@openclaw/crabline 0.1.10 → 0.1.12

package/dist/src/servers/zalo.js

@@ -6,7 +6,9 @@ import { recordServerEvent } from "./recorder.js";
 import { resolveMaxPendingInboundEvents } from "./pending-events.js";
 import { postWebhookRequest, validateWebhookTarget, } from "./webhook-target.js";
 const DEFAULT_WEBHOOK_DELIVERY_TIMEOUT_MS = 5_000;
+const DEFAULT_MAX_PENDING_INBOUND_BYTES = 64 * 1024 * 1024;
 const MAX_ACTIVE_ZALO_WEBHOOK_VALIDATIONS = 8;
+const MAX_ZALO_REDACTION_DEPTH = 32;
 const MAX_WEBHOOK_DELIVERY_TIMEOUT_MS = 30_000;
 const MAX_ZALO_WEBHOOK_SECRET_BYTES = 256;
 async function appendEvent(state, event) {
@@ -56,22 +58,39 @@ const SENSITIVE_PARAM_NAMES = new Set([
     "webhooksecret",
 ]);
 function isSensitiveParam(name) {
-    const canonicalName = name
-        .normalize("NFKC")
-        .replace(/[^A-Za-z0-9]/gu, "")
-        .toLowerCase();
+    const normalizedName = name.normalize("NFKC");
+    const canonicalName = normalizedName.replace(/[^A-Za-z0-9]/gu, "").toLowerCase();
     return (SENSITIVE_PARAM_NAMES.has(canonicalName) ||
-        /(?:^|[_-])(?:access[_-]?token|api[_-]?key|authorization|key|password|secret|signature|token)(?:$|[_-])/iu.test(name));
-}
-function redactParams(params) {
-    return Object.fromEntries(Object.entries(params).map(([key, value]) => [
-        key,
-        isSensitiveParam(key)
-            ? "<redacted>"
-            : key === "url" && typeof value === "string"
-                ? redactUrlCredentials(value)
-                : value,
-    ]));
+        /[a-z0-9](?:credentials?|keys?|passwords?|passwds?|secrets?|signatures?|tokens?)$/u.test(canonicalName) ||
+        /(?:^|[_-])(?:access[_-]?token|api[_-]?key|authorization|key|password|secret|signature|token)(?:$|[_-])/iu.test(normalizedName));
+}
+function isUrlParam(name) {
+    return /(?:urls?|uris?)$/iu.test(name.normalize("NFKC").replace(/[^A-Za-z0-9]/gu, ""));
+}
+function redactParamValue(value, key, depth) {
+    if (isSensitiveParam(key)) {
+        return "<redacted>";
+    }
+    if (Array.isArray(value)) {
+        if (depth >= MAX_ZALO_REDACTION_DEPTH) {
+            return "<redacted>";
+        }
+        return value.map((entry) => redactParamValue(entry, key, depth + 1));
+    }
+    if (isJsonObject(value)) {
+        if (depth >= MAX_ZALO_REDACTION_DEPTH) {
+            return "<redacted>";
+        }
+        return redactParams(value, depth + 1);
+    }
+    if (typeof value === "string" &&
+        (isUrlParam(key) || /^(?:\s*[a-z][a-z0-9+.-]*:)?\/\//iu.test(value))) {
+        return redactUrlCredentials(value);
+    }
+    return value;
+}
+function redactParams(params, depth = 0) {
+    return Object.fromEntries(Object.entries(params).map(([key, value]) => [key, redactParamValue(value, key, depth)]));
 }
 function redactSensitiveSearchParams(searchParams) {
     let redacted = false;
@@ -83,20 +102,28 @@ function redactSensitiveSearchParams(searchParams) {
     }
     return redacted;
 }
+function redactUrlFragment(value) {
+    const fragmentStart = value.indexOf("#");
+    return fragmentStart < 0 ? value : `${value.slice(0, fragmentStart)}#<redacted>`;
+}
 function redactMalformedUrlCredentials(value) {
     const credentialRedacted = value.replace(/^(\s*)((?:[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/iu, "$1$2<redacted>@");
-    const queryStart = credentialRedacted.indexOf("?");
-    const fragmentStart = credentialRedacted.indexOf("#", queryStart + 1);
+    if (credentialRedacted === value) {
+        return "<redacted>";
+    }
+    const fragmentRedacted = redactUrlFragment(credentialRedacted);
+    const queryStart = fragmentRedacted.indexOf("?");
+    const fragmentStart = fragmentRedacted.indexOf("#", queryStart + 1);
     if (queryStart < 0 || (fragmentStart >= 0 && fragmentStart < queryStart)) {
-        return credentialRedacted;
+        return fragmentRedacted;
     }
-    const queryEnd = fragmentStart >= 0 ? fragmentStart : credentialRedacted.length;
-    const searchParams = new URLSearchParams(credentialRedacted.slice(queryStart + 1, queryEnd));
+    const queryEnd = fragmentStart >= 0 ? fragmentStart : fragmentRedacted.length;
+    const searchParams = new URLSearchParams(fragmentRedacted.slice(queryStart + 1, queryEnd));
     if (!redactSensitiveSearchParams(searchParams)) {
-        return credentialRedacted;
+        return fragmentRedacted;
     }
     const search = searchParams.toString().replaceAll("%3Credacted%3E", "<redacted>");
-    return `${credentialRedacted.slice(0, queryStart)}?${search}${credentialRedacted.slice(queryEnd)}`;
+    return `${fragmentRedacted.slice(0, queryStart)}?${search}${fragmentRedacted.slice(queryEnd)}`;
 }
 function redactUrlCredentials(value) {
     let url;
@@ -108,11 +135,12 @@ function redactUrlCredentials(value) {
     }
     const hasCredentials = Boolean(url.username || url.password);
     const redactedQuery = redactSensitiveSearchParams(url.searchParams);
+    const hasFragment = url.hash.length > 0;
     if (!hasCredentials && !redactedQuery) {
-        return value;
+        return hasFragment ? redactUrlFragment(value) : value;
     }
     const search = url.search.replaceAll("%3Credacted%3E", "<redacted>");
-    return `${url.protocol}//${hasCredentials ? "<redacted>@" : ""}${url.host}${url.pathname}${search}${url.hash}`;
+    return `${url.protocol}//${hasCredentials ? "<redacted>@" : ""}${url.host}${url.pathname}${search}${hasFragment ? "#<redacted>" : ""}`;
 }
 function requireParam(body, name) {
     return readTrimmedString(body[name]) ?? zaloError(`${name} is required`, 400);
@@ -126,6 +154,15 @@ function webhookDeliveryTimeoutMs(value) {
     }
     return Math.max(1, Math.min(Math.floor(value), MAX_WEBHOOK_DELIVERY_TIMEOUT_MS));
 }
+function maxPendingInboundBytes(value) {
+    if (value === undefined) {
+        return DEFAULT_MAX_PENDING_INBOUND_BYTES;
+    }
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new Error("maxPendingInboundBytes must be a positive safe integer.");
+    }
+    return value;
+}
 async function validateWebhookUrl(url, state, signal) {
     const target = await validateWebhookTarget({
         allowLoopbackHttp: state.allowLoopbackHttpWebhook,
@@ -222,9 +259,7 @@ function nextUpdate(request, response, state) {
     if (!update) {
         return undefined;
     }
-    const order = pollingUpdateOrder(state, update);
-    if (state.failedUpdateOrders.has(order) &&
-        [...state.reservedUpdateOrders].some((reservedOrder) => reservedOrder < order)) {
+    if (hasEarlierReservedPollingUpdate(state, update)) {
         return undefined;
     }
     state.updates.shift();
@@ -240,6 +275,35 @@ function pollingUpdateOrder(state, update) {
     state.updateOrders.set(update, order);
     return order;
 }
+function pollingUpdateBytes(state, update) {
+    const existing = state.updateBytes.get(update);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const bytes = Buffer.byteLength(JSON.stringify(update), "utf8");
+    state.updateBytes.set(update, bytes);
+    return bytes;
+}
+function retainPollingUpdate(state, update) {
+    const bytes = pollingUpdateBytes(state, update);
+    if (state.retainedUpdateCount >= state.maxPendingInboundEvents ||
+        state.retainedUpdateBytes + bytes > state.maxPendingInboundBytes) {
+        state.updateBytes.delete(update);
+        return false;
+    }
+    state.retainedUpdateCount += 1;
+    state.retainedUpdateBytes += bytes;
+    return true;
+}
+function releasePollingUpdate(state, update) {
+    const bytes = state.updateBytes.get(update);
+    if (bytes === undefined) {
+        throw new Error("Zalo polling update retention was released without a reservation.");
+    }
+    state.updateBytes.delete(update);
+    state.retainedUpdateCount -= 1;
+    state.retainedUpdateBytes -= bytes;
+}
 function queuePollingUpdate(state, update) {
     const order = pollingUpdateOrder(state, update);
     const insertionIndex = state.updates.findIndex((queued) => pollingUpdateOrder(state, queued) > order);
@@ -250,9 +314,12 @@ function queuePollingUpdate(state, update) {
         state.updates.splice(insertionIndex, 0, update);
     }
 }
+function hasEarlierReservedPollingUpdate(state, update) {
+    const order = pollingUpdateOrder(state, update);
+    return [...state.reservedUpdateOrders].some((reservedOrder) => reservedOrder < order);
+}
 function reservePollingUpdate(state, update) {
     const order = pollingUpdateOrder(state, update);
-    state.failedUpdateOrders.delete(order);
     state.reservedUpdateOrders.add(order);
 }
 function flushPendingPollingUpdate(state) {
@@ -265,9 +332,7 @@ function flushPendingPollingUpdate(state) {
         settlePendingUpdate(state, pending, { kind: "disconnect" });
         return;
     }
-    const order = pollingUpdateOrder(state, update);
-    if (state.failedUpdateOrders.has(order) &&
-        [...state.reservedUpdateOrders].some((reservedOrder) => reservedOrder < order)) {
+    if (hasEarlierReservedPollingUpdate(state, update)) {
         return;
     }
     state.updates.shift();
@@ -276,7 +341,7 @@ function flushPendingPollingUpdate(state) {
 }
 function reservedUpdateResponse(state, update) {
     let settled = false;
-    const release = () => {
+    const releaseReservation = () => {
         if (settled) {
             return false;
         }
@@ -286,15 +351,15 @@ function reservedUpdateResponse(state, update) {
     };
     return {
         onWriteFailure() {
-            if (!release()) {
+            if (!releaseReservation()) {
                 return;
             }
-            state.failedUpdateOrders.add(pollingUpdateOrder(state, update));
             queuePollingUpdate(state, update);
             flushPendingPollingUpdate(state);
         },
         onWriteSuccess() {
-            if (release()) {
+            if (releaseReservation()) {
+                releasePollingUpdate(state, update);
                 flushPendingPollingUpdate(state);
             }
         },
@@ -374,28 +439,21 @@ async function waitForUpdate(request, response, state, timeoutSeconds) {
 }
 function deliverPollingUpdate(state, update) {
     pollingUpdateOrder(state, update);
-    if (state.updates.length > 0) {
-        if (state.updates.length + state.reservedUpdateOrders.size >= state.maxPendingInboundEvents) {
-            return false;
-        }
+    if (state.updates.length > 0 || hasEarlierReservedPollingUpdate(state, update)) {
         queuePollingUpdate(state, update);
         flushPendingPollingUpdate(state);
-        return true;
+        return;
     }
     const pending = state.pendingRequest;
     if (pending) {
         if (isPendingUpdateRequestLive(pending)) {
             reservePollingUpdate(state, update);
             settlePendingUpdate(state, pending, { kind: "update", update });
-            return true;
+            return;
         }
         settlePendingUpdate(state, pending, { kind: "disconnect" });
     }
-    if (state.updates.length + state.reservedUpdateOrders.size >= state.maxPendingInboundEvents) {
-        return false;
-    }
     queuePollingUpdate(state, update);
-    return true;
 }
 async function deliverWebhookUpdate(state, webhook, update) {
     const deadlineAt = Date.now() + state.webhookDeliveryTimeoutMs;
@@ -444,28 +502,37 @@ async function handleAdminInbound(request, state, url) {
         drainRequestBody(request);
         return adminAuthError();
     }
-    const parsedBody = await parseUnknownRequestBody(request);
-    if (!isJsonObject(parsedBody)) {
-        return zaloError("Bad Request: can't parse JSON object", 400);
+    if (state.webhookTransitionPending) {
+        drainRequestBody(request);
+        return zaloError("Webhook configuration is in progress", 409);
     }
-    const body = parsedBody;
-    const chatId = requireParam(body, "chatId");
-    const senderId = requireParam(body, "senderId");
-    const text = requireParam(body, "text");
-    if (chatId instanceof Response || senderId instanceof Response || text instanceof Response) {
-        return [chatId, senderId, text].find((value) => value instanceof Response);
+    const retainedUpdates = state.webhook?.url === undefined ? state.retainedUpdateCount : 0;
+    if (retainedUpdates + state.pendingInboundAdmissions >= state.maxPendingInboundEvents) {
+        drainRequestBody(request);
+        return zaloError(`Pending inbound queue is full (${state.maxPendingInboundEvents} updates)`, 429);
     }
+    state.pendingInboundAdmissions += 1;
     let releaseAdmission;
     const previousAdmission = state.inboundAdmission;
     state.inboundAdmission = new Promise((resolve) => {
         releaseAdmission = resolve;
     });
-    await previousAdmission;
+    let admissionPending = true;
+    let retainedPollingUpdate;
     try {
-        if (!state.webhook?.url &&
-            state.updates.length + state.reservedUpdateOrders.size >= state.maxPendingInboundEvents) {
-            return zaloError(`Pending inbound queue is full (${state.maxPendingInboundEvents} updates)`, 429);
-        }
+        const parsedBody = await parseUnknownRequestBody(request);
+        await previousAdmission;
+        if (!isJsonObject(parsedBody)) {
+            return zaloError("Bad Request: can't parse JSON object", 400);
+        }
+        const body = parsedBody;
+        const chatId = requireParam(body, "chatId");
+        const senderId = requireParam(body, "senderId");
+        const text = requireParam(body, "text");
+        if (chatId instanceof Response || senderId instanceof Response || text instanceof Response) {
+            return [chatId, senderId, text].find((value) => value instanceof Response);
+        }
+        const webhook = state.webhook;
         const update = {
             event_name: "message.text.received",
             message: {
@@ -480,27 +547,43 @@ async function handleAdminInbound(request, state, url) {
                 text,
             },
         };
+        if (!webhook?.url) {
+            if (!retainPollingUpdate(state, update)) {
+                return zaloError(`Pending inbound queue is full (${state.maxPendingInboundEvents} updates)`, 429);
+            }
+            retainedPollingUpdate = update;
+            state.pendingInboundAdmissions -= 1;
+            admissionPending = false;
+        }
         await appendEvent(state, {
             at: new Date().toISOString(),
-            body,
+            body: redactParams(body),
             method: request.method ?? "POST",
             path: url.pathname,
-            query: queryRecord(url),
+            query: redactParams(queryRecord(url)),
             type: "admin",
         });
-        if (state.webhook?.url) {
-            const error = await deliverWebhookUpdate(state, state.webhook, update);
+        if (webhook?.url) {
+            const error = await deliverWebhookUpdate(state, webhook, update);
             if (error) {
                 return error;
             }
         }
-        else if (!deliverPollingUpdate(state, update)) {
-            return zaloError(`Pending inbound queue is full (${state.maxPendingInboundEvents} updates)`, 429);
+        else {
+            deliverPollingUpdate(state, update);
+            retainedPollingUpdate = undefined;
         }
         return zaloOk(update);
     }
     finally {
+        if (retainedPollingUpdate) {
+            releasePollingUpdate(state, retainedPollingUpdate);
+        }
+        await previousAdmission;
         releaseAdmission();
+        if (admissionPending) {
+            state.pendingInboundAdmissions -= 1;
+        }
     }
 }
 async function handleZaloMethod(request, response, state, url, method) {
@@ -533,17 +616,22 @@ async function handleZaloMethod(request, response, state, url, method) {
         }
         return sendResponse;
     }
-    await appendEvent(state, event);
     if (method === "getMe") {
-        return zaloOk({
+        const getMeResponse = zaloOk({
             account_name: state.botName,
             account_type: "BASIC",
             can_join_groups: true,
             id: state.botId,
         });
+        event.accepted = getMeResponse.ok;
+        await appendEvent(state, event);
+        return getMeResponse;
+    }
+    if (method !== "setWebhook") {
+        await appendEvent(state, event);
     }
     if (method === "getUpdates") {
-        if (state.webhook?.url) {
+        if (state.webhook?.url || state.webhookTransitionPending) {
             return zaloError("Webhook is configured; delete it before using getUpdates", 400);
         }
         const parsedTimeout = Number(readTrimmedString(body.timeout) ?? "30");
@@ -563,48 +651,66 @@ async function handleZaloMethod(request, response, state, url, method) {
         return zaloOk();
     }
     if (method === "setWebhook") {
+        const reject = async (result) => {
+            if (isJsonObject(event.body) && "url" in event.body) {
+                event.body.url = "<redacted>";
+            }
+            await appendEvent(state, event);
+            return result;
+        };
         const webhookUrl = requireParam(body, "url");
         const secretToken = requireParam(body, "secret_token");
         const error = firstError(webhookUrl, secretToken);
         if (error) {
-            return error;
+            return await reject(error);
         }
         if (typeof webhookUrl !== "string" || typeof secretToken !== "string") {
-            return zaloError("Invalid webhook parameters", 400);
+            return await reject(zaloError("Invalid webhook parameters", 400));
         }
         const secretError = validateZaloWebhookSecret(secretToken);
         if (secretError) {
-            return secretError;
+            return await reject(secretError);
         }
         let parsedUrl;
         try {
             parsedUrl = new URL(webhookUrl);
         }
         catch {
-            return zaloError("url must be a valid HTTPS URL", 400);
+            return await reject(zaloError("url must be a valid HTTPS URL", 400));
         }
         if (state.activeWebhookValidations.size >= MAX_ACTIVE_ZALO_WEBHOOK_VALIDATIONS) {
-            return zaloError("Too many webhook validations", 429);
+            return await reject(zaloError("Too many webhook validations", 429));
         }
         let target;
         try {
             target = await validateWebhookUrlWithDeadline(parsedUrl, state, Date.now() + state.webhookDeliveryTimeoutMs);
         }
         catch {
-            return zaloError("url host could not be resolved", 400);
+            return await reject(zaloError("url host could not be resolved", 400));
         }
         if (target instanceof Response) {
-            return target;
+            return await reject(target);
         }
-        if (state.reservedUpdateOrders.size > 0) {
-            return zaloError("Polling deliveries are still in progress", 409);
+        if (state.webhookTransitionPending || state.reservedUpdateOrders.size > 0) {
+            return await reject(zaloError("Polling deliveries are still in progress", 409));
         }
         const webhook = { secretToken, updatedAt: Date.now(), url: parsedUrl.href };
-        if (state.pendingRequest) {
-            settlePendingUpdate(state, state.pendingRequest, { kind: "conflict" });
+        state.webhookTransitionPending = true;
+        try {
+            await state.inboundAdmission;
+            if (state.reservedUpdateOrders.size > 0) {
+                return await reject(zaloError("Polling deliveries are still in progress", 409));
+            }
+            await appendEvent(state, event);
+            if (state.pendingRequest) {
+                settlePendingUpdate(state, state.pendingRequest, { kind: "conflict" });
+            }
+            state.webhook = webhook;
+            return zaloOk({ updated_at: webhook.updatedAt, url: webhook.url });
+        }
+        finally {
+            state.webhookTransitionPending = false;
         }
-        state.webhook = webhook;
-        return zaloOk({ updated_at: webhook.updatedAt, url: webhook.url });
     }
     if (method === "deleteWebhook") {
         const updatedAt = Date.now();
@@ -628,20 +734,25 @@ export async function startZaloServer(params = {}) {
         botToken: params.botToken ??
             (isLoopbackHost(host) ? "crabline-zalo-bot-token" : randomBytes(32).toString("base64url")),
         closing: false,
-        failedUpdateOrders: new Set(),
         inboundAdmission: Promise.resolve(),
+        maxPendingInboundBytes: maxPendingInboundBytes(params.maxPendingInboundBytes),
         maxPendingInboundEvents: resolveMaxPendingInboundEvents(params.maxPendingInboundEvents),
         nextMessage: 1,
         nextUpdateOrder: 1,
         onEvent: params.onEvent,
+        pendingInboundAdmissions: 0,
         pendingRequest: undefined,
         recorderPath: params.recorderPath ?? path.resolve(".crabline", "servers", "zalo.jsonl"),
+        retainedUpdateBytes: 0,
+        retainedUpdateCount: 0,
         reservedUpdateOrders: new Set(),
         restrictWebhookTargets: true,
+        updateBytes: new WeakMap(),
         updateOrders: new WeakMap(),
         updates: [],
         webhook: undefined,
         webhookDeliveryTimeoutMs: webhookDeliveryTimeoutMs(params.webhookDeliveryTimeoutMs),
+        webhookTransitionPending: false,
     };
     const httpServer = await startHttpJsonServer({
         handle: async (request, response) => {