@fased/fased 0.1.36 → 0.1.38

package/extensions/googlechat/src/api.ts

@@ -1,282 +0,0 @@
-import crypto from "node:crypto";
-import type { ResolvedGoogleChatAccount } from "./accounts.js";
-import { getGoogleChatAccessToken } from "./auth.js";
-import type { GoogleChatReaction } from "./types.js";
-
-const CHAT_API_BASE = "https://chat.googleapis.com/v1";
-const CHAT_UPLOAD_BASE = "https://chat.googleapis.com/upload/v1";
-
-const headersToObject = (headers?: HeadersInit): Record<string, string> =>
-  headers instanceof Headers
-    ? Object.fromEntries(headers.entries())
-    : Array.isArray(headers)
-      ? Object.fromEntries(headers)
-      : headers || {};
-
-async function fetchJson<T>(
-  account: ResolvedGoogleChatAccount,
-  url: string,
-  init: RequestInit,
-): Promise<T> {
-  const token = await getGoogleChatAccessToken(account);
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      ...headersToObject(init.headers),
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Google Chat API ${res.status}: ${text || res.statusText}`);
-  }
-  return (await res.json()) as T;
-}
-
-async function fetchOk(
-  account: ResolvedGoogleChatAccount,
-  url: string,
-  init: RequestInit,
-): Promise<void> {
-  const token = await getGoogleChatAccessToken(account);
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      ...headersToObject(init.headers),
-      Authorization: `Bearer ${token}`,
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Google Chat API ${res.status}: ${text || res.statusText}`);
-  }
-}
-
-async function fetchBuffer(
-  account: ResolvedGoogleChatAccount,
-  url: string,
-  init?: RequestInit,
-  options?: { maxBytes?: number },
-): Promise<{ buffer: Buffer; contentType?: string }> {
-  const token = await getGoogleChatAccessToken(account);
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      ...headersToObject(init?.headers),
-      Authorization: `Bearer ${token}`,
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Google Chat API ${res.status}: ${text || res.statusText}`);
-  }
-  const maxBytes = options?.maxBytes;
-  const lengthHeader = res.headers.get("content-length");
-  if (maxBytes && lengthHeader) {
-    const length = Number(lengthHeader);
-    if (Number.isFinite(length) && length > maxBytes) {
-      throw new Error(`Google Chat media exceeds max bytes (${maxBytes})`);
-    }
-  }
-  if (!maxBytes || !res.body) {
-    const buffer = Buffer.from(await res.arrayBuffer());
-    const contentType = res.headers.get("content-type") ?? undefined;
-    return { buffer, contentType };
-  }
-  const reader = res.body.getReader();
-  const chunks: Buffer[] = [];
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) {
-      break;
-    }
-    if (!value) {
-      continue;
-    }
-    total += value.length;
-    if (total > maxBytes) {
-      await reader.cancel();
-      throw new Error(`Google Chat media exceeds max bytes (${maxBytes})`);
-    }
-    chunks.push(Buffer.from(value));
-  }
-  const buffer = Buffer.concat(chunks, total);
-  const contentType = res.headers.get("content-type") ?? undefined;
-  return { buffer, contentType };
-}
-
-export async function sendGoogleChatMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  space: string;
-  text?: string;
-  thread?: string;
-  attachments?: Array<{ attachmentUploadToken: string; contentName?: string }>;
-}): Promise<{ messageName?: string } | null> {
-  const { account, space, text, thread, attachments } = params;
-  const body: Record<string, unknown> = {};
-  if (text) {
-    body.text = text;
-  }
-  if (thread) {
-    body.thread = { name: thread };
-  }
-  if (attachments && attachments.length > 0) {
-    body.attachment = attachments.map((item) => ({
-      attachmentDataRef: { attachmentUploadToken: item.attachmentUploadToken },
-      ...(item.contentName ? { contentName: item.contentName } : {}),
-    }));
-  }
-  const url = `${CHAT_API_BASE}/${space}/messages`;
-  const result = await fetchJson<{ name?: string }>(account, url, {
-    method: "POST",
-    body: JSON.stringify(body),
-  });
-  return result ? { messageName: result.name } : null;
-}
-
-export async function updateGoogleChatMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-  text: string;
-}): Promise<{ messageName?: string }> {
-  const { account, messageName, text } = params;
-  const url = `${CHAT_API_BASE}/${messageName}?updateMask=text`;
-  const result = await fetchJson<{ name?: string }>(account, url, {
-    method: "PATCH",
-    body: JSON.stringify({ text }),
-  });
-  return { messageName: result.name };
-}
-
-export async function deleteGoogleChatMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-}): Promise<void> {
-  const { account, messageName } = params;
-  const url = `${CHAT_API_BASE}/${messageName}`;
-  await fetchOk(account, url, { method: "DELETE" });
-}
-
-export async function uploadGoogleChatAttachment(params: {
-  account: ResolvedGoogleChatAccount;
-  space: string;
-  filename: string;
-  buffer: Buffer;
-  contentType?: string;
-}): Promise<{ attachmentUploadToken?: string }> {
-  const { account, space, filename, buffer, contentType } = params;
-  const boundary = `fased-${crypto.randomUUID()}`;
-  const metadata = JSON.stringify({ filename });
-  const header = `--${boundary}\r\nContent-Type: application/json; charset=UTF-8\r\n\r\n${metadata}\r\n`;
-  const mediaHeader = `--${boundary}\r\nContent-Type: ${contentType ?? "application/octet-stream"}\r\n\r\n`;
-  const footer = `\r\n--${boundary}--\r\n`;
-  const body = Buffer.concat([
-    Buffer.from(header, "utf8"),
-    Buffer.from(mediaHeader, "utf8"),
-    buffer,
-    Buffer.from(footer, "utf8"),
-  ]);
-
-  const token = await getGoogleChatAccessToken(account);
-  const url = `${CHAT_UPLOAD_BASE}/${space}/attachments:upload?uploadType=multipart`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": `multipart/related; boundary=${boundary}`,
-    },
-    body,
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Google Chat upload ${res.status}: ${text || res.statusText}`);
-  }
-  const payload = (await res.json()) as {
-    attachmentDataRef?: { attachmentUploadToken?: string };
-  };
-  return {
-    attachmentUploadToken: payload.attachmentDataRef?.attachmentUploadToken,
-  };
-}
-
-export async function downloadGoogleChatMedia(params: {
-  account: ResolvedGoogleChatAccount;
-  resourceName: string;
-  maxBytes?: number;
-}): Promise<{ buffer: Buffer; contentType?: string }> {
-  const { account, resourceName, maxBytes } = params;
-  const url = `${CHAT_API_BASE}/media/${resourceName}?alt=media`;
-  return await fetchBuffer(account, url, undefined, { maxBytes });
-}
-
-export async function createGoogleChatReaction(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-  emoji: string;
-}): Promise<GoogleChatReaction> {
-  const { account, messageName, emoji } = params;
-  const url = `${CHAT_API_BASE}/${messageName}/reactions`;
-  return await fetchJson<GoogleChatReaction>(account, url, {
-    method: "POST",
-    body: JSON.stringify({ emoji: { unicode: emoji } }),
-  });
-}
-
-export async function listGoogleChatReactions(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-  limit?: number;
-}): Promise<GoogleChatReaction[]> {
-  const { account, messageName, limit } = params;
-  const url = new URL(`${CHAT_API_BASE}/${messageName}/reactions`);
-  if (limit && limit > 0) {
-    url.searchParams.set("pageSize", String(limit));
-  }
-  const result = await fetchJson<{ reactions?: GoogleChatReaction[] }>(account, url.toString(), {
-    method: "GET",
-  });
-  return result.reactions ?? [];
-}
-
-export async function deleteGoogleChatReaction(params: {
-  account: ResolvedGoogleChatAccount;
-  reactionName: string;
-}): Promise<void> {
-  const { account, reactionName } = params;
-  const url = `${CHAT_API_BASE}/${reactionName}`;
-  await fetchOk(account, url, { method: "DELETE" });
-}
-
-export async function findGoogleChatDirectMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  userName: string;
-}): Promise<{ name?: string; displayName?: string } | null> {
-  const { account, userName } = params;
-  const url = new URL(`${CHAT_API_BASE}/spaces:findDirectMessage`);
-  url.searchParams.set("name", userName);
-  return await fetchJson<{ name?: string; displayName?: string }>(account, url.toString(), {
-    method: "GET",
-  });
-}
-
-export async function probeGoogleChat(account: ResolvedGoogleChatAccount): Promise<{
-  ok: boolean;
-  status?: number;
-  error?: string;
-}> {
-  try {
-    const url = new URL(`${CHAT_API_BASE}/spaces`);
-    url.searchParams.set("pageSize", "1");
-    await fetchJson<Record<string, unknown>>(account, url.toString(), {
-      method: "GET",
-    });
-    return { ok: true };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err),
-    };
-  }
-}

package/extensions/googlechat/src/auth.ts

@@ -1,137 +0,0 @@
-import { GoogleAuth, OAuth2Client } from "google-auth-library";
-import type { ResolvedGoogleChatAccount } from "./accounts.js";
-
-const CHAT_SCOPE = "https://www.googleapis.com/auth/chat.bot";
-const CHAT_ISSUER = "chat@system.gserviceaccount.com";
-// Google Workspace Add-ons use a different service account pattern
-const ADDON_ISSUER_PATTERN = /^service-\d+@gcp-sa-gsuiteaddons\.iam\.gserviceaccount\.com$/;
-const CHAT_CERTS_URL =
-  "https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com";
-
-// Size-capped to prevent unbounded growth in long-running deployments (#4948)
-const MAX_AUTH_CACHE_SIZE = 32;
-const authCache = new Map<string, { key: string; auth: GoogleAuth }>();
-const verifyClient = new OAuth2Client();
-
-let cachedCerts: { fetchedAt: number; certs: Record<string, string> } | null = null;
-
-function buildAuthKey(account: ResolvedGoogleChatAccount): string {
-  if (account.credentialsFile) {
-    return `file:${account.credentialsFile}`;
-  }
-  if (account.credentials) {
-    return `inline:${JSON.stringify(account.credentials)}`;
-  }
-  return "none";
-}
-
-function getAuthInstance(account: ResolvedGoogleChatAccount): GoogleAuth {
-  const key = buildAuthKey(account);
-  const cached = authCache.get(account.accountId);
-  if (cached && cached.key === key) {
-    return cached.auth;
-  }
-
-  const evictOldest = () => {
-    if (authCache.size > MAX_AUTH_CACHE_SIZE) {
-      const oldest = authCache.keys().next().value;
-      if (oldest !== undefined) {
-        authCache.delete(oldest);
-      }
-    }
-  };
-
-  if (account.credentialsFile) {
-    const auth = new GoogleAuth({ keyFile: account.credentialsFile, scopes: [CHAT_SCOPE] });
-    authCache.set(account.accountId, { key, auth });
-    evictOldest();
-    return auth;
-  }
-
-  if (account.credentials) {
-    const auth = new GoogleAuth({ credentials: account.credentials, scopes: [CHAT_SCOPE] });
-    authCache.set(account.accountId, { key, auth });
-    evictOldest();
-    return auth;
-  }
-
-  const auth = new GoogleAuth({ scopes: [CHAT_SCOPE] });
-  authCache.set(account.accountId, { key, auth });
-  evictOldest();
-  return auth;
-}
-
-export async function getGoogleChatAccessToken(
-  account: ResolvedGoogleChatAccount,
-): Promise<string> {
-  const auth = getAuthInstance(account);
-  const client = await auth.getClient();
-  const access = await client.getAccessToken();
-  const token = typeof access === "string" ? access : access?.token;
-  if (!token) {
-    throw new Error("Missing Google Chat access token");
-  }
-  return token;
-}
-
-async function fetchChatCerts(): Promise<Record<string, string>> {
-  const now = Date.now();
-  if (cachedCerts && now - cachedCerts.fetchedAt < 10 * 60 * 1000) {
-    return cachedCerts.certs;
-  }
-  const res = await fetch(CHAT_CERTS_URL);
-  if (!res.ok) {
-    throw new Error(`Failed to fetch Chat certs (${res.status})`);
-  }
-  const certs = (await res.json()) as Record<string, string>;
-  cachedCerts = { fetchedAt: now, certs };
-  return certs;
-}
-
-export type GoogleChatAudienceType = "app-url" | "project-number";
-
-export async function verifyGoogleChatRequest(params: {
-  bearer?: string | null;
-  audienceType?: GoogleChatAudienceType | null;
-  audience?: string | null;
-}): Promise<{ ok: boolean; reason?: string }> {
-  const bearer = params.bearer?.trim();
-  if (!bearer) {
-    return { ok: false, reason: "missing token" };
-  }
-  const audience = params.audience?.trim();
-  if (!audience) {
-    return { ok: false, reason: "missing audience" };
-  }
-  const audienceType = params.audienceType ?? null;
-
-  if (audienceType === "app-url") {
-    try {
-      const ticket = await verifyClient.verifyIdToken({
-        idToken: bearer,
-        audience,
-      });
-      const payload = ticket.getPayload();
-      const email = payload?.email ?? "";
-      const ok =
-        payload?.email_verified && (email === CHAT_ISSUER || ADDON_ISSUER_PATTERN.test(email));
-      return ok ? { ok: true } : { ok: false, reason: `invalid issuer: ${email}` };
-    } catch (err) {
-      return { ok: false, reason: err instanceof Error ? err.message : "invalid token" };
-    }
-  }
-
-  if (audienceType === "project-number") {
-    try {
-      const certs = await fetchChatCerts();
-      await verifyClient.verifySignedJwtWithCertsAsync(bearer, certs, audience, [CHAT_ISSUER]);
-      return { ok: true };
-    } catch (err) {
-      return { ok: false, reason: err instanceof Error ? err.message : "invalid token" };
-    }
-  }
-
-  return { ok: false, reason: "unsupported audience type" };
-}
-
-export const GOOGLE_CHAT_SCOPE = CHAT_SCOPE;