@goodandready/dsh-messenger-gateway 0.4.5 → 0.4.7

package/lib/http.js

@@ -1,8 +1,25 @@
 import { timingSafeEqual } from 'node:crypto'
 
-export async function readBody(req) {
+export async function readBody(req, maxBytes = 1_048_576) {
+  const cl = Number(req?.headers?.['content-length'])
+  if (Number.isFinite(cl) && cl > maxBytes) {
+    const err = new Error(`Payload Too Large: content-length ${cl} exceeds ${maxBytes}`)
+    err.status = 413
+    err.statusCode = 413
+    throw err
+  }
   const chunks = []
-  for await (const chunk of req) chunks.push(chunk)
+  let total = 0
+  for await (const chunk of req) {
+    total += chunk.length
+    if (total > maxBytes) {
+      const err = new Error(`Payload Too Large: exceeded ${maxBytes} bytes`)
+      err.status = 413
+      err.statusCode = 413
+      throw err
+    }
+    chunks.push(chunk)
+  }
   return Buffer.concat(chunks)
 }
 
@@ -12,21 +29,67 @@ export function writeJson(res, status, body) {
   res.end(JSON.stringify(body))
 }
 
+export function isLoopback(value) {
+  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '')
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.')
+}
+
 export function isTrustedSettingsRequest(req) {
-  const host = String(req.headers?.host || '')
+  const remote = req?.socket?.remoteAddress
+  const host = String(req?.headers?.host || '')
   if (!host) return false
 
-  const origin = String(req.headers?.origin || '')
+  const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
+  if (site === 'cross-site') return false
+
+  const origin = String(req?.headers?.origin || '')
   if (origin) {
-    try { return new URL(origin).host === host } catch { return false }
+    try {
+      const url = new URL(origin)
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') return false
+      return url.host.toLowerCase() === host.toLowerCase()
+    } catch {
+      return false
+    }
   }
 
-  const secFetchSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
-  if (secFetchSite === 'same-origin') return true
-
-  const referer = String(req.headers?.referer || '')
+  const referer = String(req?.headers?.referer || '')
   if (referer) {
-    try { return new URL(referer).host === host } catch { return false }
+    try {
+      const url = new URL(referer)
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') return false
+      return url.host.toLowerCase() === host.toLowerCase()
+    } catch {
+      return false
+    }
+  }
+
+  if (site === 'same-origin') {
+    if (remote !== undefined && !isLoopback(remote)) return false
+    return true
+  }
+
+  return isLoopback(remote)
+}
+
+export function isAuthorizedMessengerRequest(req, webhooksConfig) {
+  const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
+  if (site === 'cross-site') return false
+
+  if (isTrustedSettingsRequest(req)) return true
+  if (isLoopback(req?.socket?.remoteAddress)) return true
+
+  const secret = String(webhooksConfig?.secret || '').trim()
+  if (secret) {
+    const authHeader = req?.headers?.authorization || ''
+    const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''
+    const tokenHeader = req?.headers?.['x-webhook-secret'] || ''
+    const provided = bearer || tokenHeader
+    if (provided && timingSafeCompare(provided, secret)) {
+      return true
+    }
   }
 
   return false

package/lib/index.js

@@ -3,7 +3,7 @@ import { join, dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { Gateway } from './gateway.js'
-import { readBody, writeJson, isTrustedSettingsRequest, timingSafeCompare } from './http.js'
+import { readBody, writeJson, isTrustedSettingsRequest, timingSafeCompare, isAuthorizedMessengerRequest } from './http.js'
 import { registerPluginUpdater } from './updater.js'
 import {
   createMessengerService, dispatchMessenger, httpStatusForError,
@@ -11,6 +11,7 @@ import {
 } from './messenger-api.js'
 import { listHomes } from './homes.js'
 import { Config } from './config.js'
+import { setupSettings } from './settings-bridge.js'
 
 export const name = '@goodandready/dsh-messenger-gateway'
 export const inject = ['agentDefaultModel', 'agents', 'sessions', 'loader', 'settings', 'webServer', 'attachments', 'tools']
@@ -90,14 +91,32 @@ function publicConfig(cfg) {
   }
 }
 
-function registerMessengerRoute(ctx, getGw, path, action) {
+async function readJsonSafe(req, res, maxBytes = 1_048_576) {
+  try {
+    const raw = await readBody(req, maxBytes)
+    const text = raw.toString('utf8').trim()
+    return { ok: true, data: text ? JSON.parse(text) : {} }
+  } catch (err) {
+    if (err.statusCode === 413 || err.status === 413) {
+      writeJson(res, 413, { ok: false, error: 'payload too large' })
+      return { ok: false }
+    }
+    writeJson(res, 400, { ok: false, error: 'invalid json' })
+    return { ok: false }
+  }
+}
+
+function registerMessengerRoute(ctx, getGw, path, action, source) {
   ctx.effect(() => (ctx.get?.('webServer') || ctx.webServer).register({
     kind: 'exact', path,
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
+      if (!isAuthorizedMessengerRequest(req, source?.()?.webhooks)) {
+        return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      }
       let payload
       try {
-        payload = parseMessengerBody((await readBody(req)).toString('utf8'))
+        payload = parseMessengerBody((await readBody(req, 1_048_576)).toString('utf8'))
       } catch (err) {
         return writeJson(res, httpStatusForError(err), { ok: false, error: err.message })
       }
@@ -133,7 +152,7 @@ export function apply(ctx, config) {
     if (effective.enabled === false) return
     gateway = new Gateway(ctx, effective, {
       persistAllowedUserIds: async (ids) => {
-        if (!settingsApi) return
+        if (!settingsApi?.isReady?.()) return
         const cur = source()
         await settingsApi.replace(Config({
           ...cur,
@@ -141,7 +160,7 @@ export function apply(ctx, config) {
         }))
       },
       persistHome: async ({ chatId, threadId }) => {
-        if (!settingsApi) throw new Error('settings not ready')
+        if (!settingsApi?.isReady?.()) throw new Error('settings not ready')
         const cur = source()
         await settingsApi.replace(Config({
           ...cur,
@@ -149,7 +168,7 @@ export function apply(ctx, config) {
         }))
       },
       persistHomes: async (nextTelegram) => {
-        if (!settingsApi) throw new Error('settings not ready')
+        if (!settingsApi?.isReady?.()) throw new Error('settings not ready')
         const cur = source()
         await settingsApi.replace(Config({
           ...cur,
@@ -157,7 +176,7 @@ export function apply(ctx, config) {
         }))
       },
       persistAgentModel: async ({ provider, model }) => {
-        if (!settingsApi) return
+        if (!settingsApi?.isReady?.()) return
         const cur = source()
         await settingsApi.replace(Config({
           ...cur,
@@ -168,11 +187,28 @@ export function apply(ctx, config) {
     gateway.start().catch((err) => ctx.logger?.warn?.(`dsh-messenger-gateway: ${err.message}`))
   }
 
-  const settings = ctx.get?.('settings') || ctx.settings
-  if (settings?.register) {
-    settingsApi = settings.register(SETTINGS_NAMESPACE, Config, { base: config || {} })
-    source = () => resolveConfig(settingsApi.get() ?? config ?? {})
-    ctx.effect(() => settingsApi.watch(sync), 'dsh-messenger-gateway: settings')
+  const settingsBridge = setupSettings(ctx, {
+    namespace: SETTINGS_NAMESPACE,
+    Config,
+    resolveConfig,
+    baseConfig: config,
+    sync,
+    logger: ctx.logger,
+  })
+  source = () => settingsBridge.getSource()
+  settingsApi = {
+    get: () => settingsBridge.getSettingsApi()?.get(),
+    replace: (next) => {
+      const api = settingsBridge.getSettingsApi()
+      if (!api) throw new Error('settings not ready')
+      return api.replace(next)
+    },
+    update: (patch) => {
+      const api = settingsBridge.getSettingsApi()
+      if (!api) throw new Error('settings not ready')
+      return api.update(patch)
+    },
+    isReady: () => Boolean(settingsBridge.getSettingsApi()),
   }
 
   const getGw = () => gateway
@@ -251,7 +287,7 @@ export function apply(ctx, config) {
   ctx.effect(() => {
     const onSkillsChange = () => {
       const gw = getGw()
-      if (gw) gw.syncTelegramCommands().catch(() => {})
+      if (gw) gw.syncTelegramCommands().catch((err) => ctx.logger?.debug?.(`sync telegram commands on skills change: ${err?.message || err}`))
     }
     const unbind = ctx.on('skills/change', onSkillsChange)
     return () => { if (typeof unbind === 'function') unbind() }
@@ -344,14 +380,9 @@ export function apply(ctx, config) {
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
-      let payload = {}
-      try {
-        const raw = (await readBody(req)).toString('utf8').trim()
-        if (raw) payload = JSON.parse(raw)
-      } catch {
-        return writeJson(res, 400, { ok: false, error: 'invalid json' })
-      }
-      const timeoutMs = Number(payload.timeoutMs) || 10000
+      const parsed = await readJsonSafe(req, res, 65536)
+      if (!parsed.ok) return
+      const timeoutMs = Number(parsed.data?.timeoutMs) || 10000
       const result = await gw.probeTelegram(timeoutMs)
       writeJson(res, result.ok ? 200 : 502, result)
     },
@@ -371,12 +402,6 @@ export function apply(ctx, config) {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not ready' })
-      let payload
-      try {
-        payload = JSON.parse((await readBody(req)).toString('utf8') || '{}')
-      } catch {
-        return writeJson(res, 400, { ok: false, error: 'invalid json' })
-      }
 
       if (source().webhooks?.enabled === false) {
         return writeJson(res, 404, { ok: false, error: 'webhooks disabled' })
@@ -385,12 +410,28 @@ export function apply(ctx, config) {
       if (!expectedSecret) {
         return writeJson(res, 403, { ok: false, error: 'webhook secret not configured' })
       }
+
+      // Check header authentication BEFORE reading the body to avoid unbounded buffering
       const authHeader = req.headers?.authorization || ''
       const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''
       const tokenHeader = req.headers?.['x-webhook-secret'] || ''
-      const provided = bearer || tokenHeader || payload.secret
-      if (!timingSafeCompare(provided, expectedSecret)) {
-        return writeJson(res, 401, { ok: false, error: 'unauthorized' })
+      const headerProvided = bearer || tokenHeader
+
+      if (headerProvided) {
+        if (!timingSafeCompare(headerProvided, expectedSecret)) {
+          return writeJson(res, 401, { ok: false, error: 'unauthorized' })
+        }
+      }
+
+      const parsed = await readJsonSafe(req, res, 1_048_576)
+      if (!parsed.ok) return
+      const payload = parsed.data
+
+      if (!headerProvided) {
+        const bodySecret = String(payload.secret || '').trim()
+        if (!timingSafeCompare(bodySecret, expectedSecret)) {
+          return writeJson(res, 401, { ok: false, error: 'unauthorized' })
+        }
       }
 
       const { target, text, home, chatId, threadId, platform = 'telegram', files } = payload
@@ -414,9 +455,10 @@ export function apply(ctx, config) {
       if (req.method === 'GET') return writeJson(res, 200, { ok: true, config: publicConfig(source()) })
       if (req.method !== 'PUT') return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
-      if (!settingsApi) return writeJson(res, 503, { ok: false, error: 'settings not ready' })
-      let payload
-      try { payload = JSON.parse((await readBody(req)).toString('utf8') || '{}') } catch { return writeJson(res, 400, { ok: false, error: 'invalid json' }) }
+      if (!settingsApi?.isReady?.()) return writeJson(res, 503, { ok: false, error: 'settings not ready' })
+      const parsedConfig = await readJsonSafe(req, res, 1_048_576)
+      if (!parsedConfig.ok) return
+      let payload = parsedConfig.data
       if (payload && typeof payload.config === 'object') payload = payload.config
       try {
         const cur = source()
@@ -472,9 +514,9 @@ export function apply(ctx, config) {
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
-      let payload
-      try { payload = JSON.parse((await readBody(req)).toString('utf8') || '{}') } catch { return writeJson(res, 400, { ok: false, error: 'invalid json' }) }
-      const resu = await gw.approvePairingCode(payload.code)
+      const parsed = await readJsonSafe(req, res, 65536)
+      if (!parsed.ok) return
+      const resu = await gw.approvePairingCode(parsed.data.code)
       writeJson(res, resu.ok ? 200 : 400, resu)
     },
   }), 'dsh-messenger-gateway: pairing approve')
@@ -486,9 +528,9 @@ export function apply(ctx, config) {
       if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
-      let payload
-      try { payload = JSON.parse((await readBody(req)).toString('utf8') || '{}') } catch { return writeJson(res, 400, { ok: false, error: 'invalid json' }) }
-      const resu = gw.rejectPairingCode(payload.code)
+      const parsed = await readJsonSafe(req, res, 65536)
+      if (!parsed.ok) return
+      const resu = gw.rejectPairingCode(parsed.data.code)
       writeJson(res, resu.ok ? 200 : 400, resu)
     },
   }), 'dsh-messenger-gateway: pairing reject')
@@ -515,10 +557,9 @@ export function apply(ctx, config) {
       const gw = getGw()
       const adapter = gw?.getAdapter?.('telegram')
       if (!adapter?.handleWebhookUpdate) return writeJson(res, 503, { ok: false, error: 'telegram adapter unavailable' })
-      let update
-      try { update = JSON.parse((await readBody(req)).toString('utf8') || '{}') } catch {
-        return writeJson(res, 400, { ok: false, error: 'invalid json' })
-      }
+      const parsed = await readJsonSafe(req, res, 2_097_152)
+      if (!parsed.ok) return
+      const update = parsed.data
       try {
         await adapter.handleWebhookUpdate(update)
         writeJson(res, 200, { ok: true })
@@ -528,9 +569,9 @@ export function apply(ctx, config) {
     },
   }), 'dsh-messenger-gateway: telegram webhook')
 
-  registerMessengerRoute(ctx, getGw, '/dsh-messenger-gateway/messenger/send', 'send')
-  registerMessengerRoute(ctx, getGw, '/dsh-messenger-gateway/messenger/progress', 'progress')
-  registerMessengerRoute(ctx, getGw, '/dsh-messenger-gateway/messenger/ask', 'ask')
+  registerMessengerRoute(ctx, getGw, '/dsh-messenger-gateway/messenger/send', 'send', source)
+  registerMessengerRoute(ctx, getGw, '/dsh-messenger-gateway/messenger/progress', 'progress', source)
+  registerMessengerRoute(ctx, getGw, '/dsh-messenger-gateway/messenger/ask', 'ask', source)
 
   const manifestPath = resolve(dirname(fileURLToPath(import.meta.url)), '../package.json')
   ctx.effect(() => registerPluginUpdater(ctx, {

package/lib/messenger-api.js

@@ -191,6 +191,7 @@ export function resolveAskTimeoutMs(timeoutMs) {
 }
 
 export function httpStatusForError(err) {
+  if (err?.statusCode) return err.statusCode
   if (err?.status) return err.status
   const msg = String(err?.message || '')
   if (msg.includes('timed out')) return 504