@ihazz/bitrix24 0.2.5 → 1.0.1

package/src/access-control.ts

@@ -1,43 +1,69 @@
 import type { Bitrix24AccountConfig } from './types.js';
 import type { PluginRuntime, ChannelPairingAdapter } from './runtime.js';
+import { stripChannelPrefix } from './utils.js';
 
 /**
  * Normalize an allowFrom entry — strip platform prefixes.
  * "bitrix24:42" → "42", "b24:42" → "42", "bx24:42" → "42", "42" → "42"
  */
 export function normalizeAllowEntry(entry: string): string {
-  return entry.trim().replace(/^(bitrix24|b24|bx24):/i, '');
+  return stripChannelPrefix(entry.trim());
+}
+
+export function normalizeAllowList(entries: string[] | undefined): string[] {
+  if (!Array.isArray(entries)) {
+    return [];
+  }
+
+  return [...new Set(
+    entries
+      .map((entry) => normalizeAllowEntry(String(entry)))
+      .filter(Boolean),
+  )];
+}
+
+/**
+ * Extract the owner user ID from a Bitrix24 inbound webhook URL.
+ * Format: https://{portal}/rest/{user_id}/{webhook_token}/
+ */
+export function getWebhookUserId(webhookUrl: string | undefined): string | null {
+  if (!webhookUrl) return null;
+
+  try {
+    const url = new URL(webhookUrl);
+    const pathParts = url.pathname.split('/').filter(Boolean);
+    const restIndex = pathParts.indexOf('rest');
+
+    if (restIndex < 0 || pathParts.length <= restIndex + 2) {
+      return null;
+    }
+
+    const userId = pathParts[restIndex + 1];
+    return userId ? normalizeAllowEntry(userId) : null;
+  } catch {
+    return null;
+  }
 }
 
 /**
  * Check whether a sender is allowed to communicate with the bot.
  *
- * @returns `true` if the sender is allowed, `false` otherwise.
+ * Pairing requires runtime state, so the synchronous helper cannot approve access.
  */
 export function checkAccess(
   senderId: string,
   config: Bitrix24AccountConfig,
+  _options?: { dialogId?: string; isDirect?: boolean },
 ): boolean {
-  const policy = config.dmPolicy ?? 'pairing';
-
-  switch (policy) {
-    case 'open':
-      return true;
-
-    case 'allowlist': {
-      const allowList = config.allowFrom;
-      if (!allowList || allowList.length === 0) return false;
-      const normalized = allowList.map(normalizeAllowEntry);
-      return normalized.includes(String(senderId));
-    }
+  const dmPolicy = config.dmPolicy ?? 'webhookUser';
+  const identity = resolveAccessIdentity(senderId);
 
-    case 'pairing':
-      // Pairing requires runtime — use checkAccessWithPairing() instead
-      return false;
-
-    default:
-      return false;
+  if (dmPolicy === 'webhookUser') {
+    const webhookUserId = getWebhookUserId(config.webhookUrl);
+    return webhookUserId === identity;
   }
+
+  return false;
 }
 
 export type AccessResult = 'allow' | 'deny' | 'pairing';
@@ -49,6 +75,8 @@ export type AccessResult = 'allow' | 'deny' | 'pairing';
  */
 export async function checkAccessWithPairing(params: {
   senderId: string;
+  dialogId?: string;
+  isDirect?: boolean;
   config: Bitrix24AccountConfig;
   runtime: PluginRuntime;
   accountId: string;
@@ -56,44 +84,70 @@ export async function checkAccessWithPairing(params: {
   sendReply: (text: string) => Promise<void>;
   logger?: { debug: (...args: unknown[]) => void };
 }): Promise<AccessResult> {
-  const { senderId, config, runtime, accountId, pairingAdapter, sendReply, logger } = params;
-  const policy = config.dmPolicy ?? 'pairing';
-
-  if (policy === 'open') return 'allow';
+  const {
+    senderId,
+    dialogId,
+    isDirect,
+    config,
+    runtime,
+    accountId,
+    pairingAdapter,
+    sendReply,
+    logger,
+  } = params;
+  const identity = resolveAccessIdentity(senderId);
+  const dmPolicy = config.dmPolicy ?? 'webhookUser';
 
-  // Read file-based allowFrom store and merge with config
-  const storeAllowFrom = await runtime.channel.pairing.readAllowFromStore('bitrix24', '', accountId);
-  const configAllowFrom = (config.allowFrom ?? []).map(normalizeAllowEntry);
-  const merged = [...new Set([...configAllowFrom, ...storeAllowFrom])];
-  const normalizedSender = normalizeAllowEntry(String(senderId));
+  if (dmPolicy === 'webhookUser') {
+    const webhookUserId = getWebhookUserId(config.webhookUrl);
 
-  if (merged.includes(normalizedSender)) return 'allow';
+    if (webhookUserId && webhookUserId === identity) {
+      return 'allow';
+    }
 
-  if (policy === 'allowlist') {
-    logger?.debug('Access denied (allowlist)', { senderId });
+    logger?.debug('Access denied (webhookUser)', { senderId, dialogId, webhookUserId, identity });
     return 'deny';
   }
 
-  // policy === 'pairing'
-  const { code, created } = await runtime.channel.pairing.upsertPairingRequest({
-    channel: 'bitrix24',
-    id: senderId,
-    accountId,
-    meta: {},
-    pairingAdapter,
-  });
+  const storeAllowFrom = await runtime.channel.pairing.readAllowFromStore('bitrix24', '', accountId);
+  const approved = [...new Set([
+    ...normalizeAllowList(config.allowFrom),
+    ...normalizeAllowList(storeAllowFrom),
+  ])];
 
-  if (created) {
-    const reply = runtime.channel.pairing.buildPairingReply({
-      code,
+  if (approved.includes(identity)) return 'allow';
+
+  try {
+    const { code, created } = await runtime.channel.pairing.upsertPairingRequest({
       channel: 'bitrix24',
+      id: identity,
       accountId,
+      meta: {},
+      pairingAdapter,
     });
-    // buildPairingReply returns a string directly, not an object
-    const replyText = typeof reply === 'string' ? reply : (reply as { text?: string })?.text ?? String(reply);
-    await sendReply(replyText);
+
+    if (created) {
+      const reply = runtime.channel.pairing.buildPairingReply({
+        code,
+        channel: 'bitrix24',
+        accountId,
+      });
+      const replyText = typeof reply === 'string'
+        ? reply
+        : (reply && typeof reply === 'object' && 'text' in reply && typeof (reply as Record<string, unknown>).text === 'string')
+          ? (reply as Record<string, unknown>).text as string
+          : String(reply);
+      await sendReply(replyText);
+    }
+
+    logger?.debug('Pairing request handled', { senderId, dialogId, identity, code, created });
+    return 'pairing';
+  } catch (err) {
+    logger?.debug('Pairing request failed, falling back to deny', { senderId, dialogId, identity, error: err });
+    return 'deny';
   }
+}
 
-  logger?.debug('Pairing request handled', { senderId, code, created });
-  return 'pairing';
+function resolveAccessIdentity(senderId: string): string {
+  return normalizeAllowEntry(String(senderId));
 }