    }
+
+    const buf_reviver = (_, value) => {
+        if (value && typeof value === 'object' && value.type === 'Buffer' && typeof value.data === 'string') {
+            return Buffer.from(value.data, 'base64')
+        }
+        return value
+    }
+
+    const encode = (value) => {
+        if (Buffer.isBuffer(value) || value instanceof Uint8Array) {
+            return Buffer.concat([Buffer.from([1]), Buffer.from(value)])
+        }
+        return Buffer.concat([Buffer.from([0]), Buffer.from(JSON.stringify(value, buf_replacer), 'utf8')])
+    }
+
+    const decode = (blob) => {
+        if (!blob || blob.length === 0) return null
+        if (blob[0] === 1) return Buffer.from(blob.subarray(1))
+        return JSON.parse(Buffer.from(blob.subarray(1)).toString('utf8'), buf_reviver)
+    }
+
+    const fix_name = (s) => s?.replace(/\//g, '__')?.replace(/:/g, '-')
+    const key_of = (category, id) => fix_name(`${category}-${id}`)
+
+    let DatabaseSync
+    try {
+        ;({ DatabaseSync } = await import('node:sqlite'))
+    } catch (err) {
+        throw new Error("use_sqlite_auth_state needs the built-in 'node:sqlite' module (Node 22.5+). Upgrade Node, or use useMultiFileAuthState instead.")
+    }
+
+    await mkdir(dirname(db_path), { recursive: true }).catch(() => {})
+
+    const db = new DatabaseSync(db_path)
+    db.exec('PRAGMA journal_mode = TRUNCATE')
+    db.exec('PRAGMA synchronous = NORMAL')
+    db.exec('PRAGMA busy_timeout = 5000')
+    db.exec('CREATE TABLE IF NOT EXISTS auth_state (k TEXT PRIMARY KEY, v BLOB NOT NULL) WITHOUT ROWID')
+
+    const q_get = db.prepare('SELECT v FROM auth_state WHERE k = ?')
+    const q_upsert = db.prepare('INSERT INTO auth_state(k,v) VALUES(?,?) ON CONFLICT(k) DO UPDATE SET v=excluded.v')
+    const q_delete = db.prepare('DELETE FROM auth_state WHERE k = ?')
+
+    const run_tx = (fn) => {
+        db.exec('BEGIN')
+        try {
+            const r = fn()
+            db.exec('COMMIT')
+            return r
+        } catch (err) {
+            db.exec('ROLLBACK')
+            throw err
+        }
+    }
+
+    const read_raw = (k) => {
+        const row = q_get.get(k)
+        if (!row) return null
+        try {
+            return decode(row.v)
+        } catch (err) {
+            logger?.warn?.({ k, err: err?.message }, 'sqlite-auth: failed to decode row, treating as missing')
+            return null
+        }
+    }
+
+    const run_migration = async (folder) => {
+        let files
+        try {
+            files = await readdir(folder)
+        } catch {
+            return 0
+        }
+        const rows = []
+        for (const file of files) {
+            if (!file.endsWith('.json')) continue
+            let value
+            try {
+                value = JSON.parse(await readFile(join(folder, file), 'utf8'), buf_reviver)
+            } catch {
+                continue
+            }
+            if (value === null || value === undefined) continue
+            rows.push([file.slice(0, -'.json'.length), encode(value)])
+        }
+        run_tx(() => {
+            for (const [k, v] of rows) q_upsert.run(k, v)
+        })
+        return rows.length
+    }
+
+    const has_creds = () => !!q_get.get('creds')
+
+    if (migrate_from_folder && !has_creds()) {
+        const n = await run_migration(migrate_from_folder)
+        if (n > 0) logger?.info?.({ count: n, from: migrate_from_folder }, 'sqlite-auth: migrated legacy auth state')
+    }
+
+    let creds = read_raw('creds')
+    if (!creds) {
+        creds = initAuthCreds()
+        q_upsert.run('creds', encode(creds))
+    }
+
+    const keys = {
+        get: async (type, ids) => {
+            const data = {}
+            for (const id of ids) {
+                let value = read_raw(key_of(type, id))
+                if (type === 'app-state-sync-key' && value) {
+                    value = proto.Message.AppStateSyncKeyData.fromObject(value)
+                }
+                if (value !== null && value !== undefined) {
+                    data[id] = value
+                }
+            }
+            return data
+        },
+        set: async (data) => {
+            const ops = []
+            for (const category in data) {
+                for (const id in data[category]) {
+                    ops.push([key_of(category, id), data[category][id]])
+                }
+            }
+            run_tx(() => {
+                for (const [k, value] of ops) {
+                    if (value === null || value === undefined) q_delete.run(k)
+                    else q_upsert.run(k, encode(value))
+                }
+            })
+        },
+        clear: async () => {
+            db.prepare("DELETE FROM auth_state WHERE k <> 'creds'").run()
+        }
+    }
+
+    return {
+        state: { creds, keys },
+        saveCreds: async () => {
+            q_upsert.run('creds', encode(creds))
+        },
+        db,
+        close: () => db.close()
+    }
+}
+
+exports.use_sqlite_auth_state = use_sqlite_auth_state
+module.exports = { use_sqlite_auth_state }