@netcat-ai/openclaw-weixin 2.4.7

package/src/cdn/cdn-url.ts

@@ -0,0 +1,20 @@
+/**
+ * Unified CDN URL construction for Weixin CDN upload/download.
+ */
+
+/** 设为 true 时，当服务端未返回 full_url 字段，回退到客户端拼接 URL；false 则直接报错。 */
+export const ENABLE_CDN_URL_FALLBACK = true;
+
+/** Build a CDN download URL from encrypt_query_param. */
+export function buildCdnDownloadUrl(encryptedQueryParam: string, cdnBaseUrl: string): string {
+  return `${cdnBaseUrl}/download?encrypted_query_param=${encodeURIComponent(encryptedQueryParam)}`;
+}
+
+/** Build a CDN upload URL from upload_param and filekey. */
+export function buildCdnUploadUrl(params: {
+  cdnBaseUrl: string;
+  uploadParam: string;
+  filekey: string;
+}): string {
+  return `${params.cdnBaseUrl}/upload?encrypted_query_param=${encodeURIComponent(params.uploadParam)}&filekey=${encodeURIComponent(params.filekey)}`;
+}

package/src/cdn/pic-decrypt.ts

@@ -0,0 +1,101 @@
+import { decryptAesEcb } from "./aes-ecb.js";
+import { buildCdnDownloadUrl, ENABLE_CDN_URL_FALLBACK } from "./cdn-url.js";
+import { logger } from "../util/logger.js";
+
+/**
+ * Download raw bytes from the CDN (no decryption).
+ */
+async function fetchCdnBytes(url: string, label: string): Promise<Buffer> {
+  let res: Response;
+  try {
+    res = await fetch(url);
+  } catch (err) {
+    const cause =
+      (err as NodeJS.ErrnoException).cause ?? (err as NodeJS.ErrnoException).code ?? "(no cause)";
+    logger.error(
+      `${label}: fetch network error url=${url} err=${String(err)} cause=${String(cause)}`,
+    );
+    throw err;
+  }
+  logger.debug(`${label}: response status=${res.status} ok=${res.ok}`);
+  if (!res.ok) {
+    const body = await res.text().catch(() => "(unreadable)");
+    const msg = `${label}: CDN download ${res.status} ${res.statusText} body=${body}`;
+    logger.error(msg);
+    throw new Error(msg);
+  }
+  return Buffer.from(await res.arrayBuffer());
+}
+
+/**
+ * Parse CDNMedia.aes_key into a raw 16-byte AES key.
+ *
+ * Two encodings are seen in the wild:
+ *   - base64(raw 16 bytes)          → images (aes_key from media field)
+ *   - base64(hex string of 16 bytes) → file / voice / video
+ *
+ * In the second case, base64-decoding yields 32 ASCII hex chars which must
+ * then be parsed as hex to recover the actual 16-byte key.
+ */
+function parseAesKey(aesKeyBase64: string, label: string): Buffer {
+  const decoded = Buffer.from(aesKeyBase64, "base64");
+  if (decoded.length === 16) {
+    return decoded;
+  }
+  if (decoded.length === 32 && /^[0-9a-fA-F]{32}$/.test(decoded.toString("ascii"))) {
+    // hex-encoded key: base64 → hex string → raw bytes
+    return Buffer.from(decoded.toString("ascii"), "hex");
+  }
+  const msg = `${label}: aes_key must decode to 16 raw bytes or 32-char hex string, got ${decoded.length} bytes (base64="${aesKeyBase64}")`;
+  logger.error(msg);
+  throw new Error(msg);
+}
+
+/**
+ * Download and AES-128-ECB decrypt a CDN media file. Returns plaintext Buffer.
+ * aesKeyBase64: CDNMedia.aes_key JSON field (see parseAesKey for supported formats).
+ */
+export async function downloadAndDecryptBuffer(
+  encryptedQueryParam: string,
+  aesKeyBase64: string,
+  cdnBaseUrl: string,
+  label: string,
+  fullUrl?: string,
+): Promise<Buffer> {
+  const key = parseAesKey(aesKeyBase64, label);
+  let url: string;
+  if (fullUrl) {
+    url = fullUrl;
+  } else if (ENABLE_CDN_URL_FALLBACK) {
+    url = buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl);
+  } else {
+    throw new Error(`${label}: fullUrl is required (CDN URL fallback is disabled)`);
+  }
+  logger.debug(`${label}: fetching url=${url}`);
+  const encrypted = await fetchCdnBytes(url, label);
+  logger.debug(`${label}: downloaded ${encrypted.byteLength} bytes, decrypting`);
+  const decrypted = decryptAesEcb(encrypted, key);
+  logger.debug(`${label}: decrypted ${decrypted.length} bytes`);
+  return decrypted;
+}
+
+/**
+ * Download plain (unencrypted) bytes from the CDN. Returns the raw Buffer.
+ */
+export async function downloadPlainCdnBuffer(
+  encryptedQueryParam: string,
+  cdnBaseUrl: string,
+  label: string,
+  fullUrl?: string,
+): Promise<Buffer> {
+  let url: string;
+  if (fullUrl) {
+    url = fullUrl;
+  } else if (ENABLE_CDN_URL_FALLBACK) {
+    url = buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl);
+  } else {
+    throw new Error(`${label}: fullUrl is required (CDN URL fallback is disabled)`);
+  }
+  logger.debug(`${label}: fetching url=${url}`);
+  return fetchCdnBytes(url, label);
+}

package/src/cdn/upload.ts

@@ -0,0 +1,168 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+import { getUploadUrl } from "../api/api.js";
+import type { WeixinApiOptions } from "../api/api.js";
+import { aesEcbPaddedSize } from "./aes-ecb.js";
+import { uploadBufferToCdn } from "./cdn-upload.js";
+import { logger } from "../util/logger.js";
+import { redactUrl } from "../util/redact.js";
+import { getExtensionFromContentTypeOrUrl } from "../media/mime.js";
+import { tempFileName } from "../util/random.js";
+import { UploadMediaType } from "../api/types.js";
+
+export type UploadedFileInfo = {
+  filekey: string;
+  /** 由 upload_param 上传后 CDN 返回的下载加密参数; fill into ImageItem.media.encrypt_query_param */
+  downloadEncryptedQueryParam: string;
+  /** AES-128-ECB key, hex-encoded; convert to base64 for CDNMedia.aes_key */
+  aeskey: string;
+  /** Plaintext file size in bytes */
+  fileSize: number;
+  /** Ciphertext file size in bytes (AES-128-ECB with PKCS7 padding); use for ImageItem.hd_size / mid_size */
+  fileSizeCiphertext: number;
+};
+
+/**
+ * Download a remote media URL (image, video, file) to a local temp file in destDir.
+ * Returns the local file path; extension is inferred from Content-Type / URL.
+ */
+export async function downloadRemoteImageToTemp(url: string, destDir: string): Promise<string> {
+  logger.debug(`downloadRemoteImageToTemp: fetching url=${redactUrl(url)}`);
+  let res: Response;
+  try {
+    res = await fetch(url);
+  } catch (err) {
+    const cause =
+      (err as NodeJS.ErrnoException).cause ?? (err as NodeJS.ErrnoException).code ?? "";
+    logger.error(
+      `downloadRemoteImageToTemp: fetch network error url=${redactUrl(url)} error=${String(err)}${cause ? ` cause=${cause}` : ""}`,
+    );
+    throw err;
+  }
+  if (!res.ok) {
+    const msg = `remote media download failed: ${res.status} ${res.statusText} url=${redactUrl(url)}`;
+    logger.error(`downloadRemoteImageToTemp: ${msg}`);
+    throw new Error(msg);
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  logger.debug(`downloadRemoteImageToTemp: downloaded ${buf.length} bytes`);
+  await fs.mkdir(destDir, { recursive: true });
+  const ext = getExtensionFromContentTypeOrUrl(res.headers.get("content-type"), url);
+  const name = tempFileName("weixin-remote", ext);
+  const filePath = path.join(destDir, name);
+  await fs.writeFile(filePath, buf);
+  logger.debug(`downloadRemoteImageToTemp: saved to ${filePath} ext=${ext}`);
+  return filePath;
+}
+
+/**
+ * Common upload pipeline: read file → hash → gen aeskey → getUploadUrl → uploadBufferToCdn → return info.
+ */
+async function uploadMediaToCdn(params: {
+  filePath: string;
+  toUserId: string;
+  opts: WeixinApiOptions;
+  cdnBaseUrl: string;
+  mediaType: (typeof UploadMediaType)[keyof typeof UploadMediaType];
+  label: string;
+}): Promise<UploadedFileInfo> {
+  const { filePath, toUserId, opts, cdnBaseUrl, mediaType, label } = params;
+
+  const plaintext = await fs.readFile(filePath);
+  const rawsize = plaintext.length;
+  const rawfilemd5 = crypto.createHash("md5").update(plaintext).digest("hex");
+  const filesize = aesEcbPaddedSize(rawsize);
+  const filekey = crypto.randomBytes(16).toString("hex");
+  const aeskey = crypto.randomBytes(16);
+
+  logger.debug(
+    `${label}: file=${filePath} rawsize=${rawsize} filesize=${filesize} md5=${rawfilemd5} filekey=${filekey}`,
+  );
+
+  const uploadUrlResp = await getUploadUrl({
+    ...opts,
+    filekey,
+    media_type: mediaType,
+    to_user_id: toUserId,
+    rawsize,
+    rawfilemd5,
+    filesize,
+    no_need_thumb: true,
+    aeskey: aeskey.toString("hex"),
+  });
+
+  const uploadFullUrl = uploadUrlResp.upload_full_url?.trim();
+  const uploadParam = uploadUrlResp.upload_param;
+  if (!uploadFullUrl && !uploadParam) {
+    logger.error(
+      `${label}: getUploadUrl returned no upload URL (need upload_full_url or upload_param), resp=${JSON.stringify(uploadUrlResp)}`,
+    );
+    throw new Error(`${label}: getUploadUrl returned no upload URL`);
+  }
+
+  const { downloadParam: downloadEncryptedQueryParam } = await uploadBufferToCdn({
+    buf: plaintext,
+    uploadFullUrl: uploadFullUrl || undefined,
+    uploadParam: uploadParam ?? undefined,
+    filekey,
+    cdnBaseUrl,
+    aeskey,
+    label: `${label}[orig filekey=${filekey}]`,
+  });
+
+  return {
+    filekey,
+    downloadEncryptedQueryParam,
+    aeskey: aeskey.toString("hex"),
+    fileSize: rawsize,
+    fileSizeCiphertext: filesize,
+  };
+}
+
+/** Upload a local image file to the Weixin CDN with AES-128-ECB encryption. */
+export async function uploadFileToWeixin(params: {
+  filePath: string;
+  toUserId: string;
+  opts: WeixinApiOptions;
+  cdnBaseUrl: string;
+}): Promise<UploadedFileInfo> {
+  return uploadMediaToCdn({
+    ...params,
+    mediaType: UploadMediaType.IMAGE,
+    label: "uploadFileToWeixin",
+  });
+}
+
+/** Upload a local video file to the Weixin CDN. */
+export async function uploadVideoToWeixin(params: {
+  filePath: string;
+  toUserId: string;
+  opts: WeixinApiOptions;
+  cdnBaseUrl: string;
+}): Promise<UploadedFileInfo> {
+  return uploadMediaToCdn({
+    ...params,
+    mediaType: UploadMediaType.VIDEO,
+    label: "uploadVideoToWeixin",
+  });
+}
+
+/**
+ * Upload a local file attachment (non-image, non-video) to the Weixin CDN.
+ * Uses media_type=FILE; no thumbnail required.
+ */
+export async function uploadFileAttachmentToWeixin(params: {
+  filePath: string;
+  fileName: string;
+  toUserId: string;
+  opts: WeixinApiOptions;
+  cdnBaseUrl: string;
+}): Promise<UploadedFileInfo> {
+  return uploadMediaToCdn({
+    ...params,
+    mediaType: UploadMediaType.FILE,
+    label: "uploadFileAttachmentToWeixin",
+  });
+}