@johpaz/hive 1.1.0

package/packages/core/src/security/rate-limit.ts

@@ -0,0 +1,270 @@
+import { logger } from "../utils/logger.ts";
+
+export interface TokenBucketConfig {
+  maxTokens: number;
+  refillRate: number;
+  refillIntervalMs?: number;
+}
+
+export interface TokenBucket {
+  tokens: number;
+  lastUpdate: number;
+}
+
+export interface RateLimitResult {
+  allowed: boolean;
+  remaining: number;
+  retryAfterMs: number;
+}
+
+export interface TokenBucketStats {
+  totalBuckets: number;
+  activeBuckets: number;
+  totalTokensAvailable: number;
+}
+
+export class TokenBucketRateLimiter {
+  private buckets: Map<string, TokenBucket> = new Map();
+  private config: Required<TokenBucketConfig>;
+  private log = logger.child("token-bucket-limiter");
+
+  constructor(config: TokenBucketConfig) {
+    this.config = {
+      maxTokens: config.maxTokens,
+      refillRate: config.refillRate,
+      refillIntervalMs: config.refillIntervalMs ?? 1000,
+    };
+
+    this.startCleanup();
+  }
+
+  canProceed(key: string): RateLimitResult {
+    const now = Date.now();
+    let bucket = this.buckets.get(key);
+
+    if (!bucket) {
+      bucket = {
+        tokens: this.config.maxTokens,
+        lastUpdate: now,
+      };
+      this.buckets.set(key, bucket);
+    }
+
+    const elapsed = now - bucket.lastUpdate;
+    const tokensToAdd = (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+    bucket.tokens = Math.min(this.config.maxTokens, bucket.tokens + tokensToAdd);
+    bucket.lastUpdate = now;
+
+    if (bucket.tokens >= 1) {
+      bucket.tokens--;
+      return {
+        allowed: true,
+        remaining: Math.floor(bucket.tokens),
+        retryAfterMs: 0,
+      };
+    }
+
+    const retryAfterMs = Math.ceil(
+      ((1 - bucket.tokens) / this.config.refillRate) * this.config.refillIntervalMs
+    );
+
+    this.log.debug(`Rate limit hit for ${key}, retry after ${retryAfterMs}ms`);
+
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterMs,
+    };
+  }
+
+  consume(key: string, tokens: number = 1): RateLimitResult {
+    const now = Date.now();
+    let bucket = this.buckets.get(key);
+
+    if (!bucket) {
+      bucket = {
+        tokens: this.config.maxTokens,
+        lastUpdate: now,
+      };
+      this.buckets.set(key, bucket);
+    }
+
+    const elapsed = now - bucket.lastUpdate;
+    const tokensToAdd = (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+    bucket.tokens = Math.min(this.config.maxTokens, bucket.tokens + tokensToAdd);
+    bucket.lastUpdate = now;
+
+    if (bucket.tokens >= tokens) {
+      bucket.tokens -= tokens;
+      return {
+        allowed: true,
+        remaining: Math.floor(bucket.tokens),
+        retryAfterMs: 0,
+      };
+    }
+
+    const retryAfterMs = Math.ceil(
+      ((tokens - bucket.tokens) / this.config.refillRate) * this.config.refillIntervalMs
+    );
+
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterMs,
+    };
+  }
+
+  peek(key: string): number {
+    const bucket = this.buckets.get(key);
+    if (!bucket) return this.config.maxTokens;
+
+    const now = Date.now();
+    const elapsed = now - bucket.lastUpdate;
+    const tokensToAdd = (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+
+    return Math.min(this.config.maxTokens, bucket.tokens + tokensToAdd);
+  }
+
+  refill(key: string, tokens?: number): void {
+    const bucket = this.buckets.get(key);
+    if (!bucket) return;
+
+    bucket.tokens = Math.min(
+      this.config.maxTokens,
+      bucket.tokens + (tokens ?? this.config.maxTokens)
+    );
+  }
+
+  reset(key: string): void {
+    this.buckets.delete(key);
+  }
+
+  resetAll(): void {
+    this.buckets.clear();
+    this.log.info("All rate limit buckets cleared");
+  }
+
+  getStats(): TokenBucketStats {
+    let totalTokens = 0;
+    let activeBuckets = 0;
+    const now = Date.now();
+
+    for (const bucket of this.buckets.values()) {
+      const elapsed = now - bucket.lastUpdate;
+      const tokens = Math.min(
+        this.config.maxTokens,
+        bucket.tokens + (elapsed / this.config.refillIntervalMs) * this.config.refillRate
+      );
+
+      if (tokens < this.config.maxTokens) {
+        activeBuckets++;
+      }
+      totalTokens += tokens;
+    }
+
+    return {
+      totalBuckets: this.buckets.size,
+      activeBuckets,
+      totalTokensAvailable: Math.floor(totalTokens),
+    };
+  }
+
+  private startCleanup(): void {
+    setInterval(() => {
+      const now = Date.now();
+      for (const [key, bucket] of this.buckets) {
+        const elapsed = now - bucket.lastUpdate;
+        const fullTokens =
+          bucket.tokens + (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+
+        if (fullTokens >= this.config.maxTokens) {
+          this.buckets.delete(key);
+        }
+      }
+    }, 5 * 60 * 1000);
+  }
+}
+
+export interface SlidingWindowConfig {
+  windowMs: number;
+  maxRequests: number;
+}
+
+export interface SlidingWindowEntry {
+  timestamps: number[];
+}
+
+export class SlidingWindowRateLimiter {
+  private windows: Map<string, SlidingWindowEntry> = new Map();
+  private config: SlidingWindowConfig;
+  private log = logger.child("sliding-window-limiter");
+
+  constructor(config: SlidingWindowConfig) {
+    this.config = config;
+    this.startCleanup();
+  }
+
+  check(key: string): RateLimitResult {
+    const now = Date.now();
+    const windowStart = now - this.config.windowMs;
+
+    let entry = this.windows.get(key);
+    if (!entry) {
+      entry = { timestamps: [] };
+      this.windows.set(key, entry);
+    }
+
+    entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+
+    if (entry.timestamps.length >= this.config.maxRequests) {
+      const oldestInWindow = entry.timestamps[0];
+      const retryAfterMs = oldestInWindow + this.config.windowMs - now;
+
+      this.log.debug(`Sliding window limit hit for ${key}`);
+
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfterMs: Math.max(0, retryAfterMs),
+      };
+    }
+
+    entry.timestamps.push(now);
+
+    return {
+      allowed: true,
+      remaining: this.config.maxRequests - entry.timestamps.length,
+      retryAfterMs: 0,
+    };
+  }
+
+  reset(key: string): void {
+    this.windows.delete(key);
+  }
+
+  resetAll(): void {
+    this.windows.clear();
+  }
+
+  private startCleanup(): void {
+    setInterval(() => {
+      const now = Date.now();
+      const windowStart = now - this.config.windowMs;
+
+      for (const [key, entry] of this.windows) {
+        entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+        if (entry.timestamps.length === 0) {
+          this.windows.delete(key);
+        }
+      }
+    }, 60 * 1000);
+  }
+}
+
+export function createTokenBucketLimiter(config: TokenBucketConfig): TokenBucketRateLimiter {
+  return new TokenBucketRateLimiter(config);
+}
+
+export function createSlidingWindowLimiter(config: SlidingWindowConfig): SlidingWindowRateLimiter {
+  return new SlidingWindowRateLimiter(config);
+}

package/packages/core/src/security/signal.ts

@@ -0,0 +1,321 @@
+import { spawn, type ChildProcess } from "child_process";
+import { BaseChannel, type ChannelConfig, type IncomingMessage, type OutboundMessage } from "../channels/base.ts";
+import { logger } from "../utils/logger.ts";
+import { pairingService } from "./pairing.ts";
+
+export interface SignalConfig extends ChannelConfig {
+  phoneNumber: string;
+  dataDir?: string;
+  signalCliPath?: string;
+}
+
+interface SignalMessage {
+  envelope: {
+    source: string;
+    sourceNumber?: string;
+    sourceName?: string;
+    timestamp: number;
+    dataMessage?: {
+      message?: string;
+      expiresInSeconds?: number;
+    };
+    syncMessage?: {
+      sentMessage?: {
+        destination?: string;
+        message?: string;
+      };
+    };
+  };
+}
+
+export class SignalChannel extends BaseChannel {
+  name = "signal";
+  accountId: string;
+  config: SignalConfig;
+
+  private signalCli?: ChildProcess;
+  private log = logger.child("signal");
+  private messageBuffer = "";
+  private chatIdCache: Map<string, string> = new Map();
+
+  constructor(accountId: string, config: SignalConfig) {
+    super();
+    this.accountId = accountId;
+    this.config = {
+      ...config,
+      dmPolicy: config.dmPolicy ?? "pairing",
+      allowFrom: config.allowFrom ?? [],
+      enabled: config.enabled ?? true,
+    };
+  }
+
+  async start(): Promise<void> {
+    if (!this.config.phoneNumber) {
+      throw new Error("Signal phone number not configured");
+    }
+
+    const signalCliPath = this.config.signalCliPath ?? "signal-cli";
+    const dataDir = this.config.dataDir;
+
+    const args = ["daemon", "--system"];
+    if (dataDir) {
+      args.push("--config", dataDir);
+    }
+
+    this.log.info(`Starting signal-cli: ${signalCliPath} ${args.join(" ")}`);
+
+    this.signalCli = spawn(signalCliPath, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+
+    this.signalCli.stdout?.on("data", (data: Buffer) => {
+      this.handleSignalOutput(data.toString());
+    });
+
+    this.signalCli.stderr?.on("data", (data: Buffer) => {
+      this.log.error(`signal-cli stderr: ${data.toString()}`);
+    });
+
+    this.signalCli.on("error", (error: Error) => {
+      this.log.error(`signal-cli error: ${error.message}`);
+    });
+
+    this.signalCli.on("exit", (code, signal) => {
+      this.log.warn(`signal-cli exited with code ${code}, signal ${signal}`);
+      this.running = false;
+    });
+
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+
+    this.running = true;
+    this.log.info(`Signal channel started for ${this.config.phoneNumber}`);
+  }
+
+  private handleSignalOutput(output: string): void {
+    this.messageBuffer += output;
+
+    const lines = this.messageBuffer.split("\n");
+    this.messageBuffer = lines.pop() ?? "";
+
+    for (const line of lines) {
+      if (line.trim()) {
+        this.parseSignalMessage(line);
+      }
+    }
+  }
+
+  private parseSignalMessage(line: string): void {
+    try {
+      const data: SignalMessage = JSON.parse(line);
+
+      if (data.envelope?.dataMessage?.message) {
+        const from = data.envelope.source;
+        const content = data.envelope.dataMessage.message;
+        const timestamp = data.envelope.timestamp;
+
+        this.handleIncomingMessage({
+          from,
+          content,
+          timestamp,
+          name: data.envelope.sourceName,
+        });
+      }
+    } catch {
+      this.log.debug(`Non-JSON output: ${line.slice(0, 100)}`);
+    }
+  }
+
+  private async handleIncomingMessage(msg: {
+    from: string;
+    content: string;
+    timestamp: number;
+    name?: string;
+  }): Promise<void> {
+    const peerId = msg.from;
+    const kind = "direct";
+
+    if (msg.content === "/myid") {
+      await this.sendDirectMessage(
+        peerId,
+        `🆔 Tu Signal ID es: ${peerId}\n\n` +
+          `Para emparejar, usa el comando:\n` +
+          `\`hive pairing generate signal ${peerId}\``
+      );
+      return;
+    }
+
+    if (msg.content === "/pair" || msg.content.startsWith("/pair ")) {
+      const code = msg.content.split(" ")[1]?.trim();
+
+      if (!code) {
+        await this.sendDirectMessage(
+          peerId,
+          "🔐 Envía /pair CODIGO para emparejar.\n" +
+            "Solicita un código de emparejamiento al administrador."
+        );
+        return;
+      }
+
+      const result = pairingService.approve(code);
+      if (result.success) {
+        await this.sendDirectMessage(peerId, "✅ ¡Emparejamiento exitoso! Ya puedes usar el bot.");
+      } else {
+        await this.sendDirectMessage(peerId, `❌ ${result.error}`);
+      }
+      return;
+    }
+
+    if (this.config.dmPolicy === "pairing" && !pairingService.isAllowed("signal", peerId)) {
+      this.log.debug(`Message from unpaired user: ${peerId}`);
+      await this.sendDirectMessage(
+        peerId,
+        "⛔ No estás emparejado.\n\n" +
+          "Tu Signal ID: " + peerId + "\n\n" +
+          "Solicita un código de emparejamiento al administrador y envíalo con:\n" +
+          "/pair CODIGO"
+      );
+      return;
+    }
+
+    if (!this.isUserAllowed(peerId)) {
+      this.log.debug(`Message from unauthorized user: ${peerId}`);
+      return;
+    }
+
+    const sessionId = this.formatSessionId(peerId, kind);
+    this.chatIdCache.set(sessionId, peerId);
+
+    const incomingMessage: IncomingMessage = {
+      sessionId,
+      channel: "signal",
+      accountId: this.accountId,
+      peerId,
+      peerKind: kind,
+      content: msg.content,
+      metadata: {
+        signal: {
+          phoneNumber: peerId,
+          name: msg.name,
+          timestamp: msg.timestamp,
+        },
+      },
+    };
+
+    await this.handleMessage(incomingMessage);
+  }
+
+  async stop(): Promise<void> {
+    if (this.signalCli) {
+      this.signalCli.kill("SIGTERM");
+      this.running = false;
+      this.log.info("Signal channel stopped");
+    }
+  }
+
+  async send(sessionId: string, message: OutboundMessage): Promise<void> {
+    const content = message.content ?? "";
+
+    if (!content || content.trim().length === 0) {
+      this.log.warn("Empty response, skipping send");
+      return;
+    }
+
+    const phoneNumber = this.chatIdCache.get(sessionId) ?? this.extractPhoneFromSession(sessionId);
+
+    if (!phoneNumber) {
+      throw new Error(`Cannot determine phone number for session: ${sessionId}`);
+    }
+
+    await this.sendDirectMessage(phoneNumber, content);
+  }
+
+  private async sendDirectMessage(phoneNumber: string, content: string): Promise<void> {
+    const chunks = this.chunkMessage(content, 2000);
+
+    for (const chunk of chunks) {
+      await this.executeCli([
+        "send",
+        "-a", this.config.phoneNumber,
+        "-m", chunk,
+        phoneNumber,
+      ]);
+
+      if (chunks.length > 1) {
+        await new Promise((resolve) => setTimeout(resolve, 500));
+      }
+    }
+  }
+
+  private async executeCli(args: string[]): Promise<string> {
+    return new Promise((resolve, reject) => {
+      const signalCliPath = this.config.signalCliPath ?? "signal-cli";
+      const fullArgs = this.config.dataDir
+        ? ["--config", this.config.dataDir, ...args]
+        : args;
+
+      const proc = spawn(signalCliPath, fullArgs, {
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+
+      let stdout = "";
+      let stderr = "";
+
+      proc.stdout?.on("data", (data: Buffer) => {
+        stdout += data.toString();
+      });
+
+      proc.stderr?.on("data", (data: Buffer) => {
+        stderr += data.toString();
+      });
+
+      proc.on("close", (code) => {
+        if (code === 0) {
+          resolve(stdout);
+        } else {
+          reject(new Error(`signal-cli failed: ${stderr || stdout}`));
+        }
+      });
+
+      proc.on("error", (error) => {
+        reject(error);
+      });
+    });
+  }
+
+  private extractPhoneFromSession(sessionId: string): string | undefined {
+    const parts = sessionId.split(":");
+    return parts[4];
+  }
+
+  private chunkMessage(content: string, maxLength: number): string[] {
+    const chunks: string[] = [];
+    let remaining = content;
+
+    while (remaining.length > 0) {
+      if (remaining.length <= maxLength) {
+        chunks.push(remaining);
+        break;
+      }
+
+      let splitPoint = remaining.lastIndexOf("\n\n", maxLength);
+      if (splitPoint === -1 || splitPoint < maxLength * 0.5) {
+        splitPoint = remaining.lastIndexOf("\n", maxLength);
+      }
+      if (splitPoint === -1 || splitPoint < maxLength * 0.5) {
+        splitPoint = remaining.lastIndexOf(" ", maxLength);
+      }
+      if (splitPoint === -1 || splitPoint < maxLength * 0.5) {
+        splitPoint = maxLength;
+      }
+
+      chunks.push(remaining.slice(0, splitPoint));
+      remaining = remaining.slice(splitPoint).trim();
+    }
+
+    return chunks;
+  }
+}
+
+export function createSignalChannel(accountId: string, config: SignalConfig): SignalChannel {
+  return new SignalChannel(accountId, config);
+}