@openclaw/feishu 2026.3.1 → 2026.3.7

package/src/monitor.state.ts

@@ -4,27 +4,104 @@ import {
   createFixedWindowRateLimiter,
   createWebhookAnomalyTracker,
   type RuntimeEnv,
-  WEBHOOK_ANOMALY_COUNTER_DEFAULTS,
-  WEBHOOK_RATE_LIMIT_DEFAULTS,
-} from "openclaw/plugin-sdk";
+  WEBHOOK_ANOMALY_COUNTER_DEFAULTS as WEBHOOK_ANOMALY_COUNTER_DEFAULTS_FROM_SDK,
+  WEBHOOK_RATE_LIMIT_DEFAULTS as WEBHOOK_RATE_LIMIT_DEFAULTS_FROM_SDK,
+} from "openclaw/plugin-sdk/feishu";
 
 export const wsClients = new Map<string, Lark.WSClient>();
 export const httpServers = new Map<string, http.Server>();
 export const botOpenIds = new Map<string, string>();
+export const botNames = new Map<string, string>();
 
 export const FEISHU_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
 export const FEISHU_WEBHOOK_BODY_TIMEOUT_MS = 30_000;
 
+type WebhookRateLimitDefaults = {
+  windowMs: number;
+  maxRequests: number;
+  maxTrackedKeys: number;
+};
+
+type WebhookAnomalyDefaults = {
+  maxTrackedKeys: number;
+  ttlMs: number;
+  logEvery: number;
+};
+
+const FEISHU_WEBHOOK_RATE_LIMIT_FALLBACK_DEFAULTS: WebhookRateLimitDefaults = {
+  windowMs: 60_000,
+  maxRequests: 120,
+  maxTrackedKeys: 4_096,
+};
+
+const FEISHU_WEBHOOK_ANOMALY_FALLBACK_DEFAULTS: WebhookAnomalyDefaults = {
+  maxTrackedKeys: 4_096,
+  ttlMs: 6 * 60 * 60_000,
+  logEvery: 25,
+};
+
+function coercePositiveInt(value: unknown, fallback: number): number {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    return fallback;
+  }
+  const normalized = Math.floor(value);
+  return normalized > 0 ? normalized : fallback;
+}
+
+export function resolveFeishuWebhookRateLimitDefaultsForTest(
+  defaults: unknown,
+): WebhookRateLimitDefaults {
+  const resolved = defaults as Partial<WebhookRateLimitDefaults> | null | undefined;
+  return {
+    windowMs: coercePositiveInt(
+      resolved?.windowMs,
+      FEISHU_WEBHOOK_RATE_LIMIT_FALLBACK_DEFAULTS.windowMs,
+    ),
+    maxRequests: coercePositiveInt(
+      resolved?.maxRequests,
+      FEISHU_WEBHOOK_RATE_LIMIT_FALLBACK_DEFAULTS.maxRequests,
+    ),
+    maxTrackedKeys: coercePositiveInt(
+      resolved?.maxTrackedKeys,
+      FEISHU_WEBHOOK_RATE_LIMIT_FALLBACK_DEFAULTS.maxTrackedKeys,
+    ),
+  };
+}
+
+export function resolveFeishuWebhookAnomalyDefaultsForTest(
+  defaults: unknown,
+): WebhookAnomalyDefaults {
+  const resolved = defaults as Partial<WebhookAnomalyDefaults> | null | undefined;
+  return {
+    maxTrackedKeys: coercePositiveInt(
+      resolved?.maxTrackedKeys,
+      FEISHU_WEBHOOK_ANOMALY_FALLBACK_DEFAULTS.maxTrackedKeys,
+    ),
+    ttlMs: coercePositiveInt(resolved?.ttlMs, FEISHU_WEBHOOK_ANOMALY_FALLBACK_DEFAULTS.ttlMs),
+    logEvery: coercePositiveInt(
+      resolved?.logEvery,
+      FEISHU_WEBHOOK_ANOMALY_FALLBACK_DEFAULTS.logEvery,
+    ),
+  };
+}
+
+const feishuWebhookRateLimitDefaults = resolveFeishuWebhookRateLimitDefaultsForTest(
+  WEBHOOK_RATE_LIMIT_DEFAULTS_FROM_SDK,
+);
+const feishuWebhookAnomalyDefaults = resolveFeishuWebhookAnomalyDefaultsForTest(
+  WEBHOOK_ANOMALY_COUNTER_DEFAULTS_FROM_SDK,
+);
+
 export const feishuWebhookRateLimiter = createFixedWindowRateLimiter({
-  windowMs: WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs,
-  maxRequests: WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests,
-  maxTrackedKeys: WEBHOOK_RATE_LIMIT_DEFAULTS.maxTrackedKeys,
+  windowMs: feishuWebhookRateLimitDefaults.windowMs,
+  maxRequests: feishuWebhookRateLimitDefaults.maxRequests,
+  maxTrackedKeys: feishuWebhookRateLimitDefaults.maxTrackedKeys,
 });
 
 const feishuWebhookAnomalyTracker = createWebhookAnomalyTracker({
-  maxTrackedKeys: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.maxTrackedKeys,
-  ttlMs: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.ttlMs,
-  logEvery: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.logEvery,
+  maxTrackedKeys: feishuWebhookAnomalyDefaults.maxTrackedKeys,
+  ttlMs: feishuWebhookAnomalyDefaults.ttlMs,
+  logEvery: feishuWebhookAnomalyDefaults.logEvery,
 });
 
 export function clearFeishuWebhookRateLimitStateForTest(): void {
@@ -64,6 +141,7 @@ export function stopFeishuMonitorState(accountId?: string): void {
       httpServers.delete(accountId);
     }
     botOpenIds.delete(accountId);
+    botNames.delete(accountId);
     return;
   }
 
@@ -73,4 +151,5 @@ export function stopFeishuMonitorState(accountId?: string): void {
   }
   httpServers.clear();
   botOpenIds.clear();
+  botNames.clear();
 }

package/src/monitor.test-mocks.ts

@@ -0,0 +1,45 @@
+import { vi } from "vitest";
+
+export function createFeishuClientMockModule(): {
+  createFeishuWSClient: () => { start: () => void };
+  createEventDispatcher: () => { register: () => void };
+} {
+  return {
+    createFeishuWSClient: vi.fn(() => ({ start: vi.fn() })),
+    createEventDispatcher: vi.fn(() => ({ register: vi.fn() })),
+  };
+}
+
+export function createFeishuRuntimeMockModule(): {
+  getFeishuRuntime: () => {
+    channel: {
+      debounce: {
+        resolveInboundDebounceMs: () => number;
+        createInboundDebouncer: () => {
+          enqueue: () => Promise<void>;
+          flushKey: () => Promise<void>;
+        };
+      };
+      text: {
+        hasControlCommand: () => boolean;
+      };
+    };
+  };
+} {
+  return {
+    getFeishuRuntime: () => ({
+      channel: {
+        debounce: {
+          resolveInboundDebounceMs: () => 0,
+          createInboundDebouncer: () => ({
+            enqueue: async () => {},
+            flushKey: async () => {},
+          }),
+        },
+        text: {
+          hasControlCommand: () => false,
+        },
+      },
+    }),
+  };
+}

package/src/monitor.transport.ts

@@ -4,9 +4,10 @@ import {
   applyBasicWebhookRequestGuards,
   type RuntimeEnv,
   installRequestBodyLimitGuard,
-} from "openclaw/plugin-sdk";
+} from "openclaw/plugin-sdk/feishu";
 import { createFeishuWSClient } from "./client.js";
 import {
+  botNames,
   botOpenIds,
   FEISHU_WEBHOOK_BODY_TIMEOUT_MS,
   FEISHU_WEBHOOK_MAX_BODY_BYTES,
@@ -42,6 +43,7 @@ export async function monitorWebSocket({
     const cleanup = () => {
       wsClients.delete(accountId);
       botOpenIds.delete(accountId);
+      botNames.delete(accountId);
     };
 
     const handleAbort = () => {
@@ -134,6 +136,7 @@ export async function monitorWebhook({
       server.close();
       httpServers.delete(accountId);
       botOpenIds.delete(accountId);
+      botNames.delete(accountId);
     };
 
     const handleAbort = () => {

package/src/monitor.ts

@@ -1,11 +1,11 @@
-import type { ClawdbotConfig, RuntimeEnv } from "openclaw/plugin-sdk";
+import type { ClawdbotConfig, RuntimeEnv } from "openclaw/plugin-sdk/feishu";
 import { listEnabledFeishuAccounts, resolveFeishuAccount } from "./accounts.js";
 import {
   monitorSingleAccount,
   resolveReactionSyntheticEvent,
   type FeishuReactionCreatedEvent,
 } from "./monitor.account.js";
-import { fetchBotOpenIdForMonitor } from "./monitor.startup.js";
+import { fetchBotIdentityForMonitor } from "./monitor.startup.js";
 import {
   clearFeishuWebhookRateLimitStateForTest,
   getFeishuWebhookRateLimitStateSizeForTest,
@@ -66,7 +66,7 @@ export async function monitorFeishuProvider(opts: MonitorFeishuOpts = {}): Promi
     }
 
     // Probe sequentially so large multi-account startups do not burst Feishu's bot-info endpoint.
-    const botOpenId = await fetchBotOpenIdForMonitor(account, {
+    const { botOpenId, botName } = await fetchBotIdentityForMonitor(account, {
       runtime: opts.runtime,
       abortSignal: opts.abortSignal,
     });
@@ -82,7 +82,7 @@ export async function monitorFeishuProvider(opts: MonitorFeishuOpts = {}): Promi
         account,
         runtime: opts.runtime,
         abortSignal: opts.abortSignal,
-        botOpenIdSource: { kind: "prefetched", botOpenId },
+        botOpenIdSource: { kind: "prefetched", botOpenId, botName },
       }),
     );
   }

package/src/monitor.webhook-security.test.ts

@@ -1,10 +1,21 @@
 import { createServer } from "node:http";
 import type { AddressInfo } from "node:net";
-import type { ClawdbotConfig } from "openclaw/plugin-sdk";
+import type { ClawdbotConfig } from "openclaw/plugin-sdk/feishu";
 import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  createFeishuClientMockModule,
+  createFeishuRuntimeMockModule,
+} from "./monitor.test-mocks.js";
 
 const probeFeishuMock = vi.hoisted(() => vi.fn());
 
+vi.mock("./probe.js", () => ({
+  probeFeishu: probeFeishuMock,
+}));
+
+vi.mock("./client.js", () => createFeishuClientMockModule());
+vi.mock("./runtime.js", () => createFeishuRuntimeMockModule());
+
 vi.mock("@larksuiteoapi/node-sdk", () => ({
   adaptDefault: vi.fn(
     () => (_req: unknown, res: { statusCode?: number; end: (s: string) => void }) => {
@@ -14,15 +25,6 @@ vi.mock("@larksuiteoapi/node-sdk", () => ({
   ),
 }));
 
-vi.mock("./probe.js", () => ({
-  probeFeishu: probeFeishuMock,
-}));
-
-vi.mock("./client.js", () => ({
-  createFeishuWSClient: vi.fn(() => ({ start: vi.fn() })),
-  createEventDispatcher: vi.fn(() => ({ register: vi.fn() })),
-}));
-
 import {
   clearFeishuWebhookRateLimitStateForTest,
   getFeishuWebhookRateLimitStateSizeForTest,
@@ -71,7 +73,7 @@ function buildConfig(params: {
           [params.accountId]: {
             enabled: true,
             appId: "cli_test",
-            appSecret: "secret_test",
+            appSecret: "secret_test", // pragma: allowlist secret
             connectionMode: "webhook",
             webhookHost: "127.0.0.1",
             webhookPort: params.port,

package/src/onboarding.status.test.ts

@@ -0,0 +1,25 @@
+import type { OpenClawConfig } from "openclaw/plugin-sdk/feishu";
+import { describe, expect, it } from "vitest";
+import { feishuOnboardingAdapter } from "./onboarding.js";
+
+describe("feishu onboarding status", () => {
+  it("treats SecretRef appSecret as configured when appId is present", async () => {
+    const status = await feishuOnboardingAdapter.getStatus({
+      cfg: {
+        channels: {
+          feishu: {
+            appId: "cli_a123456",
+            appSecret: {
+              source: "env",
+              provider: "default",
+              id: "FEISHU_APP_SECRET",
+            },
+          },
+        },
+      } as OpenClawConfig,
+      accountOverrides: {},
+    });
+
+    expect(status.configured).toBe(true);
+  });
+});

package/src/onboarding.test.ts

@@ -0,0 +1,143 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("./probe.js", () => ({
+  probeFeishu: vi.fn(async () => ({ ok: false, error: "mocked" })),
+}));
+
+import { feishuOnboardingAdapter } from "./onboarding.js";
+
+const baseConfigureContext = {
+  runtime: {} as never,
+  accountOverrides: {},
+  shouldPromptAccountIds: false,
+  forceAllowFrom: false,
+};
+
+const baseStatusContext = {
+  accountOverrides: {},
+};
+
+async function withEnvVars(values: Record<string, string | undefined>, run: () => Promise<void>) {
+  const previous = new Map<string, string | undefined>();
+  for (const [key, value] of Object.entries(values)) {
+    previous.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+
+  try {
+    await run();
+  } finally {
+    for (const [key, prior] of previous.entries()) {
+      if (prior === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = prior;
+      }
+    }
+  }
+}
+
+async function getStatusWithEnvRefs(params: { appIdKey: string; appSecretKey: string }) {
+  return await feishuOnboardingAdapter.getStatus({
+    cfg: {
+      channels: {
+        feishu: {
+          appId: { source: "env", id: params.appIdKey, provider: "default" },
+          appSecret: { source: "env", id: params.appSecretKey, provider: "default" },
+        },
+      },
+    } as never,
+    ...baseStatusContext,
+  });
+}
+
+describe("feishuOnboardingAdapter.configure", () => {
+  it("does not throw when config appId/appSecret are SecretRef objects", async () => {
+    const text = vi
+      .fn()
+      .mockResolvedValueOnce("cli_from_prompt")
+      .mockResolvedValueOnce("secret_from_prompt")
+      .mockResolvedValueOnce("oc_group_1");
+
+    const prompter = {
+      note: vi.fn(async () => undefined),
+      text,
+      confirm: vi.fn(async () => true),
+      select: vi.fn(
+        async ({ initialValue }: { initialValue?: string }) => initialValue ?? "allowlist",
+      ),
+    } as never;
+
+    await expect(
+      feishuOnboardingAdapter.configure({
+        cfg: {
+          channels: {
+            feishu: {
+              appId: { source: "env", id: "FEISHU_APP_ID", provider: "default" },
+              appSecret: { source: "env", id: "FEISHU_APP_SECRET", provider: "default" },
+            },
+          },
+        } as never,
+        prompter,
+        ...baseConfigureContext,
+      }),
+    ).resolves.toBeTruthy();
+  });
+});
+
+describe("feishuOnboardingAdapter.getStatus", () => {
+  it("does not fallback to top-level appId when account explicitly sets empty appId", async () => {
+    const status = await feishuOnboardingAdapter.getStatus({
+      cfg: {
+        channels: {
+          feishu: {
+            appId: "top_level_app",
+            accounts: {
+              main: {
+                appId: "",
+                appSecret: "sample-app-credential", // pragma: allowlist secret
+              },
+            },
+          },
+        },
+      } as never,
+      ...baseStatusContext,
+    });
+
+    expect(status.configured).toBe(false);
+  });
+
+  it("treats env SecretRef appId as not configured when env var is missing", async () => {
+    const appIdKey = "FEISHU_APP_ID_STATUS_MISSING_TEST";
+    const appSecretKey = "FEISHU_APP_CREDENTIAL_STATUS_MISSING_TEST"; // pragma: allowlist secret
+    await withEnvVars(
+      {
+        [appIdKey]: undefined,
+        [appSecretKey]: "env-credential-456", // pragma: allowlist secret
+      },
+      async () => {
+        const status = await getStatusWithEnvRefs({ appIdKey, appSecretKey });
+        expect(status.configured).toBe(false);
+      },
+    );
+  });
+
+  it("treats env SecretRef appId/appSecret as configured in status", async () => {
+    const appIdKey = "FEISHU_APP_ID_STATUS_TEST";
+    const appSecretKey = "FEISHU_APP_CREDENTIAL_STATUS_TEST"; // pragma: allowlist secret
+    await withEnvVars(
+      {
+        [appIdKey]: "cli_env_123",
+        [appSecretKey]: "env-credential-456", // pragma: allowlist secret
+      },
+      async () => {
+        const status = await getStatusWithEnvRefs({ appIdKey, appSecretKey });
+        expect(status.configured).toBe(true);
+      },
+    );
+  });
+});