@kodelyth/googlechat 2026.5.39 → 2026.5.42

package/src/monitor.webhook-routing.test.ts

@@ -0,0 +1,257 @@
+import { EventEmitter } from "node:events";
+import type { IncomingMessage } from "node:http";
+import {
+  createEmptyPluginRegistry,
+  setActivePluginRegistry,
+} from "klaw/plugin-sdk/plugin-test-runtime";
+import { createMockServerResponse } from "klaw/plugin-sdk/test-env";
+import { afterAll, afterEach, describe, expect, it, vi } from "vitest";
+import type { KlawConfig, PluginRuntime } from "../runtime-api.js";
+import type { ResolvedGoogleChatAccount } from "./accounts.js";
+import { verifyGoogleChatRequest } from "./auth.js";
+import {
+  handleGoogleChatWebhookRequest,
+  registerGoogleChatWebhookTarget,
+} from "./monitor-routing.js";
+
+vi.mock("./auth.js", () => ({
+  verifyGoogleChatRequest: vi.fn(),
+}));
+
+function createWebhookRequest(params: {
+  authorization?: string;
+  payload: unknown;
+  path?: string;
+}): IncomingMessage {
+  const req = new EventEmitter() as IncomingMessage & {
+    destroyed?: boolean;
+    destroy: (error?: Error) => IncomingMessage;
+    on: (event: string, listener: (...args: unknown[]) => void) => IncomingMessage;
+  };
+  req.method = "POST";
+  req.url = params.path ?? "/googlechat";
+  req.headers = {
+    authorization: params.authorization ?? "",
+    "content-type": "application/json",
+  };
+  req.destroyed = false;
+  (req as unknown as { socket: { remoteAddress: string } }).socket = {
+    remoteAddress: "127.0.0.1",
+  };
+  req.destroy = () => {
+    req.destroyed = true;
+    return req;
+  };
+
+  const originalOn = req.on.bind(req);
+  let bodyScheduled = false;
+  req.on = ((event: string, listener: (...args: unknown[]) => void) => {
+    const result = originalOn(event, listener);
+    if (!bodyScheduled && event === "data") {
+      bodyScheduled = true;
+      void Promise.resolve().then(() => {
+        req.emit("data", Buffer.from(JSON.stringify(params.payload), "utf-8"));
+        if (!req.destroyed) {
+          req.emit("end");
+        }
+      });
+    }
+    return result;
+  }) as IncomingMessage["on"];
+
+  return req;
+}
+
+function createHeaderOnlyWebhookRequest(params: {
+  authorization?: string;
+  path?: string;
+}): IncomingMessage {
+  const req = new EventEmitter() as IncomingMessage;
+  req.method = "POST";
+  req.url = params.path ?? "/googlechat";
+  req.headers = {
+    authorization: params.authorization ?? "",
+    "content-type": "application/json",
+  };
+  (req as unknown as { socket: { remoteAddress: string } }).socket = {
+    remoteAddress: "127.0.0.1",
+  };
+  return req;
+}
+
+const baseAccount = (accountId: string) =>
+  ({
+    accountId,
+    enabled: true,
+    credentialSource: "none",
+    config: {},
+  }) as ResolvedGoogleChatAccount;
+
+function registerTwoTargets() {
+  const sinkA = vi.fn();
+  const sinkB = vi.fn();
+  const logA = vi.fn();
+  const logB = vi.fn();
+  const core = {} as PluginRuntime;
+  const config = {} as KlawConfig;
+
+  const unregisterA = registerGoogleChatWebhookTarget({
+    account: baseAccount("A"),
+    config,
+    runtime: { log: logA },
+    core,
+    path: "/googlechat",
+    statusSink: sinkA,
+    mediaMaxMb: 5,
+  });
+  const unregisterB = registerGoogleChatWebhookTarget({
+    account: baseAccount("B"),
+    config,
+    runtime: { log: logB },
+    core,
+    path: "/googlechat",
+    statusSink: sinkB,
+    mediaMaxMb: 5,
+  });
+
+  return {
+    logA,
+    logB,
+    sinkA,
+    sinkB,
+    unregister: () => {
+      unregisterA();
+      unregisterB();
+    },
+  };
+}
+
+async function dispatchWebhookRequest(req: IncomingMessage) {
+  const res = createMockServerResponse();
+  const handled = await handleGoogleChatWebhookRequest(req, res);
+  expect(handled).toBe(true);
+  return res;
+}
+
+async function expectVerifiedRoute(params: {
+  request: IncomingMessage;
+  expectedStatus: number;
+  sinkA: ReturnType<typeof vi.fn>;
+  sinkB: ReturnType<typeof vi.fn>;
+  expectedSink: "none" | "A" | "B";
+}) {
+  const res = await dispatchWebhookRequest(params.request);
+  expect(res.statusCode).toBe(params.expectedStatus);
+  const expectedCounts =
+    params.expectedSink === "A" ? [1, 0] : params.expectedSink === "B" ? [0, 1] : [0, 0];
+  expect(params.sinkA).toHaveBeenCalledTimes(expectedCounts[0]);
+  expect(params.sinkB).toHaveBeenCalledTimes(expectedCounts[1]);
+}
+
+function mockSecondVerifierSuccess() {
+  vi.mocked(verifyGoogleChatRequest)
+    .mockResolvedValueOnce({ ok: false, reason: "invalid" })
+    .mockResolvedValueOnce({ ok: true });
+}
+
+describe("Google Chat webhook routing", () => {
+  afterEach(() => {
+    setActivePluginRegistry(createEmptyPluginRegistry());
+  });
+
+  afterAll(() => {
+    vi.doUnmock("./auth.js");
+    vi.resetModules();
+  });
+
+  it("rejects ambiguous routing when multiple targets on the same path verify successfully", async () => {
+    vi.mocked(verifyGoogleChatRequest).mockResolvedValue({ ok: true });
+
+    const { sinkA, sinkB, unregister } = registerTwoTargets();
+
+    try {
+      await expectVerifiedRoute({
+        request: createWebhookRequest({
+          authorization: "Bearer test-token",
+          payload: { type: "ADDED_TO_SPACE", space: { name: "spaces/AAA" } },
+        }),
+        expectedStatus: 401,
+        sinkA,
+        sinkB,
+        expectedSink: "none",
+      });
+    } finally {
+      unregister();
+    }
+  });
+
+  it("routes to the single verified target when earlier targets fail verification", async () => {
+    mockSecondVerifierSuccess();
+
+    const { logA, logB, sinkA, sinkB, unregister } = registerTwoTargets();
+
+    try {
+      await expectVerifiedRoute({
+        request: createWebhookRequest({
+          authorization: "Bearer test-token",
+          payload: { type: "ADDED_TO_SPACE", space: { name: "spaces/BBB" } },
+        }),
+        expectedStatus: 200,
+        sinkA,
+        sinkB,
+        expectedSink: "B",
+      });
+      expect(logA).not.toHaveBeenCalled();
+      expect(logB).not.toHaveBeenCalled();
+    } finally {
+      unregister();
+    }
+  });
+
+  it("rejects invalid bearer before attempting to read the body", async () => {
+    vi.mocked(verifyGoogleChatRequest).mockResolvedValue({ ok: false, reason: "invalid" });
+    const { unregister } = registerTwoTargets();
+
+    try {
+      const req = createHeaderOnlyWebhookRequest({
+        authorization: "Bearer invalid-token",
+      });
+      const onSpy = vi.spyOn(req, "on");
+      const res = await dispatchWebhookRequest(req);
+      expect(res.statusCode).toBe(401);
+      expect(onSpy.mock.calls.map(([event]) => event)).not.toContain("data");
+    } finally {
+      unregister();
+    }
+  });
+
+  it("supports add-on requests that provide systemIdToken in the body", async () => {
+    mockSecondVerifierSuccess();
+    const { sinkA, sinkB, unregister } = registerTwoTargets();
+
+    try {
+      await expectVerifiedRoute({
+        request: createWebhookRequest({
+          payload: {
+            commonEventObject: { hostApp: "CHAT" },
+            authorizationEventObject: { systemIdToken: "addon-token" },
+            chat: {
+              eventTime: "2026-03-02T00:00:00.000Z",
+              user: { name: "users/12345", displayName: "Test User" },
+              messagePayload: {
+                space: { name: "spaces/AAA" },
+                message: { text: "Hello from add-on" },
+              },
+            },
+          },
+        }),
+        expectedStatus: 200,
+        sinkA,
+        sinkB,
+        expectedSink: "B",
+      });
+    } finally {
+      unregister();
+    }
+  });
+});

package/src/runtime.ts

@@ -0,0 +1,9 @@
+import { createPluginRuntimeStore } from "klaw/plugin-sdk/runtime-store";
+import type { PluginRuntime } from "klaw/plugin-sdk/runtime-store";
+
+const { setRuntime: setGoogleChatRuntime, getRuntime: getGoogleChatRuntime } =
+  createPluginRuntimeStore<PluginRuntime>({
+    pluginId: "googlechat",
+    errorMessage: "Google Chat runtime not initialized",
+  });
+export { getGoogleChatRuntime, setGoogleChatRuntime };

package/src/secret-contract.test.ts

@@ -0,0 +1,60 @@
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import {
+  applyResolvedAssignments,
+  createResolverContext,
+  resolveSecretRefValues,
+} from "klaw/plugin-sdk/secret-ref-runtime";
+import { describe, expect, it } from "vitest";
+import { collectRuntimeConfigAssignments } from "./secret-contract.js";
+
+describe("googlechat secret contract", () => {
+  it("resolves account serviceAccount SecretRefs for enabled accounts", async () => {
+    const sourceConfig = {
+      channels: {
+        googlechat: {
+          enabled: true,
+          accounts: {
+            work: {
+              enabled: true,
+              serviceAccountRef: {
+                source: "env",
+                provider: "default",
+                id: "GOOGLECHAT_SERVICE_ACCOUNT",
+              },
+            },
+          },
+        },
+      },
+    } satisfies KlawConfig;
+    const resolvedConfig: KlawConfig = structuredClone(sourceConfig);
+    const context = createResolverContext({
+      sourceConfig,
+      env: {
+        GOOGLECHAT_SERVICE_ACCOUNT: '{"client_email":"bot@example.com"}',
+      },
+    });
+
+    collectRuntimeConfigAssignments({
+      config: resolvedConfig,
+      defaults: undefined,
+      context,
+    });
+
+    const resolved = await resolveSecretRefValues(
+      context.assignments.map((assignment) => assignment.ref),
+      {
+        config: sourceConfig,
+        env: context.env,
+        cache: context.cache,
+      },
+    );
+    applyResolvedAssignments({
+      assignments: context.assignments,
+      resolved,
+    });
+
+    const workAccount = resolvedConfig.channels?.googlechat?.accounts?.work;
+    expect(workAccount?.serviceAccount).toBe('{"client_email":"bot@example.com"}');
+    expect(context.warnings).toStrictEqual([]);
+  });
+});

package/src/secret-contract.ts

@@ -0,0 +1,161 @@
+import {
+  getChannelSurface,
+  hasOwnProperty,
+  pushAssignment,
+  pushInactiveSurfaceWarning,
+  pushWarning,
+  resolveChannelAccountSurface,
+  type ResolverContext,
+  type SecretDefaults,
+} from "klaw/plugin-sdk/channel-secret-basic-runtime";
+import { coerceSecretRef } from "klaw/plugin-sdk/secret-ref-runtime";
+
+type GoogleChatAccountLike = {
+  serviceAccount?: unknown;
+  serviceAccountRef?: unknown;
+  accounts?: Record<string, unknown>;
+};
+
+export const secretTargetRegistryEntries: import("klaw/plugin-sdk/channel-secret-basic-runtime").SecretTargetRegistryEntry[] =
+  [
+    {
+      id: "channels.googlechat.accounts.*.serviceAccount",
+      targetType: "channels.googlechat.serviceAccount",
+      targetTypeAliases: ["channels.googlechat.accounts.*.serviceAccount"],
+      configFile: "klaw.json",
+      pathPattern: "channels.googlechat.accounts.*.serviceAccount",
+      refPathPattern: "channels.googlechat.accounts.*.serviceAccountRef",
+      secretShape: "sibling_ref",
+      expectedResolvedValue: "string-or-object",
+      includeInPlan: true,
+      includeInConfigure: true,
+      includeInAudit: true,
+      accountIdPathSegmentIndex: 3,
+    },
+    {
+      id: "channels.googlechat.serviceAccount",
+      targetType: "channels.googlechat.serviceAccount",
+      configFile: "klaw.json",
+      pathPattern: "channels.googlechat.serviceAccount",
+      refPathPattern: "channels.googlechat.serviceAccountRef",
+      secretShape: "sibling_ref",
+      expectedResolvedValue: "string-or-object",
+      includeInPlan: true,
+      includeInConfigure: true,
+      includeInAudit: true,
+    },
+  ];
+
+function resolveSecretInputRef(params: {
+  value: unknown;
+  refValue?: unknown;
+  defaults?: SecretDefaults;
+}) {
+  const explicitRef = coerceSecretRef(params.refValue, params.defaults);
+  const inlineRef = explicitRef ? null : coerceSecretRef(params.value, params.defaults);
+  return {
+    explicitRef,
+    inlineRef,
+    ref: explicitRef ?? inlineRef,
+  };
+}
+
+function collectGoogleChatAccountAssignment(params: {
+  target: GoogleChatAccountLike;
+  path: string;
+  defaults?: SecretDefaults;
+  context: ResolverContext;
+  active?: boolean;
+  inactiveReason?: string;
+}): void {
+  const { explicitRef, ref } = resolveSecretInputRef({
+    value: params.target.serviceAccount,
+    refValue: params.target.serviceAccountRef,
+    defaults: params.defaults,
+  });
+  if (!ref) {
+    return;
+  }
+  if (params.active === false) {
+    pushInactiveSurfaceWarning({
+      context: params.context,
+      path: `${params.path}.serviceAccount`,
+      details: params.inactiveReason,
+    });
+    return;
+  }
+  if (
+    explicitRef &&
+    params.target.serviceAccount !== undefined &&
+    !coerceSecretRef(params.target.serviceAccount, params.defaults)
+  ) {
+    pushWarning(params.context, {
+      code: "SECRETS_REF_OVERRIDES_PLAINTEXT",
+      path: params.path,
+      message: `${params.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`,
+    });
+  }
+  pushAssignment(params.context, {
+    ref,
+    path: `${params.path}.serviceAccount`,
+    expected: "string-or-object",
+    apply: (value) => {
+      params.target.serviceAccount = value;
+    },
+  });
+}
+
+export function collectRuntimeConfigAssignments(params: {
+  config: { channels?: Record<string, unknown> };
+  defaults?: SecretDefaults;
+  context: ResolverContext;
+}): void {
+  const resolved = getChannelSurface(params.config, "googlechat");
+  if (!resolved) {
+    return;
+  }
+  const googleChat = resolved.channel as GoogleChatAccountLike;
+  const surface = resolveChannelAccountSurface(googleChat as Record<string, unknown>);
+  const topLevelServiceAccountActive = !surface.channelEnabled
+    ? false
+    : !surface.hasExplicitAccounts
+      ? true
+      : surface.accounts.some(
+          ({ account, enabled }) =>
+            enabled &&
+            !hasOwnProperty(account, "serviceAccount") &&
+            !hasOwnProperty(account, "serviceAccountRef"),
+        );
+  collectGoogleChatAccountAssignment({
+    target: googleChat,
+    path: "channels.googlechat",
+    defaults: params.defaults,
+    context: params.context,
+    active: topLevelServiceAccountActive,
+    inactiveReason: "no enabled account inherits this top-level Google Chat serviceAccount.",
+  });
+  if (!surface.hasExplicitAccounts) {
+    return;
+  }
+  for (const { accountId, account, enabled } of surface.accounts) {
+    if (
+      !hasOwnProperty(account, "serviceAccount") &&
+      !hasOwnProperty(account, "serviceAccountRef")
+    ) {
+      continue;
+    }
+    collectGoogleChatAccountAssignment({
+      target: account as GoogleChatAccountLike,
+      path: `channels.googlechat.accounts.${accountId}`,
+      defaults: params.defaults,
+      context: params.context,
+      active: enabled,
+      inactiveReason: "Google Chat account is disabled.",
+    });
+  }
+}
+
+export const channelSecrets = {
+  secretTargetRegistryEntries,
+  collectRuntimeConfigAssignments,
+};

package/src/setup-core.ts

@@ -0,0 +1,40 @@
+import {
+  createPatchedAccountSetupAdapter,
+  createSetupInputPresenceValidator,
+} from "klaw/plugin-sdk/setup-runtime";
+
+const channel = "googlechat" as const;
+
+export const googlechatSetupAdapter = createPatchedAccountSetupAdapter({
+  channelKey: channel,
+  validateInput: createSetupInputPresenceValidator({
+    defaultAccountOnlyEnvError:
+      "GOOGLE_CHAT_SERVICE_ACCOUNT env vars can only be used for the default account.",
+    whenNotUseEnv: [
+      {
+        someOf: ["token", "tokenFile"],
+        message: "Google Chat requires --token (service account JSON) or --token-file.",
+      },
+    ],
+  }),
+  buildPatch: (input) => {
+    const patch = input.useEnv
+      ? {}
+      : input.tokenFile
+        ? { serviceAccountFile: input.tokenFile }
+        : input.token
+          ? { serviceAccount: input.token }
+          : {};
+    const audienceType = input.audienceType?.trim();
+    const audience = input.audience?.trim();
+    const webhookPath = input.webhookPath?.trim();
+    const webhookUrl = input.webhookUrl?.trim();
+    return {
+      ...patch,
+      ...(audienceType ? { audienceType } : {}),
+      ...(audience ? { audience } : {}),
+      ...(webhookPath ? { webhookPath } : {}),
+      ...(webhookUrl ? { webhookUrl } : {}),
+    };
+  },
+});