@gakr-gakr/discord 0.1.0

package/src/monitor/dm-command-auth.ts

@@ -0,0 +1,259 @@
+import {
+  type AccessGroupMembershipFact,
+  type ChannelIngressEventInput,
+  type ChannelIngressIdentifierKind,
+  createChannelIngressResolver,
+  defineStableChannelIngressIdentity,
+  type ChannelIngressIdentitySubjectInput,
+  type ResolveChannelMessageIngressParams,
+} from "autobot/plugin-sdk/channel-ingress-runtime";
+import type { AutoBotConfig } from "autobot/plugin-sdk/config-contracts";
+import { logVerbose } from "autobot/plugin-sdk/runtime-env";
+import type { RequestClient } from "../internal/discord.js";
+import { canViewDiscordGuildChannel } from "../send.permissions.js";
+import { normalizeDiscordAllowList } from "./allow-list.js";
+
+const DISCORD_ALLOW_LIST_PREFIXES = ["discord:", "user:", "pk:"];
+const DISCORD_CHANNEL_ID = "discord";
+const DISCORD_USER_ID_KIND = "stable-id" satisfies ChannelIngressIdentifierKind;
+const DISCORD_USER_NAME_KIND = "username" satisfies ChannelIngressIdentifierKind;
+
+export type DiscordDmPolicy = "open" | "pairing" | "allowlist" | "disabled";
+
+function normalizeDiscordIdEntry(entry: string): string | null {
+  const text = entry.trim();
+  if (!text) {
+    return null;
+  }
+  const maybeId = text.replace(/^<@!?/, "").replace(/>$/, "");
+  if (/^\d+$/.test(maybeId)) {
+    return maybeId;
+  }
+  const prefix = DISCORD_ALLOW_LIST_PREFIXES.find((entryPrefix) => text.startsWith(entryPrefix));
+  if (prefix) {
+    const candidate = text.slice(prefix.length).trim();
+    return candidate || null;
+  }
+  return null;
+}
+
+function normalizeDiscordNameEntry(entry: string): string | null {
+  const text = entry.trim();
+  if (!text || text === "*" || normalizeDiscordIdEntry(text)) {
+    return null;
+  }
+  const nameSlug = normalizeDiscordAllowList([text], DISCORD_ALLOW_LIST_PREFIXES)
+    ?.names.values()
+    .next().value;
+  return typeof nameSlug === "string" && nameSlug ? nameSlug : null;
+}
+
+function normalizeDiscordNameSubject(value: string): string | null {
+  const nameSlug = normalizeDiscordAllowList([value], DISCORD_ALLOW_LIST_PREFIXES)
+    ?.names.values()
+    .next().value;
+  return typeof nameSlug === "string" && nameSlug ? nameSlug : null;
+}
+
+const discordIngressIdentity = defineStableChannelIngressIdentity({
+  key: "discordUserId",
+  kind: DISCORD_USER_ID_KIND,
+  normalizeEntry: normalizeDiscordIdEntry,
+  normalizeSubject: (value) => value.trim() || null,
+  sensitivity: "pii",
+  aliases: (
+    [
+      ["discordUserName", normalizeDiscordNameEntry],
+      ["discordUserTag", () => null],
+    ] as const
+  ).map(([key, normalizeEntry]) => ({
+    key,
+    kind: DISCORD_USER_NAME_KIND,
+    normalizeEntry,
+    normalizeSubject: normalizeDiscordNameSubject,
+    dangerous: true,
+    sensitivity: "pii",
+  })),
+});
+
+function createDiscordDmIngressSubject(sender: {
+  id: string;
+  name?: string;
+  tag?: string;
+}): ChannelIngressIdentitySubjectInput {
+  return {
+    stableId: sender.id,
+    aliases: {
+      discordUserName: sender.name,
+      discordUserTag: sender.tag,
+    },
+  };
+}
+
+function createDiscordDynamicAccessGroupResolver(params: {
+  cfg?: AutoBotConfig;
+  token?: string;
+  rest?: RequestClient;
+}): ResolveChannelMessageIngressParams["resolveAccessGroupMembership"] {
+  if (!params.cfg) {
+    return undefined;
+  }
+  const cfg = params.cfg;
+  return async ({ name, group, accountId, subject }) => {
+    if (group.type !== "discord.channelAudience") {
+      return false;
+    }
+    const senderId = String(subject.stableId ?? "").trim();
+    if (!senderId) {
+      return false;
+    }
+    const membership = group.membership ?? "canViewChannel";
+    if (membership !== "canViewChannel") {
+      return false;
+    }
+    try {
+      return await canViewDiscordGuildChannel(group.guildId, group.channelId, senderId, {
+        cfg,
+        accountId,
+        token: params.token,
+        rest: params.rest,
+      });
+    } catch (err) {
+      logVerbose(`discord: accessGroup:${name} lookup failed for user ${senderId}: ${String(err)}`);
+      throw err;
+    }
+  };
+}
+
+function createDiscordIngressResolver(params: {
+  accountId: string;
+  cfg?: AutoBotConfig;
+  token?: string;
+  rest?: RequestClient;
+  readStoreAllowFrom?: ResolveChannelMessageIngressParams["readStoreAllowFrom"];
+  useDefaultPairingStore?: boolean;
+}) {
+  return createChannelIngressResolver({
+    channelId: DISCORD_CHANNEL_ID,
+    accountId: params.accountId,
+    identity: discordIngressIdentity,
+    cfg: params.cfg,
+    resolveAccessGroupMembership: createDiscordDynamicAccessGroupResolver({
+      cfg: params.cfg,
+      token: params.token,
+      rest: params.rest,
+    }),
+    ...(params.readStoreAllowFrom ? { readStoreAllowFrom: params.readStoreAllowFrom } : {}),
+    ...(params.useDefaultPairingStore !== undefined
+      ? { useDefaultPairingStore: params.useDefaultPairingStore }
+      : {}),
+  });
+}
+
+function syntheticAccessGroupMembership(
+  groupName: string,
+  allowed: boolean,
+): AccessGroupMembershipFact {
+  return allowed
+    ? {
+        kind: "matched",
+        groupName,
+        source: "dynamic",
+        matchedEntryIds: [groupName],
+      }
+    : {
+        kind: "not-matched",
+        groupName,
+        source: "dynamic",
+      };
+}
+
+export async function resolveDiscordDmCommandAccess(params: {
+  accountId: string;
+  dmPolicy: DiscordDmPolicy;
+  configuredAllowFrom: string[];
+  sender: { id: string; name?: string; tag?: string };
+  allowNameMatching: boolean;
+  cfg?: AutoBotConfig;
+  token?: string;
+  rest?: RequestClient;
+  readStoreAllowFrom?: ResolveChannelMessageIngressParams["readStoreAllowFrom"];
+  eventKind?: ChannelIngressEventInput["kind"];
+}) {
+  return await createDiscordIngressResolver({
+    accountId: params.accountId,
+    cfg: params.cfg,
+    token: params.token,
+    rest: params.rest,
+    readStoreAllowFrom: params.readStoreAllowFrom,
+    useDefaultPairingStore: params.readStoreAllowFrom == null,
+  }).message({
+    subject: createDiscordDmIngressSubject(params.sender),
+    conversation: {
+      kind: "direct",
+      id: params.sender.id,
+    },
+    event: {
+      kind: params.eventKind ?? "native-command",
+      authMode: "inbound",
+      mayPair: true,
+    },
+    dmPolicy: params.dmPolicy,
+    groupPolicy: "disabled",
+    policy: {
+      mutableIdentifierMatching: params.allowNameMatching ? "enabled" : "disabled",
+    },
+    allowFrom: params.configuredAllowFrom,
+    command: {
+      hasControlCommand: false,
+      modeWhenAccessGroupsOff: "configured",
+    },
+  });
+}
+
+export async function resolveDiscordTextCommandAccess(params: {
+  accountId: string;
+  sender: { id: string; name?: string; tag?: string };
+  ownerAllowFrom?: string[];
+  memberAccessConfigured: boolean;
+  memberAllowed: boolean;
+  allowNameMatching: boolean;
+  allowTextCommands: boolean;
+  hasControlCommand: boolean;
+  cfg?: AutoBotConfig;
+  token?: string;
+  rest?: RequestClient;
+}) {
+  const ownerAllowFrom = (params.ownerAllowFrom ?? []).filter((entry) => entry.trim() !== "*");
+  const memberAccessGroup = "discord-member-access";
+  const commandGroup = params.memberAccessConfigured ? [`accessGroup:${memberAccessGroup}`] : [];
+  const accessGroupMembership = params.memberAccessConfigured
+    ? [syntheticAccessGroupMembership(memberAccessGroup, params.memberAllowed)]
+    : [];
+  const result = await createDiscordIngressResolver({
+    accountId: params.accountId,
+    cfg: params.cfg,
+    token: params.token,
+    rest: params.rest,
+  }).command({
+    subject: createDiscordDmIngressSubject(params.sender),
+    conversation: {
+      kind: "group",
+      id: "discord-command",
+    },
+    accessGroupMembership,
+    dmPolicy: "allowlist",
+    groupPolicy: "allowlist",
+    policy: {
+      mutableIdentifierMatching: params.allowNameMatching ? "enabled" : "disabled",
+    },
+    allowFrom: ownerAllowFrom,
+    groupAllowFrom: commandGroup,
+    command: {
+      allowTextCommands: params.allowTextCommands,
+      hasControlCommand: params.hasControlCommand,
+      modeWhenAccessGroupsOff: "configured",
+    },
+  });
+  return result.commandAccess;
+}

package/src/monitor/dm-command-decision.ts

@@ -0,0 +1,49 @@
+import type { ResolvedChannelMessageIngress } from "autobot/plugin-sdk/channel-ingress-runtime";
+import { createChannelPairingChallengeIssuer } from "autobot/plugin-sdk/channel-pairing";
+import { upsertChannelPairingRequest } from "autobot/plugin-sdk/conversation-runtime";
+
+export async function handleDiscordDmCommandDecision(params: {
+  senderAccess: Pick<ResolvedChannelMessageIngress["senderAccess"], "decision">;
+  accountId: string;
+  sender: {
+    id: string;
+    tag?: string;
+    name?: string;
+  };
+  onPairingCreated: (code: string) => Promise<void>;
+  onUnauthorized: () => Promise<void>;
+  upsertPairingRequest?: typeof upsertChannelPairingRequest;
+}): Promise<boolean> {
+  if (params.senderAccess.decision === "allow") {
+    return true;
+  }
+
+  if (params.senderAccess.decision === "pairing") {
+    const upsertPairingRequest = params.upsertPairingRequest ?? upsertChannelPairingRequest;
+    const result = await createChannelPairingChallengeIssuer({
+      channel: "discord",
+      upsertPairingRequest: async ({ id, meta }) =>
+        await upsertPairingRequest({
+          channel: "discord",
+          id,
+          accountId: params.accountId,
+          meta,
+        }),
+    })({
+      senderId: params.sender.id,
+      senderIdLine: `Your Discord user id: ${params.sender.id}`,
+      meta: {
+        tag: params.sender.tag,
+        name: params.sender.name,
+      },
+      sendPairingReply: async () => {},
+    });
+    if (result.created && result.code) {
+      await params.onPairingCreated(result.code);
+    }
+    return false;
+  }
+
+  await params.onUnauthorized();
+  return false;
+}

package/src/monitor/exec-approvals.ts

@@ -0,0 +1,161 @@
+import { ButtonStyle } from "discord-api-types/v10";
+import { resolveApprovalOverGateway } from "autobot/plugin-sdk/approval-gateway-runtime";
+import type { ExecApprovalDecision } from "autobot/plugin-sdk/approval-runtime";
+import type {
+  DiscordExecApprovalConfig,
+  AutoBotConfig,
+} from "autobot/plugin-sdk/config-contracts";
+import { Button, type ButtonInteraction, type ComponentData } from "../internal/discord.js";
+export { buildExecApprovalCustomId } from "../approval-handler.runtime.js";
+import { getDiscordExecApprovalApprovers } from "../exec-approvals.js";
+
+export { extractDiscordChannelId } from "../approval-native.js";
+function decodeCustomIdValue(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+export function parseExecApprovalData(
+  data: ComponentData,
+): { approvalId: string; action: ExecApprovalDecision } | null {
+  if (!data || typeof data !== "object") {
+    return null;
+  }
+  const coerce = (value: unknown) =>
+    typeof value === "string" || typeof value === "number" ? String(value) : "";
+  const rawId = coerce(data.id);
+  const rawAction = coerce(data.action);
+  if (!rawId || !rawAction) {
+    return null;
+  }
+  const action = rawAction as ExecApprovalDecision;
+  if (action !== "allow-once" && action !== "allow-always" && action !== "deny") {
+    return null;
+  }
+  return {
+    approvalId: decodeCustomIdValue(rawId),
+    action,
+  };
+}
+
+type ExecApprovalButtonContext = {
+  getApprovers: () => string[];
+  resolveApproval: (
+    approvalId: string,
+    decision: ExecApprovalDecision,
+  ) => Promise<ExecApprovalResolveResult>;
+};
+
+type ExecApprovalResolveResult = { ok: true } | { ok: false; reason: "error" | "not-found" };
+
+function isStructuredApprovalNotFoundError(err: unknown): boolean {
+  if (!err || typeof err !== "object") {
+    return false;
+  }
+  const record = err as {
+    gatewayCode?: unknown;
+    details?: { reason?: unknown } | null;
+  };
+  if (record.gatewayCode === "APPROVAL_NOT_FOUND") {
+    return true;
+  }
+  return (
+    record.gatewayCode === "INVALID_REQUEST" && record.details?.reason === "APPROVAL_NOT_FOUND"
+  );
+}
+
+export class ExecApprovalButton extends Button {
+  override label = "execapproval";
+  customId = "execapproval:seed=1";
+  override style = ButtonStyle.Primary;
+
+  constructor(private readonly ctx: ExecApprovalButtonContext) {
+    super();
+  }
+
+  override async run(interaction: ButtonInteraction, data: ComponentData): Promise<void> {
+    const parsed = parseExecApprovalData(data);
+    if (!parsed) {
+      try {
+        await interaction.reply({
+          content: "This approval is no longer valid.",
+          ephemeral: true,
+        });
+      } catch {}
+      return;
+    }
+
+    const approvers = this.ctx.getApprovers();
+    const userId = interaction.userId;
+    if (!approvers.some((id) => id === userId)) {
+      try {
+        await interaction.reply({
+          content: "⛔ You are not authorized to approve exec requests.",
+          ephemeral: true,
+        });
+      } catch {}
+      return;
+    }
+
+    const decisionLabel =
+      parsed.action === "allow-once"
+        ? "Allowed (once)"
+        : parsed.action === "allow-always"
+          ? "Allowed (always)"
+          : "Denied";
+
+    try {
+      await interaction.acknowledge();
+    } catch {}
+
+    const result = await this.ctx.resolveApproval(parsed.approvalId, parsed.action);
+    if (!result.ok && result.reason !== "not-found") {
+      try {
+        await interaction.followUp({
+          content: `Failed to submit approval decision for **${decisionLabel}**. The request may have expired or already been resolved.`,
+          ephemeral: true,
+        });
+      } catch {}
+    }
+  }
+}
+
+export function createExecApprovalButton(ctx: ExecApprovalButtonContext): Button {
+  return new ExecApprovalButton(ctx);
+}
+
+export function createDiscordExecApprovalButtonContext(params: {
+  cfg: AutoBotConfig;
+  accountId: string;
+  config: DiscordExecApprovalConfig;
+  gatewayUrl?: string;
+}): ExecApprovalButtonContext {
+  return {
+    getApprovers: () =>
+      getDiscordExecApprovalApprovers({
+        cfg: params.cfg,
+        accountId: params.accountId,
+        configOverride: params.config,
+      }),
+    resolveApproval: async (approvalId, decision) => {
+      try {
+        await resolveApprovalOverGateway({
+          cfg: params.cfg,
+          approvalId,
+          decision,
+          gatewayUrl: params.gatewayUrl,
+          clientDisplayName: `Discord approval (${params.accountId})`,
+        });
+        return { ok: true };
+      } catch (err) {
+        return {
+          ok: false,
+          reason: isStructuredApprovalNotFoundError(err) ? "not-found" : "error",
+        };
+      }
+    },
+  };
+}

package/src/monitor/format.ts

@@ -0,0 +1,45 @@
+import type { Guild, User } from "../internal/discord.js";
+
+export function resolveDiscordSystemLocation(params: {
+  isDirectMessage: boolean;
+  isGroupDm: boolean;
+  guild?: Guild;
+  channelName: string;
+}) {
+  const { isDirectMessage, isGroupDm, guild, channelName } = params;
+  if (isDirectMessage) {
+    return "DM";
+  }
+  if (isGroupDm) {
+    return `Group DM #${channelName}`;
+  }
+  return guild?.name ? `${guild.name} #${channelName}` : `#${channelName}`;
+}
+
+export function formatDiscordReactionEmoji(emoji: { id?: string | null; name?: string | null }) {
+  if (emoji.id && emoji.name) {
+    // Custom guild emoji in Discord-renderable form.
+    return `<:${emoji.name}:${emoji.id}>`;
+  }
+  if (emoji.id) {
+    // Keep id visible even when name is missing (instead of opaque "emoji").
+    return `emoji:${emoji.id}`;
+  }
+  return emoji.name ?? "emoji";
+}
+
+export function formatDiscordUserTag(user: User) {
+  const discriminator = (user.discriminator ?? "").trim();
+  if (discriminator && discriminator !== "0") {
+    return `${user.username}#${discriminator}`;
+  }
+  return user.username ?? user.id;
+}
+
+export function resolveTimestampMs(timestamp?: string | null) {
+  if (!timestamp) {
+    return undefined;
+  }
+  const parsed = Date.parse(timestamp);
+  return Number.isNaN(parsed) ? undefined : parsed;
+}

package/src/monitor/gateway-handle.ts

@@ -0,0 +1,34 @@
+import type { EventEmitter } from "node:events";
+import type { GatewayPlugin } from "../internal/gateway.js";
+
+export const DISCORD_GATEWAY_TRANSPORT_ACTIVITY_EVENT =
+  "autobot:discord-gateway-transport-activity";
+
+export type DiscordGatewayHandle = Pick<GatewayPlugin, "disconnect"> & {
+  emitter?: EventEmitter;
+};
+
+type GatewaySocketListener = (...args: unknown[]) => void;
+
+type DiscordGatewaySocket = {
+  on: (event: "close" | "error", listener: GatewaySocketListener) => unknown;
+  listeners: (event: "close" | "error") => GatewaySocketListener[];
+  removeListener: (event: "close" | "error", listener: GatewaySocketListener) => unknown;
+  terminate?: () => void;
+};
+
+export type MutableDiscordGateway = GatewayPlugin & {
+  emitter?: EventEmitter;
+  options: Record<string, unknown> & {
+    reconnect?: {
+      maxAttempts?: number;
+    };
+  };
+  state?: {
+    sessionId?: string | null;
+    resumeGatewayUrl?: string | null;
+    sequence?: number | null;
+  };
+  sequence?: number | null;
+  ws?: DiscordGatewaySocket | null;
+};