@crewhaus/channel-adapter-telegram 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/channel-adapter-telegram",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Telegram channel adapter: secret_token webhook verification, message/edited_message/callback_query parsing, group + topic session keying (Section 33)",
   "main": "src/index.ts",
@@ -12,13 +12,13 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.1"
+    "@crewhaus/errors": "0.1.3"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -30,12 +30,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -59,6 +59,14 @@ describe("verifyTelegramSecret (T8)", () => {
     const h = new Headers({ "X-Telegram-Bot-Api-Secret-Token": "" });
     expect(verifyTelegramSecret({ headers: h, secretToken: SECRET })).toBe(false);
   });
+
+  test("rejects when UTF-16 length matches but UTF-8 byte length differs", () => {
+    // "é" is one UTF-16 code unit but two UTF-8 bytes; "e" is one unit / one
+    // byte. They pass the `.length` check yet must be rejected by the
+    // byte-length guard before timingSafeEqual (which throws on size mismatch).
+    const h = new Headers({ "X-Telegram-Bot-Api-Secret-Token": "é" });
+    expect(verifyTelegramSecret({ headers: h, secretToken: "e" })).toBe(false);
+  });
 });
 
 describe("createTelegramAdapter.verify()", () => {
@@ -178,6 +186,231 @@ describe("parseInbound — fixtures (T2)", () => {
     const a = adapter();
     expect(a.parseInbound(withHeaders(SECRET, "null")).kind).toBe("skip");
   });
+
+  test("non-numeric update_id → skip", () => {
+    const a = adapter();
+    const body = JSON.stringify({ update_id: "not-a-number", message: {} });
+    expect(a.parseInbound(withHeaders(SECRET, body)).kind).toBe("skip");
+  });
+
+  test("JSON array body (object, not null, but not an Update) → skip", () => {
+    const a = adapter();
+    // Arrays are typeof "object" and non-null; they lack a numeric update_id.
+    expect(a.parseInbound(withHeaders(SECRET, "[1,2,3]")).kind).toBe("skip");
+  });
+
+  test("message with chat but no `from` (userId undefined) → skip", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200001,
+      message: { message_id: 5, chat: { id: 9, type: "private" }, text: "hi" },
+    });
+    expect(a.parseInbound(withHeaders(SECRET, body)).kind).toBe("skip");
+  });
+
+  test("message text prefers `text` over `caption`", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200002,
+      message: {
+        message_id: 6,
+        from: { id: 1 },
+        chat: { id: 9, type: "private" },
+        text: "the-text",
+        caption: "the-caption",
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.event.text).toBe("the-text");
+  });
+
+  test("bot_command entity → subtype app_mention", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200003,
+      message: {
+        message_id: 7,
+        from: { id: 1 },
+        chat: { id: 9, type: "private" },
+        text: "/start",
+        entities: [{ type: "bot_command", offset: 0, length: 6 }],
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.event.subtype).toBe("app_mention");
+  });
+
+  test("entity with unrelated type (e.g. `url`) → subtype message", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200004,
+      message: {
+        message_id: 8,
+        from: { id: 1 },
+        chat: { id: 9, type: "private" },
+        text: "see https://example.com",
+        entities: [{ type: "url", offset: 4, length: 19 }],
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.event.subtype).toBe("message");
+  });
+
+  test("bot message is NOT skipped when no selfBotId is configured", () => {
+    // selfBotId-less adapter must let bot-authored messages through (the
+    // `opts.selfBotId !== undefined` short-circuit guards this branch).
+    const a = createTelegramAdapter(
+      { botToken: BOT_TOKEN, secretToken: SECRET },
+      { apiBaseUrl: "https://test.telegram.local" },
+    );
+    const body = JSON.stringify({
+      update_id: 200005,
+      message: {
+        message_id: 9,
+        from: { id: 9999, is_bot: true, username: "crewhaus_bot" },
+        chat: { id: 9, type: "private" },
+        text: "I am the bot",
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.kind).toBe("event");
+    expect(r.event.userId).toBe("9999");
+  });
+
+  test("non-self bot message is NOT skipped even with selfBotId set", () => {
+    // selfBotId is set, message is from a bot, but a *different* bot id →
+    // exercises the `String(from.id) === selfBotId` false branch.
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200006,
+      message: {
+        message_id: 10,
+        from: { id: 8888, is_bot: true, username: "other_bot" },
+        chat: { id: 9, type: "private" },
+        text: "different bot",
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.kind).toBe("event");
+    expect(r.event.userId).toBe("8888");
+  });
+
+  test("edited_message with neither text nor caption → skip", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200007,
+      edited_message: { message_id: 11, from: { id: 1 }, chat: { id: 9, type: "private" } },
+    });
+    expect(a.parseInbound(withHeaders(SECRET, body)).kind).toBe("skip");
+  });
+
+  test("edited_message in a topic → channelId chatId:topicId, threadTs set", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200008,
+      edited_message: {
+        message_id: 12,
+        from: { id: 1 },
+        chat: { id: -100123, type: "supergroup" },
+        message_thread_id: 21,
+        text: "edited in topic",
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.event.channelId).toBe("-100123:21");
+    expect(r.event.threadTs).toBe("21");
+  });
+
+  test("callback_query without `message` → skip", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200009,
+      callback_query: { id: "cq", from: { id: 7 }, data: "go" },
+    });
+    expect(a.parseInbound(withHeaders(SECRET, body)).kind).toBe("skip");
+  });
+
+  test("callback_query without `from` (userId undefined) → skip", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200010,
+      callback_query: {
+        id: "cq",
+        data: "go",
+        message: { message_id: 3, chat: { id: 9, type: "private" } },
+      },
+    });
+    expect(a.parseInbound(withHeaders(SECRET, body)).kind).toBe("skip");
+  });
+
+  test("callback_query whose message lacks `chat` → skip", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200011,
+      callback_query: { id: "cq", from: { id: 7 }, data: "go", message: { message_id: 3 } },
+    });
+    expect(a.parseInbound(withHeaders(SECRET, body)).kind).toBe("skip");
+  });
+
+  test("callback_query without `data` → text defaults to empty string", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200012,
+      callback_query: {
+        id: "cq",
+        from: { id: 7 },
+        message: { message_id: 3, chat: { id: 9, type: "private" } },
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.kind).toBe("event");
+    expect(r.event.text).toBe("");
+  });
+
+  test("callback_query in a topic → channelId chatId:topicId, threadTs set", () => {
+    const a = adapter();
+    const body = JSON.stringify({
+      update_id: 200013,
+      callback_query: {
+        id: "cq",
+        from: { id: 7 },
+        data: "approve",
+        message: {
+          message_id: 3,
+          chat: { id: -100123, type: "supergroup" },
+          message_thread_id: 42,
+        },
+      },
+    });
+    const r = a.parseInbound(withHeaders(SECRET, body)) as Extract<
+      ParsedInbound,
+      { kind: "event" }
+    >;
+    expect(r.event.channelId).toBe("-100123:42");
+    expect(r.event.threadTs).toBe("42");
+    expect(r.event.text).toBe("approve");
+  });
 });
 
 describe("sendReply / setTyping (T3)", () => {
@@ -275,4 +508,113 @@ describe("sendReply / setTyping (T3)", () => {
     expect(body.chat_id).toBe(4242);
     expect(body.action).toBe("typing");
   });
+
+  test("sendReply tolerates a 2xx response without a JSON content-type", async () => {
+    // res.ok is true but content-type is not application/json, so the
+    // ok:false body inspection is skipped and no error is thrown.
+    const f = (async () =>
+      new Response("OK", { status: 200, statusText: "OK" })) as unknown as typeof fetch;
+    const a = createTelegramAdapter(
+      { botToken: BOT_TOKEN, secretToken: SECRET },
+      { apiBaseUrl: "https://test.telegram.local", fetch: f },
+    );
+    await expect(a.sendReply({ event, text: "x" })).resolves.toBeUndefined();
+  });
+
+  test("sendReply accepts a 2xx JSON response with ok:true", async () => {
+    const f = (async () =>
+      new Response(JSON.stringify({ ok: true, result: { message_id: 1 } }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      })) as unknown as typeof fetch;
+    const a = createTelegramAdapter(
+      { botToken: BOT_TOKEN, secretToken: SECRET },
+      { apiBaseUrl: "https://test.telegram.local", fetch: f },
+    );
+    await expect(a.sendReply({ event, text: "x" })).resolves.toBeUndefined();
+  });
+
+  test("setTyping forwards message_thread_id when threadTs is set", async () => {
+    const { calls, fetch: f } = captureFetch();
+    const a = createTelegramAdapter(
+      { botToken: BOT_TOKEN, secretToken: SECRET },
+      { apiBaseUrl: "https://test.telegram.local", fetch: f },
+    );
+    await a.setTyping({ event: { ...event, threadTs: "17", channelId: "4242:17" } });
+    const body = JSON.parse(String(calls[0]?.init.body));
+    expect(body.message_thread_id).toBe(17);
+  });
+
+  test("setTyping rejects malformed workspaceId", async () => {
+    const a = adapter();
+    await expect(a.setTyping({ event: { ...event, workspaceId: "not-a-number" } })).rejects.toThrow(
+      /invalid workspaceId/,
+    );
+  });
+
+  test("setTyping ignores a non-200 response (best-effort)", async () => {
+    // setTyping never checks res.ok; a 500 must NOT reject.
+    let called = false;
+    const f = (async () => {
+      called = true;
+      return new Response("nope", { status: 500, statusText: "Server Error" });
+    }) as unknown as typeof fetch;
+    const a = createTelegramAdapter(
+      { botToken: BOT_TOKEN, secretToken: SECRET },
+      { apiBaseUrl: "https://test.telegram.local", fetch: f },
+    );
+    await expect(a.setTyping({ event })).resolves.toBeUndefined();
+    expect(called).toBe(true);
+  });
+});
+
+describe("apiBaseUrl resolution", () => {
+  const event: InboundEvent = {
+    idempotencyKey: "1",
+    workspaceId: "4242",
+    channelId: "4242",
+    userId: "4242",
+    ts: "7",
+    text: "hi",
+    subtype: "message",
+  };
+
+  function captureUrlFetch() {
+    const calls: string[] = [];
+    const f = (async (input: string | Request | URL) => {
+      calls.push(String(input));
+      return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    }) as unknown as typeof fetch;
+    return { calls, fetch: f };
+  }
+
+  test("falls back to TELEGRAM_API_BASE_URL env var when no apiBaseUrl option", async () => {
+    const prev = process.env["TELEGRAM_API_BASE_URL"];
+    process.env["TELEGRAM_API_BASE_URL"] = "https://env.telegram.local";
+    try {
+      const { calls, fetch: f } = captureUrlFetch();
+      const a = createTelegramAdapter({ botToken: BOT_TOKEN, secretToken: SECRET }, { fetch: f });
+      await a.sendReply({ event, text: "x" });
+      expect(calls[0]).toBe(`https://env.telegram.local/bot${BOT_TOKEN}/sendMessage`);
+    } finally {
+      if (prev === undefined) Reflect.deleteProperty(process.env, "TELEGRAM_API_BASE_URL");
+      else process.env["TELEGRAM_API_BASE_URL"] = prev;
+    }
+  });
+
+  test("falls back to the public Telegram API host when nothing is configured", async () => {
+    const prev = process.env["TELEGRAM_API_BASE_URL"];
+    Reflect.deleteProperty(process.env, "TELEGRAM_API_BASE_URL");
+    try {
+      const { calls, fetch: f } = captureUrlFetch();
+      const a = createTelegramAdapter({ botToken: BOT_TOKEN, secretToken: SECRET }, { fetch: f });
+      await a.sendReply({ event, text: "x" });
+      expect(calls[0]).toBe(`https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`);
+    } finally {
+      if (prev !== undefined) process.env["TELEGRAM_API_BASE_URL"] = prev;
+    }
+  });
 });