@ihazz/bitrix24 1.1.1 → 1.1.2

package/package.json

@@ -1,10 +1,18 @@
 {
   "name": "@ihazz/bitrix24",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Bitrix24 Messenger channel for OpenClaw",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "files": [
+    "index.ts",
+    "openclaw.plugin.json",
+    "README.md",
+    "LICENSE",
+    "src",
+    "skills"
+  ],
   "openclaw": {
     "extensions": [
       "./index.ts"

package/src/media-service.ts

@@ -1,11 +1,11 @@
 import { randomUUID } from 'node:crypto';
 import { isIP } from 'node:net';
 import { writeFile, readFile, mkdir, stat, unlink } from 'node:fs/promises';
-import { homedir } from 'node:os';
 import { join, basename, resolve as resolvePath, relative, sep } from 'node:path';
 import { Bitrix24Api } from './api.js';
 import type { BotContext } from './api.js';
 import type { Logger } from './types.js';
+import { resolveManagedMediaDir } from './state-paths.js';
 import { defaultLogger, serializeError } from './utils.js';
 
 export interface DownloadedMedia {
@@ -111,27 +111,23 @@ function normalizeDownloadUrl(downloadUrl: string, webhookUrl: string): string {
   }
 }
 
-function resolveHomeDir(env: NodeJS.ProcessEnv = process.env): string {
-  const homePath = env.HOME?.trim() || env.USERPROFILE?.trim();
-  if (homePath) {
-    return resolvePath(homePath);
-  }
-
-  return homedir();
-}
+function replaceDownloadUrlOrigin(downloadUrl: string, webhookUrl: string): string | null {
+  try {
+    const sourceUrl = new URL(downloadUrl);
+    const webhook = new URL(webhookUrl);
+    if (sourceUrl.protocol === webhook.protocol && sourceUrl.host === webhook.host) {
+      return null;
+    }
 
-function resolveOpenClawStateDir(env: NodeJS.ProcessEnv = process.env): string {
-  const override = env.OPENCLAW_STATE_DIR?.trim() || env.CLAWDBOT_STATE_DIR?.trim();
-  if (override) {
-    return resolvePath(override);
+    sourceUrl.protocol = webhook.protocol;
+    sourceUrl.host = webhook.host;
+    return sourceUrl.toString();
+  } catch {
+    return null;
   }
-
-  return join(resolveHomeDir(env), '.openclaw');
 }
 
-export function resolveManagedMediaDir(env: NodeJS.ProcessEnv = process.env): string {
-  return join(resolveOpenClawStateDir(env), 'media', 'bitrix24');
-}
+export { resolveManagedMediaDir } from './state-paths.js';
 
 /** Maximum file size for download/upload (100 MB). */
 const MAX_FILE_SIZE = 100 * 1024 * 1024;
@@ -155,6 +151,24 @@ export class MediaService {
     this.dirReady = true;
   }
 
+  private async fetchDownloadResponse(params: {
+    url: string;
+    fileId: string;
+  }): Promise<Response> {
+    try {
+      return await fetch(params.url, {
+        signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
+      });
+    } catch (err) {
+      this.logger.warn('Bitrix file fetch failed', {
+        fileId: params.fileId,
+        url: params.url,
+        error: serializeError(err),
+      });
+      throw err;
+    }
+  }
+
   /**
    * Download a file from B24 using imbot.v2.File.download.
    * Single-step: get download URL, then fetch the file.
@@ -198,16 +212,55 @@ export class MediaService {
         });
       }
 
+      const webhookFallbackUrl = replaceDownloadUrlOrigin(downloadUrl, webhookUrl);
+      const canRetryWithWebhookOrigin = Boolean(
+        webhookFallbackUrl && webhookFallbackUrl !== safeDownloadUrl,
+      );
+
       // Download the file (with timeout)
-      const response = await fetch(safeDownloadUrl, {
-        signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
-      });
-      if (!response.ok) {
-        this.logger.warn('Failed to download file', {
+      let response: Response;
+      try {
+        response = await this.fetchDownloadResponse({
+          url: safeDownloadUrl,
           fileId,
-          status: response.status,
         });
-        return null;
+      } catch (err) {
+        if (!canRetryWithWebhookOrigin || !webhookFallbackUrl) {
+          throw err;
+        }
+
+        this.logger.warn('Retrying Bitrix file download via webhook origin after fetch failure', {
+          fileId,
+          fromUrl: safeDownloadUrl,
+          toUrl: webhookFallbackUrl,
+        });
+        response = await this.fetchDownloadResponse({
+          url: webhookFallbackUrl,
+          fileId,
+        });
+      }
+
+      if (!response.ok) {
+        if (canRetryWithWebhookOrigin && webhookFallbackUrl) {
+          this.logger.warn('Retrying Bitrix file download via webhook origin after HTTP failure', {
+            fileId,
+            status: response.status,
+            fromUrl: safeDownloadUrl,
+            toUrl: webhookFallbackUrl,
+          });
+          response = await this.fetchDownloadResponse({
+            url: webhookFallbackUrl,
+            fileId,
+          });
+        }
+
+        if (!response.ok) {
+          this.logger.warn('Failed to download file', {
+            fileId,
+            status: response.status,
+          });
+          return null;
+        }
       }
 
       // Check file size before downloading into memory

package/src/state-paths.ts

@@ -0,0 +1,24 @@
+import { homedir } from 'node:os';
+import { join, resolve as resolvePath } from 'node:path';
+
+function resolveHomeDir(env: NodeJS.ProcessEnv = process.env): string {
+  const homePath = env.HOME?.trim() || env.USERPROFILE?.trim();
+  if (homePath) {
+    return resolvePath(homePath);
+  }
+
+  return homedir();
+}
+
+function resolveOpenClawStateDir(env: NodeJS.ProcessEnv = process.env): string {
+  const override = env.OPENCLAW_STATE_DIR?.trim() || env.CLAWDBOT_STATE_DIR?.trim();
+  if (override) {
+    return resolvePath(override);
+  }
+
+  return join(resolveHomeDir(env), '.openclaw');
+}
+
+export function resolveManagedMediaDir(env: NodeJS.ProcessEnv = process.env): string {
+  return join(resolveOpenClawStateDir(env), 'media', 'bitrix24');
+}

package/tests/access-control.test.ts

@@ -1,398 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import {
-  checkAccess,
-  checkAccessWithPairing,
-  getWebhookUserId,
-  normalizeAllowEntry,
-  normalizeAllowList,
-} from '../src/access-control.js';
-import type { PluginRuntime, ChannelPairingAdapter } from '../src/runtime.js';
-
-describe('normalizeAllowEntry', () => {
-  it('strips bitrix24: prefix', () => {
-    expect(normalizeAllowEntry('bitrix24:42')).toBe('42');
-  });
-
-  it('strips b24: prefix', () => {
-    expect(normalizeAllowEntry('b24:100')).toBe('100');
-  });
-
-  it('strips bx24: prefix', () => {
-    expect(normalizeAllowEntry('bx24:7')).toBe('7');
-  });
-
-  it('strips prefixes case-insensitively', () => {
-    expect(normalizeAllowEntry('Bitrix24:42')).toBe('42');
-    expect(normalizeAllowEntry('B24:100')).toBe('100');
-    expect(normalizeAllowEntry('BX24:7')).toBe('7');
-  });
-
-  it('returns plain ID as-is', () => {
-    expect(normalizeAllowEntry('42')).toBe('42');
-  });
-
-  it('trims whitespace', () => {
-    expect(normalizeAllowEntry('  b24:42  ')).toBe('42');
-  });
-});
-
-describe('normalizeAllowList', () => {
-  it('normalizes, deduplicates and filters empty allowFrom entries', () => {
-    expect(normalizeAllowList([' bitrix24:42 ', '42', 'b24:7', ''])).toEqual(['42', '7']);
-  });
-
-  it('returns empty list for missing allowFrom config', () => {
-    expect(normalizeAllowList(undefined)).toEqual([]);
-  });
-});
-
-describe('getWebhookUserId', () => {
-  it('extracts owner ID from webhook URL', () => {
-    expect(getWebhookUserId('https://test.bitrix24.com/rest/42/token/')).toBe('42');
-  });
-
-  it('normalizes prefixed user IDs', () => {
-    expect(getWebhookUserId('https://test.bitrix24.com/rest/b24:42/token/')).toBe('42');
-  });
-
-  it('returns null for invalid URLs', () => {
-    expect(getWebhookUserId('not-a-url')).toBeNull();
-  });
-
-  it('returns null when rest segment is missing', () => {
-    expect(getWebhookUserId('https://test.bitrix24.com/api/42/token/')).toBeNull();
-  });
-});
-
-describe('checkAccess', () => {
-  it('defaults to webhookUser and denies without a valid webhook owner', () => {
-    expect(checkAccess('1', {})).toBe(false);
-  });
-
-  it('allows only the webhook owner in webhookUser mode', () => {
-    const config = {
-      dmPolicy: 'webhookUser' as const,
-      webhookUrl: 'https://test.bitrix24.com/rest/42/token/',
-    };
-
-    expect(checkAccess('42', config)).toBe(true);
-    expect(checkAccess('99', config)).toBe(false);
-  });
-
-  it('allows webhook owner when dmPolicy is omitted', () => {
-    expect(checkAccess('42', { webhookUrl: 'https://test.bitrix24.com/rest/42/token/' })).toBe(true);
-  });
-
-  it('keeps senderId as the access identity even when direct dialogId differs', () => {
-    const config = {
-      dmPolicy: 'webhookUser' as const,
-      webhookUrl: 'https://test.bitrix24.com/rest/42/token/',
-    };
-
-    expect(checkAccess('42', config, { dialogId: '2386', isDirect: true })).toBe(true);
-    expect(checkAccess('77', config, { dialogId: '42', isDirect: true })).toBe(false);
-  });
-
-  it('denies when webhookUser mode has no valid webhook owner', () => {
-    expect(checkAccess('42', { dmPolicy: 'webhookUser', webhookUrl: 'invalid' })).toBe(false);
-  });
-
-  it('returns false for pairing mode without runtime state', () => {
-    expect(checkAccess('1', { dmPolicy: 'pairing' })).toBe(false);
-  });
-
-  it('allows any sender in open mode', () => {
-    expect(checkAccess('1', { dmPolicy: 'open' })).toBe(true);
-    expect(checkAccess('77', { dmPolicy: 'open' })).toBe(true);
-  });
-
-  it('allows only configured identities in allowlist mode', () => {
-    expect(checkAccess('42', { dmPolicy: 'allowlist', allowFrom: ['bitrix24:42'] })).toBe(true);
-    expect(checkAccess('77', { dmPolicy: 'allowlist', allowFrom: ['bitrix24:42'] })).toBe(false);
-  });
-});
-
-function makeMockRuntime(storeAllowFrom: string[] = []): PluginRuntime {
-  return {
-    config: { loadConfig: () => ({}) },
-    channel: {
-      routing: { resolveAgentRoute: vi.fn() },
-      reply: {
-        finalizeInboundContext: vi.fn(),
-        dispatchReplyWithBufferedBlockDispatcher: vi.fn(),
-      },
-      session: { recordInboundSession: vi.fn() },
-      pairing: {
-        readAllowFromStore: vi.fn().mockResolvedValue(storeAllowFrom),
-        upsertPairingRequest: vi.fn().mockResolvedValue({ code: 'ABCD1234', created: true }),
-        buildPairingReply: vi.fn().mockReturnValue('Your pairing code: ABCD1234'),
-      },
-    },
-    logging: { getChildLogger: () => ({ info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() }) },
-  } as unknown as PluginRuntime;
-}
-
-const mockAdapter: ChannelPairingAdapter = {
-  idLabel: 'bitrix24UserId',
-  normalizeAllowEntry: (entry) => entry.replace(/^(bitrix24|b24|bx24):/i, ''),
-};
-
-const silentLogger = { debug: vi.fn() };
-
-describe('checkAccessWithPairing', () => {
-  it('defaults to webhookUser when dmPolicy is omitted', async () => {
-    const runtime = makeMockRuntime();
-
-    const result = await checkAccessWithPairing({
-      senderId: '42',
-      config: { webhookUrl: 'https://test.bitrix24.com/rest/42/token/' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-    expect(runtime.channel.pairing.readAllowFromStore).not.toHaveBeenCalled();
-  });
-
-  it('allows only the webhook owner in webhookUser mode', async () => {
-    const runtime = makeMockRuntime();
-    const sendReply = vi.fn();
-
-    const result = await checkAccessWithPairing({
-      senderId: '42',
-      config: {
-        dmPolicy: 'webhookUser',
-        webhookUrl: 'https://test.bitrix24.com/rest/42/token/',
-      },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply,
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-    expect(runtime.channel.pairing.readAllowFromStore).not.toHaveBeenCalled();
-    expect(runtime.channel.pairing.upsertPairingRequest).not.toHaveBeenCalled();
-    expect(sendReply).not.toHaveBeenCalled();
-  });
-
-  it('keeps senderId as the identity in webhookUser mode even when dialogId differs', async () => {
-    const runtime = makeMockRuntime();
-
-    const allowed = await checkAccessWithPairing({
-      senderId: '42',
-      dialogId: '2386',
-      isDirect: true,
-      config: {
-        dmPolicy: 'webhookUser',
-        webhookUrl: 'https://test.bitrix24.com/rest/42/token/',
-      },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    const denied = await checkAccessWithPairing({
-      senderId: '77',
-      dialogId: '42',
-      isDirect: true,
-      config: {
-        dmPolicy: 'webhookUser',
-        webhookUrl: 'https://test.bitrix24.com/rest/42/token/',
-      },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(allowed).toBe('allow');
-    expect(denied).toBe('deny');
-  });
-
-  it('denies non-owner users in webhookUser mode', async () => {
-    const runtime = makeMockRuntime();
-    const sendReply = vi.fn();
-
-    const result = await checkAccessWithPairing({
-      senderId: '77',
-      config: {
-        dmPolicy: 'webhookUser',
-        webhookUrl: 'https://test.bitrix24.com/rest/42/token/',
-      },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply,
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('deny');
-    expect(runtime.channel.pairing.readAllowFromStore).not.toHaveBeenCalled();
-    expect(runtime.channel.pairing.upsertPairingRequest).not.toHaveBeenCalled();
-    expect(sendReply).not.toHaveBeenCalled();
-  });
-
-  it('returns allow when sender is in pairing store', async () => {
-    const runtime = makeMockRuntime(['42']);
-
-    const result = await checkAccessWithPairing({
-      senderId: '42',
-      config: { dmPolicy: 'pairing' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-  });
-
-  it('returns allow when sender is in config allowFrom', async () => {
-    const runtime = makeMockRuntime();
-
-    const result = await checkAccessWithPairing({
-      senderId: '42',
-      config: {
-        dmPolicy: 'pairing',
-        allowFrom: ['bitrix24:42'],
-      },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-    expect(runtime.channel.pairing.upsertPairingRequest).not.toHaveBeenCalled();
-  });
-
-  it('returns allow for any sender in open mode', async () => {
-    const runtime = makeMockRuntime();
-
-    const result = await checkAccessWithPairing({
-      senderId: '77',
-      config: { dmPolicy: 'open' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-  });
-
-  it('returns deny for non-allowlisted sender in allowlist mode', async () => {
-    const runtime = makeMockRuntime();
-
-    const result = await checkAccessWithPairing({
-      senderId: '77',
-      config: { dmPolicy: 'allowlist', allowFrom: ['bitrix24:42'] },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('deny');
-    expect(runtime.channel.pairing.upsertPairingRequest).not.toHaveBeenCalled();
-  });
-
-  it('uses senderId as the pairing identity even when direct dialogId differs', async () => {
-    const runtime = makeMockRuntime(['42']);
-
-    const result = await checkAccessWithPairing({
-      senderId: '42',
-      dialogId: '42',
-      isDirect: true,
-      config: { dmPolicy: 'pairing' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-  });
-
-  it('normalizes prefixed entries from pairing store', async () => {
-    const runtime = makeMockRuntime(['b24:42']);
-
-    const result = await checkAccessWithPairing({
-      senderId: '42',
-      config: { dmPolicy: 'pairing' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply: vi.fn(),
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('allow');
-  });
-
-  it('upserts pairing request and sends reply for new pairing', async () => {
-    const runtime = makeMockRuntime();
-    const sendReply = vi.fn();
-
-    const result = await checkAccessWithPairing({
-      senderId: '77',
-      config: { dmPolicy: 'pairing' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply,
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('pairing');
-    expect(runtime.channel.pairing.readAllowFromStore).toHaveBeenCalledWith('bitrix24', '', 'default');
-    expect(runtime.channel.pairing.upsertPairingRequest).toHaveBeenCalledWith({
-      channel: 'bitrix24',
-      id: '77',
-      accountId: 'default',
-      meta: {},
-      pairingAdapter: mockAdapter,
-    });
-    expect(runtime.channel.pairing.buildPairingReply).toHaveBeenCalledWith({
-      code: 'ABCD1234',
-      channel: 'bitrix24',
-      accountId: 'default',
-    });
-    expect(sendReply).toHaveBeenCalledWith('Your pairing code: ABCD1234');
-  });
-
-  it('does not send reply for duplicate pairing request', async () => {
-    const runtime = makeMockRuntime();
-    (runtime.channel.pairing.upsertPairingRequest as ReturnType<typeof vi.fn>).mockResolvedValue({
-      code: 'ABCD1234',
-      created: false,
-    });
-    const sendReply = vi.fn();
-
-    const result = await checkAccessWithPairing({
-      senderId: '77',
-      config: { dmPolicy: 'pairing' },
-      runtime,
-      accountId: 'default',
-      pairingAdapter: mockAdapter,
-      sendReply,
-      logger: silentLogger,
-    });
-
-    expect(result).toBe('pairing');
-    expect(sendReply).not.toHaveBeenCalled();
-  });
-});